In an era in which information is as valuable a commodity as products or services - or may itself be the product - it is critical to plan for its protection in the event of a natural or manmade business disruption. In the 1997 Vulnerability Index commissioned by Comdisco, 55 percent of companies reported having experienced a business disruption of one hour or more; the median length of disruption was eight hours. While dollars lost during interruptions range from industry to industry and business to business, costs easily reach an average hourly financial impact ranging from the tens of thousands into the millions of dollars. Data protection is clearly vital to a business' survival.
But, beyond ensuring that crucial data can be restored, remember that, for recovered data to be useful, workers need to access it in a similar manner to which they are accustomed. Redundant systems and data will mean little without a place for staff to work on backups and recreate business processes while technology in the home site, or even the home site itself, remains unavailable. Enter the necessity of the alternate site.
In planning ahead to recover after a business disruption, it's important to identify the type of alternate site that will best serve your company's recovery objectives. Do you need immediate restoration, or is a defined period of downtime acceptable? Which business functions and systems warrant priority attention? Do you need to recover each of your business' locations, or can you consider satellite offices second priority? The range of business continuity services in today's marketplace offers options in building an alternate site program into your recovery strategy, but it takes careful assessment and planning to identify the site that best matches both your needs and your budget. Identifying concerns common to continuity planning; assessing business recovery needs; exploring alternate site options; and avoiding frequently encountered misconceptions all contribute to designing a comprehensive alternate site recovery strategy.
Identifying Common Concerns
First, consider the following issues risk managers commonly address in developing alternate site strategies as part of overall business continuity planning programs:
- Employee comfort. Risk managers are growing more concerned and increasingly thoughtful about employees during crises. Local crises that affect the workplace, such as a fire or flood, might or might not affect workers' home environments. Regardless, uprooting employees for relocation to distant recovery facilities may cause further trauma, inspiring many managers to seek solutions close to home - and preferably equipped with workspace furnishings and amenities such as kitchen and rest room facilities and break rooms. This type of solution will help protect employees' personal lives, preserve a pleasant work atmosphere and boost employee morale at a stressful time.
- Location, location, location. Alternate site solutions that require significant travel can necessitate substantial expense in providing employee transportation and remote accommodations. These expenses must be weighed against the value to the company of the unit or business function(s) in question.
- Fast recovery time balanced with a reasonable budget. Customers are looking to restore their data and business functions promptly, but without placing undue strain on financial resources. Internal 'hot sites' are preferred by some corporations, but after staffing and accounting for space and technology upgrades, can wind up costing significantly more.
- Less disruptive return to the home site. Many seekers of business recovery solutions mention the return home of people, systems and processes can be as stressful as the initial disaster or disruption.
Assessing Business Recovery Needs
To address these concerns in developing a business continuity plan that includes selection of an alternate site, it is important to conduct an effective assessment of your business. Under the guidance of a qualified continuity planning consultant, you might find it helpful to study your business to identify the locations, functions or applications most critical to your success. You can then determine how best to protect them. Ask yourself:
- What are my business' critical processes and what would be the impact of disruptions to them? For example, are financial functions, customer satisfaction, service level agreements or compliance with regulatory issues of critical importance? Objectively assess the financial implications of the failure of each process: While your company may be able to manage without support staff for a time, it probably could not afford major disruption to its customer service call center, for example.
- What is the critical chronological point after a disruption at which vital processes must be recovered? At what point do you need at least some percentage of your normal staff up and running at its usual functions? This is the recovery time objective.
- What business equipment is necessary to support information, processes or functions identified as critical? Define strategies to access the necessary phones, PCs, cabling, LANs, photocopiers, etc. This helps protect the flow of information; beyond recovery of data, it allows users to access and transport information per usual business practices.
- What criteria do you seek in an alternate site? Will it be able to support the needed technology? Can workers reach it conveniently? Will it accommodate day-care facilities, for example, if this is a service workers enjoyed at the permanent site? The 'people factor' is especially critical in situations where the disaster also affects employees' home lives. Vendors typically define a two-hour commute as the greatest acceptable distance for the location of an alternate site that will support work areas; this makes commutes by bus, perhaps based on a revised shift schedule, at least possible if not ideal.
- When do your business' peak operating times occur? The timing of business disruptions - for example, in the midst of end-of-month accounting functions - may alter the criticality of business processes.
