Lion Cipher Lab
Run a call-tree drill and measure it against the notification limit
- GRC / Compliance
- Intermediate
- ~35 min
- Free · no account required
Why it matters
When a disaster or a serious incident is declared, the first thing that has to work is reaching people. Most continuity plans use a call tree: the coordinator calls a few people, each of them calls a few more, and so on. NIST SP 800-34 Rev. 1 describes call trees and says they should account for primary and alternate contact methods and for what to do when someone cannot be contacted. It also gives call trees as an example of a test: 'an organization could test call tree lists to determine if calling can be executed within prescribed time limits'. Plans rarely get that test. When they do, the…
What you'll learn
- testing a call tree the way NIST SP 800-34 describes
- separating 'unreachable' from 'never called'
- finding people the tree assigns to no caller
- measuring critical roles against a time limit
- why '% of people reached' overstates readiness
- fixing the tree with alternates and escalation
Steps in this lab
- A call tree is a plan that has to be tested
- The tree and the drill results
- Write the drill analysis
- Run it: one missed call stopped a branch
- Fix the tree, then drill again