Backup & Storage

For some companies, the cost of business interruptions can be huge.

If there are even a few days when products can't be shipped and orders can't be taken, the revenue impact can run into hundreds of thousands of dollars. Whatever the volume, though, a business interruption can be devastating. It's important for companies of any size to develop a plan for coping with disasters, natural or man-made. That's the best way to ensure business continuity, even in emergency situations.

Business Continuity Planning needs to take a broad view, embracing people, human behavior, customers and other factors. The actual planning work need not be done by top management, but it is important to secure management's vision and support. The goal of Business Continuity Planning is to identify what's really important and develop back up plans to protect essential elements. The point is to isolate and understand what's critical, and develop a comprehensive plan that considers all of the necessary parts (personnel, facilities, hardware, software and data).

Business Continuity Planning is actually a straightforward discipline, and it includes only a few basic steps: consider every part of your business, decide what's critical and determine how long a given department can operate without some of its support systems. This prioritization exercise should drive your planning decisions. For example, if you have a function you can't do without for more than two hours, relocating people to a back-up facility isn't practical. You need some other approach. For this high priority function, the operational and financial cost of the downtime should also be assessed. If you don't have a fail-over customer contact center, how much revenue could you lose if calls can't be forwarded in an emergency? How many customers could you lose forever? What is the real cost of downtime, in financial terms as well as in potential loss of reputation?

Planning for business continuity is like buying life insurance. When you're looking for a policy, the first thing you need to know is how much insurance you need. Only when you have a clear understanding of the need can you make an informed decision about the purchase. The same principle applies to Business Continuity Planning - understand the fundamental requirements before evaluating potential strategies. Effective planning can't begin until you have a clear understanding of the functions you need to support, and the scope of what that support will entail.

There are a number of Business Continuity Planning solutions available. When considering the cost of things in the planning process, keep in mind that faster recovery solutions tend to be more expensive because they usually involve pre-positioned assets. In Business Continuity Planning, solutions that are designed for rapid deployment will generally be more expensive.

Historically, business continuity plans have tended to focus on natural disasters: fires, floods, hurricanes and earthquakes. Security breaches should also be part of your overall plan. A virus-driven system failure could spread very quickly, compromising your whole operation. Any options proposed by a continuity plan should comply with existing security standards and policies. Even if a business is running in disaster mode, security procedures shouldn't be compromised. In fact, a minor disaster might even be engineered as way to gain entry to a your systems and access to sensitive information.

Developing the Plan
As mentioned above, the first step in developing a plan is to establish the scope. This means identifying what's critical, and defining back-up requirements. In doing so, there are three useful metrics to keep in mind:

• Recovery Time Objective (RTO) - This is the amount of time it takes to go from the point of disaster to the point of recovery. The RTO defines how long the business can be down.
• Recovery Point Objective (RPO) - This is the amount of time between a disaster and the last full back-up. The RPO tells you how much data is at risk.
• Level of Service (LOS) - This is a combination of throughput and functionality, and is an indicator of what services are essential. For example, in a disaster, you might still need full functionality in your billing systems, but not in your forecasting systems.

Business Continuity Planning tools and templates can help, by giving you a general structure for developing a plan. However, the same steps should be followed, with or without a planning tool: set the scope, define the requirements, develop the plan and test it. It's a good idea to build your plan around a worse-case scenario, rather than planning for many different, graduated levels of disaster. If a plan can cover the total loss and destruction of a facility - the so-called "smoking hole scenario" - it shouldn't be difficult to adapt it to less severe situations.

While you're developing a Business Continuity Plan, there are four factors which will greatly influence its effectiveness: management buy-in, regular testing, adequate funding and a focus on the people. These factors should be considered throughout your planning process.

1. Secure Management Buy-In
There may be nothing more important than engaging with management to define the big picture. Without executive guidance, people tend to produce very expensive plans that cover every aspect of daily operations. The problem is that these high-cost plans either may not be fully implemented, or may be put aside for later consideration. That makes them self-defeating, and the company remains at risk. That's why one of the most challenging tasks in Business Continuity Planning is to establish management consensus about which aspects of a company's business must stay operational in an emergency, and the exact level of protection that's needed to support those functions.

2. Establish a Regular Testing Program
If a plan isn't tested, it may fail under the stress of a real disaster. Also, remember that the point of testing is not to prove that the plan works. The point is to stress the plan, expose weaknesses and uncover what's missing. A good way to handle your testing is to look for ways it can be integrated with normal business operations. For example, servers need to be taken down for periodic maintenance. That's a perfect opportunity to conduct a fail-over test, without adding additional down time (or cost). Remember that the best plan won't be worth the paper it's printed on if it isn't continually tested.

3. Obtain Sufficient Funding
Whether counting the cost of hardware, software or time, Business Continuity Planning is sometimes considered a good but non-essential practice. Surveys show that a surprising number of companies either don't engage in formal continuity planning, or believe their plans may not adequately address a real disaster. One approach to the funding issue is to work Business Continuity Planning costs into whatever business cases are normally used to secure project approval. No project should be implemented if it doesn't include some budget to cover Business Continuity Planning as well as the associated maintenance and testing costs. Remember that an under-funded plan is a plan at risk.

4. Trust the People
In an actual disaster, people can be incredibly inventive. They're a lot more flexible than systems, especially in emergency situations. It may be that some of your work teams need little more than a laptop and an Internet connection to conduct business. They could work from virtually anywhere, including homes, alternate company locations, recovery centers or temporary office space. However, trusting the people doesn't mean that testing isn't important. As mentioned above, all plans should be supported by an ongoing program of testing and practice drills.

Summary
Keeping these four factors in the foreground will help you develop a plan that really does the job and keeps you in business. A properly funded, well-prioritized continuity plan, combined with a regular program of testing, is the best way to safeguard your business. Protect your business against lost data with AT&T Remote Vault.