There's no way to determine the validity of a disaster recovery (DR)/business continuity plan unless it is tested on a regular basis. The industry standard is a quarterly test, but many companies usually test on a yearly basis, if they even do so at all.
According to a global survey by Symantec Corp. of 1,000 respondents from 15 countries, 30% of companies with 500 or more employees that test their plan at least one a year report a failure. So why do disaster recovery tests fail? Here's a look at some tips to help your disaster recovery plan become a success.
Leaders must be involved in disaster recovery plans
The Symantec survey notes an alarming decrease in executive-level involvement in the business continuity/disaster recovery plan process, a key point that Lance Stange from MIR3 Inc. believes causes many testing failures.
"Not only does the CEO have to have buy in, but that has to trickle down through the organization," says Stange, a notification engineer at the San Diego-based company that provides products and services used for IT alerting, business continuity/disaster recovery messaging and emergency management. "The best of plans are still plans until they're fleshed out" by testing.
He recommends quarterly testing but recognizes that funding is a stumbling block for many companies. To increase the chances of success, he recommends testing a disaster recovery plan in pieces, ironing out the inconsistencies before moving onto the next segment. After all pieces have been tested individually, then test the entire plan at one time.
Expect the unexpected
Another finding from the Symantec survey indicates that IT managers believe the number of mission-critical applications have increased by 20% over the previous year, but only about half these applications are covered by the company disaster recovery plan.
Adam Quilty, testing man...
To continue reading for free, register below or login
To read more you must become a member of SearchDisasterRecovery.com
ager at Charlotte-based Agility Recovery Solutions, says that companies have to carefully prioritize their objectives, tackling the most pressing issues first. However, changes to that list are often not reflected in a disaster recovery plan.
"When you look at your BCP [business continuity plan], the test should validate that your plan will meet the expectations you have for yourself," Quilty says. "How long can you be without a particular function? That amount of time to get that function back up should be equal to or less than the time you can afford to be without it."
Agility provides backup infrastructure service to small- to midsized businesses (SMBs). Its popular ReadySuite option, which Quilty says that 80% to 90% of members use, costs $275 a month and includes 48 PCs, three servers, one-third the bandwidth of a T1 line delivered via satellite, a mobile office and a generator delivered within 48 hours of an incident. Rentsys Recovery Services Inc. and SunGard have similar offerings in this space.
But the Agility service doesn't cover data backup and the applications an IT department will need to get a company running again. That's why, after the contract is signed, each customer discusses the company's particular needs. General needs are understood before a contract signing, and a consulting/advising period (including discussion of data backup strategy) takes place once the company is protected as a member of Agility. That way, Agility will be ready with the infrastructure and the company will know what it needs to do in the event of an emergency.
The Agility service is a "load tapes when disaster hits deal," using Agility-provided technology for the duration of the recovery.
Quilty believes that DR tests should be learning experiences, not pass/fail exams. "You find new efficiencies through hands-on practice," Quilty says. "You don't want to be learning in a disaster." Most tests incur costs of approximately $1,500.
Disconnect between business, IT in DR plans
Another failure point occurs at the intersection of technology and business expectations, says Colin Silvester, director of product management at IPC Systems. The Jersey City, N.J.-based company provides disaster recovery services for the financial services industry.
Silvester has developed a Matrix of Event Levels that helps companies plan for a certain level of failure. Higher levels of failure, of course, will cost more money to remediate, but knowing that up front helps executives weigh the levels of risk they're willing to plan for.
"A joint decision by the business unit and IT at the outset is a very good way to set expectations," Silvester says.
The business continuity discussion should be ongoing, incorporating disaster recovery plans into new buildings as they are constructed or outfitted, rather than after the fact, Silvester says. Duplicate hardware required for a retrofit disaster recovery solution often is not needed if those discussions take place before the infrastructure is installed, saving companies money in the long run.
Backups for key business personnel
Critical business information isn't the only thing that needs to be backed up, notes Pat Corcoran, global business development executive at IBM, Armonk, N.Y. "You must do something beyond your core people," says Corcoran. "Does everyone know their responsibilities, and do you have backups [of personnel] for your backups?"
Testing a business continuity plan is quite different from reality should a disaster occur. Key personnel could be unavailable. Workers can be within reach but too concerned about family and friends to come to work or if they do show up, be too dedicated to themselves to the job of recovery.
"When we help a client with a plan, we bring the people issue up," Corcoran says. "We can't tell them what to do, but we have the ability to offset some of those key people."
About this author: Matt Bolch (mbolch@mindspring.com) is an Atlanta-based freelance writer who regularly contributes to more than a dozen consumer and trade magazines on a wide range of topics, including technology and general business.
Do you have comments on this tip? Let us know. Please let others know how useful this tip was via the rating scale below.
Do you know a helpful storage tip, timesaver or workaround? Email the editors to talk about writing for SearchDisasterRecovery.com.
