Disaster Recovery Journal - Spring 2003 Issue- How Far is 'Far Enough'

Return to the Spring 2003 Index

DISASTER RECOVERY
JOURNAL

P. O. Box 510110
St. Louis, MO 63151
(314) 894-0276
Fax: (314) 894-7474
Internet www.drj.com
E-mail drj@drj.com

PUBLISHER &
EDITOR-IN-CHIEF
Richard L. Arnold, CBCP
richard@drj.com

SENIOR EDITOR
Janette Ballman
janette@drj.com

MANAGING EDITOR
Jon Seals
jon@drj.com

COPY EDITORS
Richard Sandhofer
richards@drj.com
Pamela Clifton
pamelaclifton@hotmail.com

ADVERTISING
Robert Arnold
bob@drj.com

_____________

Corporate

President/CEO
Richard L. Arnold, CBCP
richard@drj.com

Vice President
Robert Arnold
bob@drj.com

CONFERENCE COORDINATOR
Patti Fitzgerald, CBCP
patti@drj.com

CONFERENCE REGISTRAR
Merce Knese
mercedes@drj.com

CIRCULATION
Laura Baugh
laurab@drj.com

EXECUTIVE COUNCIL
Patrick Corcoran, IBM Bus. Cont. & Rec. Services
Jeff Dato, MBCP, KPMG
Edward S. Devlin, E.S. Devlin & Associates
Judith Eckles, SunGard Availability Services
James Hammill, CBCP, JMH Consulting Inc.
John Jackson, Independant

INTERNATIONAL
CONTACTS
England: Thom Hetherington
Business Continuity
Phone: 0161-237-1007
thomh@tempus.demon.co.uk

Australia: Anthony J. Harvey
Journal of Business Continuity
Phone: 0011-613-953-0055-8
fax: 0011-613-953-0528
sector@notability.com.au

Japan: Shinji Hosotsubo
Quake Japan Co., Ltd.
Phone: 03-3215-2880
fax: 03-3215-2881

Brazil: Jose Carlos Ferreira
Disaster Recovery Mercosul
Phone: 55 11 3666-9506
conc2000@uol.com.br
www.drms.com.br

Click Here for a Printable Version

Alternate Facility

How Far is 'Far Enough'

By THOMAS L. WEEMS

How far is enough? That was the question asked of Association of Contingency Planners (ACP) chapters in the United States. The intent of the survey question was to set standards from within the industry regarding how far an alternate facility and an off-site storage facility should be from the primary operations site. This article is a compilation and interpretation of the responses to that survey. Our thanks to all of the ACP chapters for their participation. Without their cooperation this study could not have been completed. A list of chapters that participated is included at the end of this article.
So, how far is far enough? The answer is 105 miles. Well, sort of ... actually, the survey got a little more granular than that. We asked the participants to indicate how far an alternate facility should be from the primary operations facility, assuming that the primary facility is susceptible to any of 12 different threats/risks. Response averages were tabulated and the results are shown in Figure 1.

The 105-mile distance is specific to hurricanes, which the survey indicated should result in the greatest distance between the primary operations facility and the alternate facility. At the other end of the chart, the lowest average for any category was 21 miles for a company that was not susceptible to any of the listed threat/risk categories.
The responses to distance for an alternate facility ranged from a low of five miles to an upper limit of 1,000 miles in certain categories. However, extreme responses were the exception and, to avoid skewing the survey results, the upper and lower 10 percent of responses in all categories were eliminated before the average calculations were made.
The survey was organized in two major sections. The first section addressed concerns for an alternate facility and the second addressed concerns for an offsite storage facility. For purposes of the survey, the following definitions were used:
Alternate Facility: A predesignated facility or site that will be used for business continuation/recovery if the primary operations facility is unavailable (regardless of the cause). An alternate site may be for continuation/recovery of a business unit or a technical component.

Off-Site Storage Facility: A site used to store business continuity inventory on an ongoing basis.

