|
|
||
|
DISASTER
RECOVERY
_____________ Corporate President/CEO Vice
President
CONFERENCE REGISTRAR Brazil:
Jose Carlos Ferreira
|
GLOBAL PLANNING Looking
Worldwide Before Disaster Strikes By KIM HACKETT Following distressing
and disturbing events, it is human nature to take stock and to identify
lessons learned, in order to minimize the impact of similar future events.
Following the Twin Towers attack in September 2001, the business community
world wide has looked to identify and implement the precautions needed
in order to protect employees and institutions in the future. As recently as a decade
ago, the idea of losing hours, or even days, due to unplanned intervention
would not have caused undue concern, as contracts and business could
take days, if not weeks, to complete. Now, however, technology has enabled
a time-sensitive environment where even seconds lost in down time, cost
money and business. One emerging trend
which is clearly identifiable is the number of U.S. companies, many
of which lost primary IT systems in the attacks, which are now looking
to both replace their systems and introduce mirror sites to protect
against future disasters. Often these mirror sites are going to be sited
not in the U.S., but somewhere in Europe. Increasingly U.S. companies
are also looking to split their operations between the U.S. and Europe
to allow for continuity of client service and to provide a contingency
service. Cemented in a long-standing
“special relationship,” with a shared language and business
cultures, the U.K. also can offer American organizations the important
flexibility of labor laws, which are far less restrictive than the rest
of the EU. Another explanation
for the U.S. looking to its U.K. neighbors for assistance now is the
U.K. telecommunications industry’s reputation for rapid response
on previous occasions like the major U.K. bomb attacks in London’s
Bishopsgate and in Manchester. Both of these incidents devastated large
areas and caused disruption to many for months – and for some businesses,
years – and yet customers were up and running within hours as a
result of action by communications suppliers. In future-proofing your business security you should be seeking telecommunications resilience levels that meet the demands of your organizations’ intensive eBusiness applications. What Organizations Should Be
Asking Suppliers Also on the checklist for tenants should be resilient access network facilities for every customer on the site, along with extensive switch, transmission and broadband capacity, which can carry voice and data communications utilizing the very latest technology. Assessing Risks A more detailed example of just
how one small incident for one organization can be another one’s
disaster is the large U.K. insurance company which decided not to store
its server equipment in the main office, preferring instead to place
it in a little-used basement away from harm and damage. Above the basement
was a restaurant, which leased space from the insurance company. Everything
was fine, until the industrial dishwashers sprung a leak and drenched
the supposedly safely stored servers and rendered them and the systems
useless. This example demonstrates that
the average organization faces a plethora of risks as a result of its
normal day-to-day operations and systems, rather more than terrorist
attacks. An important starting point in managing disruption, whatever
the cause, is to establish a culture that will identify and manage those
risks that could cause it to suffer stoppage and to embody this in the
business continuity planning process. An organization has many elements
that comprise its mission critical processes and functions. These can
include suppliers, customers, shareholders, and IT systems as well as
external influences such as government departments, regulators, competitors,
trade bodies and pressure. All of these relationships and dependencies
should be factored in to the planning process. There is a continuum of possible
reactions when a disaster strikes: Business Continuity Planning
When companies look at business
continuity they need to identify mission critical processes and functions.
It is important to determine what the impact would be upon the organization’s
goals if these were disrupted or lost. Once having identified those
critical processes and functions, a risk assessment should be conducted
to identify the many threats to these processes. Whatever risks the
organization faces, the effects of disruption share a commonality: loss
of critical system(s), site or personnel or denial of access to systems
and premises; all will produce similar disruptions to business (i.e.
- being unable to operate has the same result, whatever the cause). A definition of what constitutes
a ‘disaster’ for the organization should be agreed and included
in the plan. It is important to differentiate between an interruption
and a ‘disaster’. There should be a clearly laid out escalation
procedure setting out how a ‘disaster’ is declared. Risk assessment is used to determine the internal and external threats that could cause loss or disruption and their likelihood of occurrence. Making An Example Of The Finance
Industry The most significant change brought
about by the Turnbull Report is the requirement for listed companies
to report on the review of all internal controls, including financial,
operational and compliance controls and risk management. The Turnbull report’s effects
were to make financial institutions widen their definitions of risk
from just what physical disasters might happen to look at the risks
involved in confidentiality, integrity of information, security risks
from hacking and internal fraud. Typical Emergency Response And
Operations An emergency or crisis operations
center will need to be established to enable the effective management
of any incident. In establishing this, the following must be considered: It is essential that a procedure be established for command and control of the incident. The procedure must include plans
for: There will be many calls upon the operations center and it is important to develop, implement and exercise emergency response and prioritization procedures. This includes the determination of priorities for actions in an emergency. This must include the first aid and medical procedures to be taken if appropriate. Finally Kim Hackett is vice president of U.K.-based, British Telecom’s locations and inward investment division. To comment on this article, go to 1503-19 at www.drj.com/feedback.
|
