Business Continuity & Disaster Recovery - Planning Advice

1.    I back up all my corporate data onto tape - do I really need a business continuity solution?

These terms can be misleading, so let’s make sure we are talking about the same things. Business continuity is PROACTIVE - its aim is to identify then avoid or mitigate risk and it usually includes more than just IT systems. Disaster recovery is REACTIVE and focuses on restoring the operational running of a business after a risk or incident occurs. Disaster recovery is an integral part of a business continuity plan.

If you are asking whether your business needs a strategy to avoid or mitigate the business impact of a risk, then the answer should be a resounding yes.  Is effective backup part of a good business continuity strategy? Absolutely, but it is not the full story. What are you going to recover your tapes to? Do you have a spare tape library, spare servers and maybe even a spare data centre? Where will your staff work in the event of a disaster? How will your staff communicate? If you can’t answer any of these questions then you don’t have a business continuity strategy.

2.    What solutions are out there and how much are they?

A business continuity strategy is broader than a business continuity solution. My view is that a business really needs a strategy first and foremost. The strategy needs to consider the risks that exist for both IT and non-IT elements of the business, what the impact of those risks is and what strategy is in place to deal with them.

Business continuity solutions exist that help formulate and document your business continuity strategy, whilst other solutions focus on using technology to help maintain service. The latter includes tools such as backup, synchronous storage options, clustering and high availability - each platform will have a variety of tools to achieve a specific goal. The general principle is that the less downtime you can spare and the less data you can afford to lose, the more you will have to pay. In business continuity-speak, this is known as the recovery point object and recovery time objective (RPO and RTO).

3.    Do such solutions really form a part of the network – are they the IT department’s responsibility?

The business continuity strategy should involve the whole business.

The IT department might be involved in providing software to help people effectively plan and document the business continuity strategy. The IT department will most definitely be involved in communicating the potential risk to IT systems and implementing adequate preventative measures to match the RPO and RTO required by the business.

Whilst there is no advantage to exceeding your RPO and RTO requirements, you absolutely can’t afford to miss the target.  The network is one of the most precious IT assets you have - you must intimately understand what risks it faces and have effective proactive strategies to ensure its survival or recovery.

4.    If so, what are the challenges for network managers when deploying them?

The biggest challenge is when you are forced to implement a disaster recovery solution without complete buy-in from the business. You could, for example, deliver a fully resilient network and data centre only to discover that no alternative office space has been procured, nor any way of connecting to the data centres. It is unfair when IT managers carry the burden for the survival of the entire business and are expected to identify every risk. Push back on the business and get them to understand it is a collaborative effort.

5.    Can you illustrate what you say with any specific examples or brief case studies?

Adapt worked with a market-leading provider of currency exchange services to devise a business continuity solution that would meet the most demanding recovery point and recovery time objectives.

The technical solution that Adapt designed with the customer’s IT department is a core element of their wider business continuity strategy - an integrated approach that offers best possible chance of mitigating or avoiding a variety of business impacting events both in the data centre and at office locations.

6.    Any other points worth considering?

Become a trusted consult - help the business to articulate its RTO and RPO and identify risks collaboratively rather than making it a wholesale IT concern. Once the business understands its collective responsibility, your job will be much easier - good luck!