I’ve marvelled over the years at how otherwise-prudent executives have remained somewhat indifferent about the consequences of a disaster. The attacks on the World Trade Centre and the Pentagon were so extraordinary as to defy the imagination of even the very best disaster recovery planners. Of course, disasters of that magnitude are not the first place that CIOs and other IT professionals should be directing their attention. Instead, they need to tackle the rudiments.Consider, for instance, the case of the deep-fryer. A conscientious company enthusiastically backed up its data on a daily basis, a practice that is a basic tenet of data recovery. But when the deep-fryer in the cafeteria, located one floor below the data centre, erupted into flames the backup tapes were destroyed, along with much of the data centre. Why? Because the company failed to secure the tapes at an offsite location, another basic tenet of data recovery.Here are some things to remember when developing a business continuity strategy. Write it down. Develop a business recovery plan. Use documented, predetermined procedures and tactics to restore mission-critical business functions and avert unacceptable loss. Understand vulnerabilities and risks. That requires a risk assessment process for analysing the probability of what can happen, what current business functions may be affected and what is the likely affect on the organisation based on the length of the outage. Assess the impact. Determine the amount of time the company can afford to be out of operation, as measured in revenue as well as intangibles such as investor confidence and legal implications. The amount of time you can afford to be down will determine the next step.Finalise on strategy. While the amount of allowable downtime will determine the strategy for the most part, it is no longer as simple as choosing between “hot site” and “cold site”. Today’s environments and capabilities provide a number of permutations of basic options. Choose the ones that are right for your organisation. Don’t stop planning. Ongoing updating of plans is absolutely essential. The plans should be regularly tested by staff to ensure they work and provide an appropriate level of protection. Finally, the very heart of disaster planning is balancing the cost of protection and recovery with the risk. That principle must be constantly applied during every segment of the recovery planning process to ensure that you invest only in what is essential for protection and recovery. Disaster recovery is often an IT afterthought, yet asking “What if?” today can prevent you from wondering “Why me?” tomorrow. As senior manager in Accenture’s Chicago office, Michael Symmers is responsible for the business, continuity and disaster recovery practice.
Join the CIO New Zealand group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.