Disaster recovery (DR) and business continuity (BC) plans often fall through the cracks as IT staffs and company executives focus more on fixing problems that crop up and keeping up with competitors in an increasingly nimble global economy.
According to Stephanie Balaouras, a senior analyst at Forrester Research Inc. in Cambridge, Mass., a company's organizational chart can play a huge role in whether it has a plan. While business continuity plans often fall under the purview of a senior-level executive, DR plans (see "DR in six steps," at left) generally are left to the IT department, which must make a compelling business case to upper management to receive approval to spend staff time and resources on developing a plan.
Who has a plan?
Two-thirds of companies with 1,000 or more employees have a backup site to recover key data should the primary data center fail, according to Forrester.
"That sounds good until you look at the other side, that 34% of larger companies don't have a backup plan at all," Balaouras said. "A lot of companies cross their fingers and hope for the best. Six years after 9/11, it's surprising that one-third don't have a plan."
Of those companies that have a DR plan, 23% don't test at all and 40% test just once a year, according to Forrester.
In need of DR approval
The IT department at House of LaRose Inc., a beverage distributor in Brecksville, Ohio, had no problem convincing company owners of the need for a formal DR plan, following the failure of the motherboard on its Novell NetWare system in 2004. The incident cost the company thousands in overhead and business losses while waiting for a new one.
"We never had the budget for backup, and, because we hadn't had any problems, no emphasis was put on it," said Dan Brinegar, IT administrator. "When the motherboard went down, we basically couldn't deliver any beer until it was fixed."
Following that isolated but significant event, Brinegar quickly received approval for a three-phase plan to create a backup system, build a redundant site elsewhere within the distributorship and blanket these two with a tape backup system. "If server A goes down, we can move forward to determine the type of crash and scenarios for bringing it back up," Brinegar says. "We can be up and running in four to five hours in the worst case."
Testing pays off
House of LaRose chose FalconStor Software Inc. in Melville, N.Y., for its backup systems after exhaustive testing of many products. Brinegar insisted on testing so he could draw lines between vendor claims and the actual performance of products.
"Many vendors will tell you what you want to hear, but only you can determine whether software is or is not a good fit for what you need it to do," Brinegar said. "It's not just about the software, but about the fit of the software and the company that provides it."
The Ohio State University spends about $100,000 annually on DR efforts, an amount that will grow as new technology comes along, said Bruce Boda, senior systems manager at the Columbus-based university. The university began a comprehensive look at its DR efforts three years ago, supported by $250,000 in planning and implementation funds from the Ohio Board of Regents and led by the state's office of information technology.
Each department has its own DR plan that's managed at the IT level. "In the event of a disaster, management will assess the impact (local, regional or national), then look at the impact on the university," Boda said.
The university has a reciprocal database backup agreement with the University of Cincinnati, and that infrastructure is tested on an annual basis. Boda said that should an event require use of the backup location, most operations can be restored within 24 hours, with the rest coming online within three days.
"Disaster recovery efforts are built into our daily job duties," Boda said. "As equipment is upgraded, the DR plan is checked and old equipment may be repurposed for use in the DR environment."
Matt Bolch is a freelance writer based out of Atlanta. He can be reached at firstname.lastname@example.org.