Executive Overview

Predefined methods for business recovery provide templates for IT service recovery planning. They typically leave out three key issues in need of a strategy:

• How to deal with distributed systems

• How to avoid data destruction in a disaster

• How much to invest in recovery facilities

How Do You Deal with Distributed Systems?

• The distributed architecture paradigm drastically increases the complexity of business continuity planning.

• To succeed, business continuity planning has to focus on an IT service recovery model.

RECOMMENDATION : Designate the "custodian" of an IT resource as responsible for the recovery of the IT services after a disaster.

RECOMMENDATION : Focus on improving the IT documentation necessary for business continuity.

RECOMMENDATION : Organize IT documentation by "service," with individuals responsible for recovery assigned the responsibility for maintaining the documentation.

How Do You Avoid Data Destruction in a Disaster?

• You can purchase new hardware, build new buildings , even hire new employees , but you must have an intact "copy" of your data for successful recovery.

• Storing the copy in a remote location decreases your risk of losing both the original and the copy in a disaster.

• The potential exists in a disaster to lose all data changes that have occurred since the delivery of the last copy of the data to the remote location.

• Options exist to speed up the movement of the copy to the remote location.

RECOMMENDATION : Implement a second-generation storage network with remote disk mirroring. (This will have to be approached on an incremental basis to avoid a large one-time infrastructure investment.)

RECOMMENDATION : Replace the current tape-based disaster backup strategy inherited from the mainframe with remote disk mirroring.

RECOMMENDATION : Locate the remote disk mirror in a remote location. Potential vendors exist in most metropolitan areas.

RECOMMENDATION : Store the IT documentation electronically in the SAN to take advantage of the remote disk mirroring.

How Much Do You Invest in Recovery Facilities?

• Your recovery facility strategy determines how soon services will be available again following a disaster.

• The tasks required to build a recovery facility are about the same amount of work before or after the disaster.

• The only way to decrease the time it takes to get the recovery facility in service is to put some or all of the recovery facility in place before the disaster. The more you put in place before the disaster, the sooner you will have IT services after a disaster.

• The more you put in place before the disaster, the higher your overhead costs to maintain the recovery facilities until the disaster.

• A disaster is not a certainty . The money spent before the disaster amounts to insurance against lost IT services.

• Lacking a risk assessment on paper, an organization's budget tends to make more decisions concerning the recovery facility than concerning the threat of a disaster.

RECOMMENDATION : Create a formalized risk assessment process. (Security issues contain a parallel requirement for predictable risk assessments.)

RECOMMENDATION : Identify the acceptable downtime for each IT service based on the documented risk assessment.

RECOMMENDATION : Identify key vendors for replacement equipment.

RECOMMENDATION : Establish lead time for replacement equipment in the event of a disaster.

RECOMMENDATION : Establish the need for a recovery site based on lead time rather than acceptable downtime.

RECOMMENDATION : Document and maintain all of this information in an SLA for IT customers to consider in gap analysis.