Disaster Recovery Journal

Most organizations and companies want to mitigate risk. Limit risk by making smart business decisions that enable the company to be on the leading-edge of their niche but still not in the "risk" danger zone. A fine line indeed. 

What is interesting is that so many executives, managers, team leaders, and boards of directors often tend to overlook all facets of risk. The one type of risk that most folks are focused on is financial risk: what impact on the bottom line will the decision, new product, or switch in focus have?

According to a survey performed earlier this year by CIO.com, 54% of all IT security professionals cite cloud computing security as their top priority.  Another 32% cite security as a middle priority for them.  However, 85% of IT professionals are confident in their cloud provider’s ability to provide a secure environment for their data. 

Security has always been a concern when sensitive data is involved and this concern is heightened when it comes to cloud services outside of the corporate wall because no longer is it under the company’s direct supervision.  It is human nature to be afraid of the unknown, but the risks of cloud computing come with a plethora of benefits as well.  For example, the cloud offers greater flexibility, scalability, and agility, allowing IT staff to complete tasks in hours rather than weeks or months.

By Stacy Gardner, Avalution Consulting
Article originally posted on Avalution Consulting’s Blog

Though many business continuity standards emphasize the importance of tracking corrective actions to address identified issues, the recently published ISO 22301 (and previously BS 25999-2) also requires conducting a root cause analysis – looking not just at an issue, but its cause and how it can be prevented in the future.   Root cause analysis (RCA) is an approach that seeks to proactively prevent reoccurrences of the same adverse event or systems failure by tracing causal relationships of a failure to its most likely impactful origin, then putting measures in place to mitigate underlying causes to ultimately help prevent recurrence of the adverse event in the future.  While common in disciplines that deal with extreme precision and protection of life (e.g. quality and environmental health and safety), there’s no reason the business continuity discipline cannot benefit from a similar approach, particularly for practitioners looking to fully implement ISO 22301.  This article explains root cause analysis and identifies how organizations can benefit from implementing the concept in a business continuity context.

By Sameer Sule

SANDY- if you live in the northeast you will not forget her name for a long time. Every CEO, business owner and home owner was holding his/her breath as Sandy blew over us. I know I was. My house is surrounded by trees and every time a 50 mph gust came, I was praying to the higher power that the branches held up. Unfortunately a tree on the adjoining street couldn’t hold up and came down, knocking the power out from our neighborhood for a day. We were the lucky ones! Others in the NY and NJ area weren’t so lucky. 

Spring World 2013 Features Exclusive Senior Advanced Track

Senior practitioners are invited to attend our one-day track on Monday at Spring World 2013. This exclusive track, How To Achieve True Enterprise Resiliency, will feature General Session 3 in the morning (attended by everyone)and then a separate breakout track in the afternoon. The one-day track will conclude with an exclusive “Meet the Expert’ reception in the evening. There is no additional cost for this new track.

The issue I would like to think about this week is how, as business continuity people, we should approach big disasters and what should our attitude be to them. If we are affected by the incident, then our job is simple, we implement our business continuity plan and hopefully we recover our organisation successfully. If we are not affected by the disaster how should we approach it?

 

It's about time. Someone has admitted that DR/BCP writers have ignored the personal issues of employees following a disaster when creating business continuity plans, reviewing them, or just writing about them. Eric Krell wrote in Business Finance on November 6, 2012, an article entitled "Sandy Exposes the Human Side of Continuity." I was alerted to the article by Phil Rothstein. Perhaps for Mr. Krell, Sandy was HIS first exposure to the human side of continuity. I've been teaching a unit called "Take Care of Your People" with my colleague Deidrich Towne, Jr. at DRJ conferences since 1999. We have presented lessons learned from our real experience of "people" issues associated with disaster response.

People, including employees, have routines that must be followed daily. Examples are taking care of children, pets, elderly parents, and farm animals. If you were to review Maslow's hierarchy, you wouldn't find work or career in the list of critical, life-sustaining functions. Let me give you an example. When putting together a strike plan, management employees were assigned duties requiring they work 6 days, 12-hour shifts. I got a call from a woman who said she couldn't work that many hours in a week. I told her it was a "condition of employment" for management personnel. She responded, "Dr. Phelan, three months ago my husband and I adopted a child on the condition I would not work outside the home more than 35 hours per week. If I accept the strike assignment, I will lose my child." I called her boss and set up a job-sharing arrangement to cover the duty.

In the months following Hurricane Katrina in 2005, businesses in southern Louisiana tried to get back to business as usual, but some of these businesses were gone for good.  Financial records, customer information, investor reports, and other electronic data was completely lost if it was stored locally on hard drives or external flash drives.  An important and very costly lesson was learned that year regarding the importance of data backup in the cloud. 

Fortunately, this time around many companies did rely on the cloud as a data backup/disaster recovery solution.  And, because of this, they were able to continue working off of Smartphones and laptops without a break in operations when Hurricane Sandy hit their offices.  With time, companies in the Northeast that were affected by Hurricane Sandy will start to pick up the pieces and get back on their feet.

Despair. Anger. Frustration. Hopelessness. Sadness. Disappointment.

This is just a brief list of the emotions that folks impacted by Hurricane Sandy are feeling. It is impossible to understand what the citizens of the hard-hit areas are feeling. Many have lost everything - homes, belongings, businesses, and likely along with this - optimism.

As you likely know, the team at Disaster Recovery Journal holds two conferences each year: DRJ Fall World and DRJ Spring World. DRJ is not alone in hosting, organizing, and managing these learning and networking opportunities. A quick search of the Internet reveals a range of conferences, workshops, and seminars focused on the issues of business continuity and disaster recovery.