Where To Start: Building a Company BC/DR Program

Since most companies do not have a comprehensive BC/DR program in place, how do you make the case in your company to invest in disaster recovery? The first order of business is to create a methodology for making an accurate BC/DR assessment.

Organizations that take the time to develop and test disaster recovery plans ahead of time will likely ride out catastrophes with minimal or no loss of data, hardware, or business revenue. This in turn allows them to maintain the faith and confidence of their customers, employees, business partners, and investors.

1. Perform a risk assessment or a business impact analysis.

Such an analysis focuses the plan on features that are most critical, which saves the organization time and money. A risk assessment helps CIOs focus on what they absolutely need to mitigate the core risks and, if necessary, defer the rest. Having risk controls in place make a potential disaster much less daunting.

 2. Think of business continuity and disaster recovery as extensions of company policy, not exclusively an IT issue.

A BC/DR program must be linked to overall corporate strategy, said Pat Corcoran, global client solutions executive at IBM. "If you can't demonstrate that, you've got a gap." What should drive BC/DR objectives are the business objectives themselves, not just systems and networks, which are simply support mechanisms for the business. The wrong approach is to make BC/DR a discreet area not integrated with the company's larger strategies. The two are often and should be one in the same.

3. Make BC/DR a component of the organizations normal change processes.

At most companies, BC/DR plans are an afterthought and not an integral part of the IT systems and business processes a company depends upon. Not incorporating BC/DR into the company's big picture is to jeopardize its core business functions, and to compromise the return on investment of the BC/DR strategy. It's all about implementation, and taking into account the company and systems architecture in place. Retrofitting a BC/DR plan after the fact is inviting risk.

4. Put a priority on business process resiliency.

Technology solutions are easier to put in place than changing people and processes to add resiliency. Again, it's about recognizing the imperatives of an organization, and determining which people, processes, and systems must be in place for the enterprise to continue uninterrupted. It's also valuable to take a close look at business metrics, which can enhance BC/DR.

5. Develop a five-year plan that reflects changes, reduced errors, and enhanced risk coverage.

BC/DR, like any other business process, needs to show constant improvement to provide business value.  "If you launch a program and have the same recovery times for the next five years, even if you are aligned with the business side, you're not delivering value," Toigo said. "Even if the only improvement is that you are driving the recovery time objectives down, that is removing risk from the business."

Track errors in testing, reexamine repeat errors for the root cause and set up programs to remove the errors. Also set benchmarks for incrementally improving recovery times over specific time periods. This requires diligence to all potentially impacted areas of operation, and an ongoing assessment of how different systems are dependent and interact.

6. Make sure BC/DR is dependent on more than a few trained individuals.

Have multiple individuals participate in testing your BC/DR plan. Even if all goes well in a test, if the same people are always performing the recovery, you're not as ready as you should be.

7. Document procedures, train employees and test the plan.

An untested plan is only a half-step above no plan at all. A report from Forrester Research states why IT management must be strong advocates of regular continuity and disaster plan testing: "Aside from an actual disaster, it's your only chance to ensure that everything works the way it should. The middle of a disaster is not the time to discover your plan isn't up to par."

Of the 50 percent to 70 percent of organizations that actually create disaster recovery plans, fewer than half actually test those plans, according to The Gartner Group.

Also in This Issue

• Reality Check: What If a Disaster Happened Today?
• Answers to 3 Common Disaster Recovery Questions
• The Lightpath Disaster Recovery Solutions Portfolio
• 2013 Hurricane Forecast
• 9 Links to Disaster Recovery Resources