How The Survey Was Conducted
All surveys need a target audience for collection of data. In reviewing potential sources, we decided to ask for participation from the ACP chapters for a number of reasons:
• The group was definable and has an interest in the outcome of the survey.
• They were easily accessible and mailing lists were already in place.
However, the primary reason for selecting this group is that:
• This group practices business continuity on a daily basis.
For this reason, we felt that the ACP members would provide the best information because their responses would reflect real world experience and first-hand knowledge.
To begin the information-gathering process, an e-mail with a copy of the survey form was sent to all ACP chapters in the United States requesting that the chapter participate in the survey. Assuming that the chapter elected to participate, we requested that the survey form be e-mailed to the chapter members with instructions to complete the form and return it to us by e-mail. (A copy of the survey can be downloaded from the Web site noted at the end of this article.)
Completed surveys were received and compiled at our office. The results reflect data from surveys returned as of July 31, 2002. A total of 37 surveys representing nine ACP chapters were returned and included in the analysis.

Basic Rule
An alternate facility or off-site storage facility should be sufficiently far enough from the primary operations facility to provide a comfort level to all interested parties that it would be reasonable to expect the alternate facility or off-site storage facility would NOT be destroyed, damaged, inaccessible, or unusable, due to the same event that caused the primary operations facility to be destroyed, damaged, inaccessible, or unusable.
In answering the survey questions, all participants were asked to assume that they had only one alternate facility and one off-site storage facility. Additionally, they were asked to answer in all categories (not just the ones that apply to them) and to make their answers general and not specific to their industry.
Participants were asked to base their responses on the “basic rule” furnished with the survey instructions.

What The Survey Shows
General Concepts
One of the questions asked of the survey participants was whether or not the distance between an alternate or off-site storage facility and the primary operations facility should be determined by the most geographically widespread threat/risk for which the business needs to plan (established during a risk analysis). Some 89 percent of the survey respondents agreed that it should. That being the case, we can easily look at the survey results and determine the standard answer for, “How far is far enough?” in each of the categories surveyed. If, for example, the most geographically widespread threat/risk for which we have to plan is a volcano, then the standard (average) for minimum distance between the primary operations facility and an alternate site would be 75 miles. See Figure 1. The standard minimum distance between the primary operations facility and the offsite storage facility for the same company would be 62 miles. See Figure 2.

Alternate Facility vs. Off-Site Storage Facility
In general, the distance participants specified as a minimum between the primary operations facility and the off-site storage facility was less than the distance specified for an alternate facility, with the largest disparity (21 miles) being in the category of hurricanes. Although the two sections, when sequenced by distances, are not identical, they are indeed very similar. See Figures 1 and 2.

Alternate Facility
This section of the survey asked whether it would ever be acceptable for the alternate facility to be in the same building as the primary operations facility. An overwhelming majority of 92 percent of the survey respondents said “no” it should not.
We also asked if it would ever be permissible for the alternate facility to be on the same campus as the primary operation site. As you might expect, a majority (73 percent) of the respondents answered “no” to this question. While this is less than the 92 percent that said “no” to the same question concerning the same building, it is still a large majority and should be considered the consensus of the group. However, it still leaves more than one in four survey participants that think being on the same campus is acceptable. For purposes of analyzing the survey results, we felt that a threshold level of 25 percent in disagreement was significant and should be used as a caveat when using the survey results.
Is it permissible for an alternate facility to be subject to the same occurrence of a threat/risk as the primary site?
Results to this question are shown in Figure 3.

In categories such as earthquakes and hurricanes, the results were virtually a unanimous “no,” while in the categories of tornado and snow/sleet/ice the percentages saying “no” were considerably less. In fact, the number saying “yes” meets or breaks our significant disagreement threshold of 25 percent. Threats/risks such as ice storms can be very widespread, covering hundreds of miles, and the reality is that being far enough away to remove all possibility of being subject to the same occurrence may indeed be difficult, if not impractical. Still, most survey respondents think that exposing both primary and alternate sites to the same occurrence of a threat is not a good idea and that distance standards should reflect this concern. We should also note that the survey asked for responses to establish standards and not to indicate practices being followed at or by their place of business. A survey to determine actual practices in place might, and probably would, produce very different results. So, is it permissible for the primary and alternate facility to be subject to the same occurrence of a threat/risk? Survey says ... “no.”
Participants were asked to indicate whether they felt the distance standard between a primary operations facility and an alternate facility should vary based on physical circumstances. Most of the respondents said “yes,” it should. Results were compiled by category with the most “yes” responses coming from the earthquake category (91 percent) and the least coming from the hurricane category (79 percent). None of the categories broke our disagreement threshold of 25 percent. The implication of these responses is the survey participants feel that, although there should be minimum acceptable standards, the standards should be a guide, reference, or starting point and not an immutable figure that must apply to every business. In other words, every planner has the flexibility (and the responsibility) to determine whether the distances for alternate facilities should be on, below, or above the standards. So, the standards can function much as the sticker price on a vehicle – it’s a common starting point.

