Sat, June 01, 2002 — CIO — I’VE MARVELED OVER THE YEARS how otherwise-prudent executives have remained somewhat indifferent about the consequences of a disaster. The attacks on the World Trade Center and the Pentagon were so extraordinary as to defy the imagination of even the very best disaster recovery planners. Of course, disasters of that magnitude are not the first place that CIOs and other IT professionals should be directing their attention. Instead, they need to tackle the rudiments.

Consider, for instance, the case of the deep-fryer. A conscientious company enthusiastically backed up its data on a daily basis, a practice that is a basic tenet of data recovery. But when the deep-fryer in the cafeteria?which was located one floor below the data center?erupted into flames, the backup tapes were destroyed, along with much of the data center. Why? Because the company failed to secure the tapes at an offsite location, another basic tenet of data recovery.

Here are some things to remember when developing a business continuity strategy.

Write it down. Develop a business recovery plan. Use documented, predetermined procedures and tactics to restore mission-critical business functions and avert unacceptable loss.

Understand vulnerabilities and risks. That requires a risk assessment?a process for analyzing the probability of what can happen, what current business functions may be affected and what is the likely affect on the organization based on the length of the outage.

Assess the impact. Determine the amount of time the company can afford to be out of operation, as measured in revenue as well as intangibles such as investor confidence and legal implications. The amount of time you can afford to be down will determine the next step.

Finalize on strategy. While the amount of allowable downtime will determine the strategy for the most part, it is no longer as simple as choosing between "hot-site" and "cold-site." Today’s environments and capabilities provide a number of permutations of basic options. Choose the ones that are right for your organization.

Don’t stop planning. Ongoing updating of plans is absolutely essential. The plans should be regularly tested by staff to ensure they work and provide an appropriate level of protection.

Finally, the very heart of disaster planning is balancing the cost of protection and recovery with the risk. That principle must be constantly applied during every segment of the recovery planning process to ensure that you invest only in what is essential for protection and recovery.

Disaster recovery is often an IT afterthought, yet asking What if? today can prevent you from wondering Why me? tomorrow.