Recover, resume, repeat

Business continuity and disaster recovery are, firstly, critical for any business that plans to stay in business, and, secondly, not synonymous.

Business continuity refers to those things that ensure the business can remain operational in the face of minor hiccups and bog-standard crises, like regular power failures. Disaster recovery is what will ensure survival in the face of a major disaster; for example, the building burns down. Companies need to make plans for both.

Says CommVault business development director Bryan Balfe: “The biggest problem companies face with disaster recovery is the issue of where to start, as it is such an amorphous, multifaceted problem without a single, neat solution.”

It's a management discipline. Companies try to do it and forget about it, but it needs to be ongoing.

Justin Hamman, business development manager, Continuity SA

This is partially the reason why companies either ignore the potential major disasters and focus on the small stuff, or do the converse - plan for total annihilation and forget to take the annual flu epidemic into account.

Balfe concurs: “Disaster recovery is always something that gets the CEO's attention when he sees it on a PowerPoint. Boards are happy to fund big DR projects. Unfortunately, in our experience, the bill these plans try to fit is Armageddon. So it includes getting staff to a new location with seats and desks and phones, etc. A lot of cash goes into replicating data live in two sites so that systems can fail over. The problem is that time, money and attention is focused on this, and not on virus attacks, data corruption, or hungover admins doing silly things on a Monday morning.

“What we're trying to get people to do is to take a step back and say, 'What is a disaster'? A company's e-mail system crashing at financial year-end when the sales team is trying to get big orders in, for example, is a disaster. So the first thing companies should do is try to define what a disaster is, then to rank the disasters, and then build a plan that deals with various levels of crises,” he states.

The above assumes any given company has a plan, however, and that's not necessarily the case.

Softline Accpac strategic sales VP Keith Fenner says many of his company's customers (mid-market companies) don't have BC or DR plans. “A lot of companies haven't taken those steps; they're still trying to get their heads around the concepts.”

It becomes a compliance issue to have a BC and DR plan.

Keith Fenner, strategic sales VP, Softline Accpac

Fenner says his company has identified three levels of BC and DR, and is trying to assist its client base with these where it can, primarily on its hosted offerings.

“The first level is backing up - and we hope everyone is doing that. The second level is looking at IT infrastructure and saying, 'I have a set of applications and I have data and if the servers crash, how quickly can I access my data and applications?' The third level is where the big guys are at - having a complete site to which to move staff and operations.”

This third level is also where the money is, as it were. It's also something that a lot of companies are probably wishing they didn't have to spend hard cash on.

“It's like when seat belts first came in,” says Continuity SA business development manager Justin Hammann, “people were asking how long they would have to wear them for. And the answer is: forever. BC is like that. It's a management discipline. Companies try to do it and forget about it but it needs to be ongoing.”

It's also an investment that is not optional for many organisations. “If you are a publicly listed company and people are investing and trading in your stock, then it becomes a compliance issue to have a BC and DR plan,” states Fenner.

Hamman concurs: “Are people trying to cut BC and DR budgets? If you look at the global financial crisis, it can be attributed to the fact that financial institutions were taking short-term profit over long-term sustainability. Investors, for the next few years, will be looking for companies that are visibly mitigating risk. BC and DR are very valuable now, and we'll be seeing both featured prominently in annual reports in future.

“We're talking to companies that have had BC&DR on the 'to do' list for three years. They're holding off on capex expenditure now, and outsourcing it, thus turning it into an opex and enabling them to address it,” he adds.

“The piece [of the BC and DR puzzle] that's becoming increasingly relevant is proving that it is in place and functional,” says Balfe. “CIOs are increasingly being told that they must be able to prove that plans are in place, and can cater to a number of responses.

“It's all too easy to go for a big bang scenario and go for one of the 10 big ones,” he adds. “If something else [that's not what your plan caters for] goes wrong, your answer will be the wrong one for the business. Where we're focusing the conversations we have with customers is by taking it away from the technology and focusing on the business requirement. That's what drives it; otherwise you're dealing with an academic scenario.”

Another common mistake is CIOs trying to do it themselves.

“This is where our biggest competition comes from,” admits Hammann. “BC and DR are a skill and management discipline that many companies don't really have, but we find IT directors and CIOs who believe they can turn it into their own project, do the risk analysis themselves and build a DR and BC solution. This goes against the global best practice grain.” And deprives service providers of business.

Hammann does have a point, however, and that is that, as in so many instances, companies that do DR and BC as a core business are in all probability going to be better at it than companies whose core business is totally unrelated. Your mileage may vary.

“Many companies don't know how close to disaster they come,” he states, reflecting on a local fresh produce company that listed in 2007 and nearly went bankrupt in 2008. A power failure killed off half of the company's mushroom crop. Then the remaining half was left standing on the dock at Durban Harbour, where a further half of it rotted due to a shipping delay. The solution? A generator or alternative power source at its mushroom farm and contingency plans for shipping.

“Obviously the company was focusing on growth and revenue rather than battening down processes and looking at mitigating risk,” Hamman states.

The story never made headlines either - the company concerned blamed its near demise on the market and the current economic climate, and is still listed, and still operational. As Hamman notes, however, shareholders and the market can be very unforgiving of such things. In the current climate more so than ever, ITWeb suspects, and our anonymous case study can count itself lucky it's become an anecdote, and not a BC and DR reference case.