Offsite Storage Facilities
This section of the survey asked two of the same questions asked in the alternate facility section. Is it permissible for the off-site storage facility to be in the same building or on the same campus? The results were similar. Some 89 percent said storage should not be in the same building and 77 percent said it should not be on the same campus. Once again, we should mention that the survey did not ask if these rules were being followed at their place of business.
In this survey section, participants were asked if their answers, in regard to distance from the primary site, would vary for files that are mirrored or replicated to another site. Some 74 percent indicated their answers would not change. That, of course, leaves 26 percent stating their answers would change. Again, this is more than the 25 percent threshold level. While the survey did not ask for explanations, it does raise the question of how files electronically moved offsite differ from those couriered offsite (perhaps a question for another survey).
To the question of, “Is it permissible for an off-site storage facility to be subject to the same occurrence of a threat/risk as the primary site?” The results were similar to the alternate facility section. Most respondents said “no,” it should not. However, significantly, there were four categories that broke our disagreement threshold: tornado (72 percent), civilian airport (67 percent), military installation (66 percent), and snow/sleet/ice (64 percent).
To the question of, “Should distance between the primary operations facility and the offsite storage facility vary based on physical circumstances?” overwhelmingly the respondents said, “yes.” See Figure 4. This result closely parallels the alternate facility section and implies that planners must factor physical circumstances into efforts to place their recovery inventory a safe distance from the primary operations facility. The survey clearly indicates the majority of the responding individuals feel that, for a given entity, it would be acceptable for the distance to be greater or less than an accepted standard.
Participants were also asked whether any of their responses to offsite storage questions would change if fire resistant vaults were in use. An overwhelming 91 percent said their answers would not change. Again the survey did not ask about the practices in place at their current place of business.

Summary
As contingency planners, we are often asked questions such as, “What are the standards?” Unfortunately, we are often forced to reply that, as of yet, there are no standards. The contingency planning industry is, relative to some other industries, quite young and for now and up until now we have been able to get by with this answer. However, as the industry matures and more businesses become involved in contingency planning, the industry will be forced to set some standards. Our profession, contingency planning, does not presently have the structure and organization that it will in the future. Auditors, management, clients, and investors all have expressed a growing interest in our efforts and are beginning to insist on standards to measure our efforts and effectiveness. Standards will be set and standards will be accepted. It would be best if these standards are set by the industry itself, but rest assured, if we as professionals do not set the standards, then someone else will and we will have to live by them. If this survey has been a positive step toward providing standard benchmarks, then it has accomplished its purpose.
The impetus to conduct this survey was the result of a phone call. A client called with the following true scenario:
“I have discussed our BC plan with a client and the client wants to know if the distance to our alternate facility meets or exceeds the industry standard.
“What is the industry standard?”
Unfortunately, I had no “standard” I could quote to the client. I could speak to best practices or even the “basic rule” stated in this article, but the client wanted something else, something I did not have. If I get a similar call tomorrow, I will be better prepared.
We would like to extend our thanks to the Arkansas, Capital of Texas, Greater Tampa Bay, North Texas, Northeast Florida, Oklahoma, Orange County (Calif.), Utah, and Washington D.C., ACP chapters for participating in the survey.

Thomas L. Weems, president of PreEmpt Inc., is responsible for coordinating all business continuation planning efforts for the company. PreEmpt is based in the Dallas/Fort Worth metroplex and is involved with all facets of business continuation planning, from turnkey consulting to customized training/classes. For more information about the products and services offered by PreEmpt, set your browser to www.PreEmptInc.com.

To comment on this article, go to 1602-02 at www.drj.com/feedback.