Manage Learn to apply best practices and optimize your operations.

Disaster recovery still not a priority for most CIOs

Disaster recovery planning still isn't a priority for many CIOs, who are expected to spend more time fixing current problems than preparing the business for future ones.

Disaster recovery (DR) and business continuity (BC) plans often fall through the cracks as IT staffs and company executives focus more on fixing problems that crop up and keeping up with competitors in an increasingly nimble global economy.

According to Stephanie Balaouras, a senior analyst at Forrester Research Inc. in Cambridge, Mass., a company's organizational chart can play a huge role in whether it has a plan. While business continuity plans often fall under the purview of a senior-level executive, DR plans (see "DR in six steps," at left) generally are left to the IT department, which must make a compelling business case to upper management to receive approval to spend staff time and resources on developing a plan.

Who has a plan?

Two-thirds of companies with 1,000 or more employees have a backup site to recover key data should the primary data center fail, according to Forrester.

"That sounds good until you look at the other side, that 34% of larger companies don't have a backup plan at all," Balaouras said. "A lot of companies cross their fingers and hope for the best. Six years after 9/11, it's surprising that one-third don't have a plan."

Of those companies that have a DR plan, 23% don't test at all and 40% test just once a year, according to Forrester.

In need of DR approval

The IT department at House of LaRose Inc., a beverage distributor in Brecksville, Ohio, had no problem convincing company owners of the need for a formal DR plan, following the failure of the motherboard on its Novell NetWare system in 2004. The incident cost the company thousands in overhead and business losses while waiting for a new one.

DR in six steps
1. Initiate the project. Identify and verify the business continuity and disaster recovery requirements. Begin the business continuity management process.

2. Analyze the business impact. Assess how dependent each business process is on IT services and the potential losses due to business process interruptions (financial, legal, possible risk to the company's reputation). Also examine the organization's capabilities to address the problem (people, technology).

3. Determine the risk. Evaluate what effects various disasters could have on IT services, and how vulnerable the business is to these potential disruptions.

4. Develop a strategy. Identify available recovery options (processes, technologies) and ways to mitigate risks.

5. Implement the project with the following steps:
  • Plan the implementation process (organizational and technological issues).
  • Determine which tasks to outsource and which to keep in-house (for both implementation and operation).
  • Secure the necessary budget to execute the project.
  • Implement measures to mitigate risk.
  • Build the technological solution
  • Develop the organizational BC/DR procedures.
  • Test the technologies and procedures.
6. Operate the system. Train staff directly involved in the BC/DR process. Educate and raise awareness among staff members not directly involved in the BC/DR process. Align IT Infrastructure Library processes with BC/DR requirements; conduct ongoing testing of the process; regularly review and audit the effectiveness of the technologies and processes; and modify the system if necessary.

Source: Forrester Research Inc.

 "We never had the budget for backup, and, because we hadn't had any problems, no emphasis was put on it," said Dan Brinegar, IT administrator. "When the motherboard went down, we basically couldn't deliver any beer until it was fixed."

Following that isolated but significant event, Brinegar quickly received approval for a three-phase plan to create a backup system, build a redundant site elsewhere within the distributorship and blanket these two with a tape backup system. "If server A goes down, we can move forward to determine the type of crash and scenarios for bringing it back up," Brinegar says. "We can be up and running in four to five hours in the worst case."

Testing pays off

House of LaRose chose FalconStor Software Inc. in Melville, N.Y., for its backup systems after exhaustive testing of many products. Brinegar insisted on testing so he could draw lines between vendor claims and the actual performance of products.

"Many vendors will tell you what you want to hear, but only you can determine whether software is or is not a good fit for what you need it to do," Brinegar said. "It's not just about the software, but about the fit of the software and the company that provides it."

The Ohio State University spends about $100,000 annually on DR efforts, an amount that will grow as new technology comes along, said Bruce Boda, senior systems manager at the Columbus-based university. The university began a comprehensive look at its DR efforts three years ago, supported by $250,000 in planning and implementation funds from the Ohio Board of Regents and led by the state's office of information technology.

Each department has its own DR plan that's managed at the IT level. "In the event of a disaster, management will assess the impact (local, regional or national), then look at the impact on the university," Boda said.

The university has a reciprocal database backup agreement with the University of Cincinnati, and that infrastructure is tested on an annual basis. Boda said that should an event require use of the backup location, most operations can be restored within 24 hours, with the rest coming online within three days.

"Disaster recovery efforts are built into our daily job duties," Boda said. "As equipment is upgraded, the DR plan is checked and old equipment may be repurposed for use in the DR environment."

Matt Bolch is a freelance writer based out of Atlanta. He can be reached at

Dig Deeper on Enterprise disaster recovery and business continuity planning

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.