Being prepared for a continuity event involves more than just having a plan in place and distributing it to the team. Your credit union should run periodic tabletop exercises, where credit union executives and other team members review how the credit union would respond in the event of a cyber-attack, natural disaster, terrorist attack, or other continuity event.
As hurricane season begins, it is especially important to have a tested plan in place, as hurricanes often only provide a few days of preparation and can shift to new paths at the last minute. In this blog, we’ll discuss what a tabletop exercise is, and why your credit union should conduct them.
What Is A Tabletop Exercise?
A tabletop exercise serves as a practical evaluation tool to assess a group’s preparedness in responding to various hypothetical scenarios, such as fires, major weather events, pandemics, or cyber incidents. Facilitated by an organizer, participants simulate their reactions based on their established business continuity plans, discussing the necessary steps as if the crisis were unfolding.
The participation of executives is crucial, with representation from all functional areas of the credit union. The facilitator may introduce additional challenges and test decisions against existing response procedures, ensuring a focus on adherence to the established plans. This approach minimizes the risk of straying from the planned response and proves invaluable in a credit union’s business continuity program (BCP).
If your credit union regularly experiences hurricanes, you might think your response plan doesn’t need further review or testing; however, as storms continue to strengthen and each season brings a new historic storm and level of damage, it is important to continue to assess your credit union’s readiness. Hurricane season may only last six months, but the effects of a single storm can take years for a community to recover from.
Why Are Tabletop Exercises Important?
As the quote “By failing to prepare, you are preparing to fail” implies, inadequate preparation sets the stage for failure, while thorough preparation leads to success. Tabletop exercises embody this principle by fostering collaboration among staff while rehearsing their response plans. Regularly conducting these exercises enhances a credit union’s readiness for the inevitable occurrence of an actual crisis.
For credit unions in areas regularly affected by hurricanes, it has the added benefit of ensuring your staff is prepared to take care of themselves in the event of a storm. Remind staff they should always have bottled water, batteries, shelf-stable food, and flashlights on hand during hurricane season. Members would also benefit from reminders to keep these supplies on hand.
However, merely enacting a disaster scenario is just one facet of the exercise. Debriefing, considered a best practice, allows participants to reflect on the lessons learned during the tabletop exercise. The true value of these exercises lies in identifying weak areas or missing steps — known as gaps — within incident response plans.
If your credit union’s hurricane plan does not have contingency for structural damage to a branch or a plan for allowing employees to work from home in the immediate aftermath, those gaps should be documented during the exercise and transformed into actionable steps for plan enhancement. Each identified, addressed, and rectified gap contributes to the overall strength of response plans and the BCP.
How Often Should My Credit Union Conduct A Tabletop Exercise?
How often your credit union conducts these exercises will depend on its unique needs. If you have had continuity events in the past that your credit union has managed well, you might want to pursue only a once or twice a year approach, focusing on those events your credit union has not yet experienced or on ways to improve on plans you have had to use.
If your credit union is smaller or younger and is just building continuity plans, you might benefit from a quarterly schedule. This will allow your credit union to begin practicing your responses and prepare for any potential threats headed your way.
If your credit union regularly experiences hurricanes, it might be beneficial to conduct an exercise at the start of hurricane season. Sending a reminder of the plan to staff, at the very least, can ensure all staff are prepared to respond to a potential storm.
In the end, how often your credit union conducts tabletop exercises will depend on its situation and needs. Be aware of your environment. If you are in an area prone to natural disasters — such as the Florida coast with its hurricanes or California with the potential for wildfires — make sure your credit union is aware of and ready for those potential events.
Tabletop exercises are simple, easy ways to make sure your credit union is prepared for a continuity event. For more information on how Trellance can help your credit union with its business continuity needs, please contact us.
