IT execs are insecure about their disaster recovery plans.
That's according to a new survey by Rochester, N.Y.-based Harris Interactive Inc. that reported 39% of executives polled gave their plans a letter grade of C or worse, revealing a troubling lack of confidence in disaster readiness.
The survey results also indicated that this lack of confidence in disaster recovery planning is growing. A similar survey conducted in 2004 found that only 24% of executives gave their plans poor grades.
But the survey, sponsored by Wayne, Pa.-based SunGard Availability Services, which polled 57 senior executives at U.S. companies with more than $500 million in revenue, did find that 46% of executives said they are more prepared than they were a year ago.
"Businesses that are truly prepared, that have a pretty good level of confidence, are not just paying lip service to having a plan in place," said Michael Croy, director of business continuity at Forsythe Technology Inc. in Skokie, Ill. "They're also testing that plan and having an impartial third party sitting in there and seeing how that plan will work."
Donna Scott, a vice president and distinguished analyst at Stamford, Conn.-based Gartner Inc., agreed that a high percentage of companies lack confidence in their plans, but she rejected the notion that things are getting worse.
"I would say I'm seeing improvements," Scott said. "I think the amount [of companies with suspect plans] is shrinking, because of Sarbanes-Oxley and other regulations and the huge amount of awareness created by Sept. 11, Hurricane Katrina and the blackouts in recent years. There were companies that were struggling to survive [during disasters], and that awareness has reached the CEO and the board room."
Scott said that after the terrorist attacks of Sept. 11, many companies spent all of 2002 and part of 2003 reviewing their disaster recovery plans.
"Then if they decided to make a change it took another couple years to make that change," she said. "The decision to open or close data centers or to write an outsourcing contract is not something you do overnight."
However, Stephanie Balaouras, senior analyst at Cambridge, Mass.-based Forrester Research Inc., suspects the large number of uneasy executives reveals that many companies don't have a formal business continuity plan, with procedures and strategies for how the business as a whole responds to an emergency.
"I think they spend a lot of money on technology," Balaouras said. "Sixty to 70% of enterprises have a backup data center. But I don't think they take enough time to test and maintain a plan. They're focused on the technology but they didn't go into the formal business continuity planning process."
And once that plan is established, a company can't let it gather dust.
Scott said many companies build a plan, test the plan once, "then throw it on the shelf. If they don't test it again, if they don't have regular tests, then it's not really a plan."
"You've got to review that plan constantly," said Bruce Thomas, CEO of Calcasieu Teachers and Employees' Credit Union in Lake Charles, La.
When Hurricane Rita struck in September 2005, just a few weeks after Hurricane Katrina devastated New Orleans, Thomas' employees were forced to evacuate their offices. For more than three weeks they operated out of a mobile SunGard facility in a town outside the area affected by Rita.
"It's not like you develop the plan and put it on your shelf and forget about it," Thomas said. "If you're not putting your hands on it at least once a week then you don't have a viable plan. We've seen businesses here when the hurricane hit -- they didn't have any plan. They basically just shut their doors and never came back."
Ron Maillette, senior vice president of information services at NuCO2 Inc., a Stuart, Fla.-based distributor of carbon dioxide for the beverage and food service industries, said his company approaches disaster planning from a true business continuity perspective wherein information technology is just a subset of an overall plan that is constantly reviewed.
Maillette just opened a new data center in Tulsa, Okla., that will serve as NuCO2's primary data center. The company's old data center in its Stuart headquarters will take on a more secondary role. The Tulsa data center also has a hot backup site for the company's call center.
Maillette said 24/7 service by his company's call center is critical with 125 depots in 46 states. Customers in states not affected by a hurricane in Florida will have no tolerance if the call center in Stuart goes down and they can't order CO2 from a local depot.
"Most companies take a very narrowly defined approach," Maillette said. "They focus too heavily on IT as opposed to processes and procedures. Testing is extremely important if you're serious about it."
When Hurricane Ernesto was bearing down on Florida two weeks ago, Maillette was able to test the backup call center. In advance of the storm, several of the company's call center staff was sent to Tulsa to ensure uninterrupted coverage in case Ernesto knocked out the Stuart office.
Ernesto packed very little punch by the time it passed through Florida, and ultimately NuCO2 didn't suffer any outages. But Maillette said the exercise proved to be an excellent test for the company's business continuity plan. Call center employees operated in both Tulsa and Stuart simultaneously with complete transparency.
Maillette said his company tests its business continuity plan at least once a year. However, practically speaking, his company tests the plan much more often because the constant threat of hurricanes in South Florida sometimes forces NuCO2 to enact the plan in advance of storms.
"Unfortunately because of the weather [our plan] has been tested because of reality," Maillette said. "Even though Ernesto didn't clobber us, we constantly monitor the weather. We can't gamble. We pull into action ahead of time."
Let us know what you think about the story; email: Shamus McGillicuddy, News Writer