Salow is getting them out in a grand way?and we’re not just talking about the obvious decision, say, to start storing backup tapes for the office automation servers farther away from headquarters than the basement of the Trade Center. American Express’s technology operations were already spread out, but the company decided to house only a few technology operations in its New York headquarters, such as the bare requirements of telephones and networked desktop computers.

It’s part of a move to make continuity planning geography-based, not building-based. "We had a disaster-recovery plan for this building. We had a disaster-recovery plan for 7 World Financial Center, where we had our bank back office. Each building continuity plan worked, but we hadn’t contemplated losing all of Southern Manhattan," he says. Now, Salow is looking at what might happen if business shuts down in Phoenix or Minneapolis, where the company’s IT operations are based. "A CIO I worked for a long time ago used to say, ’You lose a whole data center every 10,000 years,’ which was his excuse for not having disaster recovery, which was stupid then. You have to assume it’s more likely to happen now, and it’s affecting larger geographic areas."

Salow also signed a seven-year, $4 billion outsourcing deal with IBM Global Services, announced in February. About 2,000 members of his 6,000-person IT team are being transferred to IBM. (So far, about 99 percent of them have accepted the offer, he says.) Salow says the deal will save hundreds of millions of dollars and likens it to purchasing electricity rather than generating it. For less money, he says, American Express can draw on the resources it needs, when it needs them.

Salow went ahead with the IBM deal despite the fact that 9/11 taught him how much he already relied on his vendors. In the future, he says, he’ll spend more time delving into how his vendors would recover from a disaster. But some vendors have already proven themselves with their actions. "If I look at the role IBM Global Services played for us, at the role Compaq played for us, they’ve got every bit of help we could ask for, and it’s there before we could ask for it," he says. With the outsourcing deal, he says, "On the one hand, we’re more dependent on IBM Global Services, but on the other hand, I think I got a really cheap insurance policy."