If a disaster takes out one or more of your facilities, it's crucial that you have a failover site waiting in the wings. A failover site is a location where you can temporarily run the business while your primary location is being repaired, rebuilt or brought back into service. There are three types -- hot, warm, and cold -- and which type you choose can mean the difference between maintaining or losing business continuity.
The other extreme is a cold site, which is essentially just a bare facility. It could be anywhere -– a rented room, a vacant warehouse or any other unequipped location ready for immediate move-in during a disaster. This is certainly the cheapest of the three failover site options, and, possibly, the only affordable one for some SMBs. But think twice before designating an empty office advertised in the newspaper as your failover site. A cold site has to be completely equipped during a disaster, which takes money, and could mean significant downtime during crucial business activities.
The third option, a warm site, is the middle-of-the-road approach --it's part hot and part cold. While not completely equipped or ready, it is partially equipped with utility links that can be turned on as needed at a moment's notice. SMBs have several options when it comes to warm sites, including colocation -- sharing a failover site with other small companies. Of course, if the other companies are affected by the same natural disaster at the same time as your SMB, it could get awfully crowded, awfully quick.
The outsourcing option
Another option is to outsource disaster recovery operations, and there are a number of vendors that specialize in SMBs. Among them is SunGard Availability Services LP, which has an extensive network of data centers around the country that can be converted into temporary locations for your business at short notice. In addition, the Wayne, Pa.-based company has a mobile team that can assist in setting up a location closer to home, if needed.
If you decide to go with an outsourcer for your backup facilities, ask yourself the following questions:
- Is the vendor geared to the unique needs of SMBs and smaller companies?
- Are its facilities secure and in secure locations, with redundant systems?
- Does it have national or global reach?
- Does it have a proven track record in the disaster recovery field?
- Can the vendor encrypt my data during transmission, say, over the Internet to its backup facilities?
- Can it handle diverse computing platforms from mainframes to distributed environments?
Evaluate via risk analysis
Conducting a risk analysis that identifies your SMB's key core and critical activities will also help you decide which type of failover site is best for your SMB. A thorough risk analysis should:
- Identify those business functions that absolutely must be up and running at all times;
- Determine how those mission-critical functions could be moved quickly and efficiently to a temporary location; and
- Identify key staff members needed to run a disaster recovery site and backup staff in case of injury or even death.
Ultimately, whether you decide on hot or cold, warm or outsourced, your failover site must be in a safe area away from fires, floodplains, coastal areas, earthquake zones or terrorist targets. The important thing to remember is that with a well-chosen failover site, SMBs of all sizes can survive disaster.
Joel Dubin, CISSP, is an independent computer security consultant. He is a Microsoft MVP specializing in Web and application security, and is the author of The Little Black Book of Computer Security, available from Amazon. He has a radio show in Chicago on computer security and runs The IT Security Blog at www.theitsecurityguy.com.