Exploring Alternate Site Options
Dedicated Off-Site Recovery Centers Meet Enterprise Needs
Distributed computing has made it possible for companies to spread data and information across various satellite and home offices, resulting in a need for continuity planning that addresses not just the office, but the enterprise. In these scenarios, it is wise to carefully assess the needs of each office and prioritize - considering the needs of the overall business over the needs of distinct offices - the necessary degree and speed of recovery. For example, it may be possible for two closely located offices to back each other up in the event of a business disruption. Or, perhaps relocation to a very closely located vendor site would be the optimal move. If a number of offices are located surrounding a metropolitan recovery site, it may make sense from a management standpoint for the enterprise as a whole to leverage a continuity strategy focused around that nearby center.
Mobile Solutions Deliver New Capabilities
More recent business continuity planning developments allow even more flexibility in identifying the most effective alternate site solutions, taking into consideration many factors including those outlined above. For example, mobile services, a newer class of alternate site options, deliver recovery sites directly to businesses' doorsteps or the most convenient location physically feasible. Mobile recovery sites should offer all services available in permanent sites, including workarea, distributed systems, mainframe and others. Such facilities, outfitted with both the look and functionality of permanent office space, bring local services to those for whom a lengthy trip to a remote site would be an expensive, inefficient and inconvenient undertaking. In a mobile service solution, your vendor will deliver to your chosen location the required work space equipped with the your business' IT infrastructure, including hardware, software and communications, as well as restrooms, food service areas, etc. Some units can be connected together, walls removed, to create a large, comfortable and functional workspace.
While mobile services may require some time for full set-up, many risk managers recognize that this is a often a timeframe in which damage assessment is still occurring, and value the cost savings and added convenience of a local site over the minimal delay in achieving full redundant functionality. True mobile services are highly tailorable, offering incremental square footage to recreate virtually any size office, and security to segregate and protect data centers from workareas, just as in permanent sites. Mobile services, too, place great emphasis on workers' comfort, giving risk managers the opportunity to display their sensitivities to employees during times of crisis.
In addition, mobile recovery solutions, located at or near businesses' permanent sites, can also facilitate smoother migrations back to the companies' home sites - a process that can be described as a controlled disaster. While the return home offers greater opportunity for planning, it is still a substantial relocation procedure and calls for careful consideration. With a local mobile solution, this move can be conducted gradually.
Avoiding Common Misconceptions
Companies often run up against common misconceptions as they plan their alternate site strategies. Keep the big picture in mind as you pursue the alternate site plan most appropriate to your business:
- If your business exists on a distributed enterprise level, plan your alternate site recovery by strategically viewing the needs of the overall enterprise, not simply the needs of individual locations. Target your recovery efforts, and don't get bogged down in detail that pertains only to a single site.
- Companies frequently allocate substantial resources and support staff to their high-profile data centers without realizing the criticality of lower profile locations or business functions. Be careful not to assume it's too expensive to plan for enterprise recovery; the price of overlooking those functions may be far more costly.
- While data recovery is clearly critical, avoid thinking that data protection constitutes a recovery plan. Remember, your staff is what transforms the raw data into valuable information. It's essential to consider the processes that affect people - such as commuting or day-care facilities - as well as define procedures for obtaining business equipment for your staff to be productive with the data you've recovered.
- The closest temporary site may not necessarily be the best choice. For example, if a nearby alternate site shares the same power grid, utility services or highway access as your primary site, it's likely the alternate site will suffer some impact by the same business disruptions that affect your home site.
- Understand the value of the business continuity program as an evolving process. While initial planning and design require the greatest time investment, it's essential to refine your continuity program as your business grows and changes. Test your strategy in conjunction with your chosen vendor on a regular basis. You'll then be able to measure important benchmarks for incorporating changes and improvements to your plan.
Today's business continuity planning services market offers a range of choices in coverage, many of which are surprisingly affordable. But, in order to make effective decisions in developing a recovery strategy and selecting alternate sites, it is advisable to first have a thorough understanding of the drivers that make your business a success. Equipped with a detailed vision of the information, processes, applications and people critical to their companies operations, risk managers will be well positioned to design and implement custom continuity plans that keep their businesses running even in the event of disruption that renders their home sites unavailable.