The Hindu Business Line : Is your back-up plan crack-proof?

Two out of five companies that experience disaster go out of business, say experts. How sure are you that your workforce and data can bounce back whatever the threats?

PEOPLE and information are the lifeblood of your organisation, and they are irreplaceable. These are the lessons learned in the aftermath of the September 11 catastrophe in the US. While businesses today are being challenged to reassess their state of readiness in protecting their information assets, the first hurdle often is to dispel the myths that many business and IT executives believe about business continuity planning.

Gartner Group Dataquest estimates that two out of five companies that experience a disaster go out of business within five years. The analyst group also predicts that by 2005, the market for storage management will more than double, leading to increasing complexity in these issues. As the amount of data grows exponentially, and the need for 24 x 7 x 365 becomes critical, more companies are recognising the need for quicker back-up and data recovery.

Lessons from September 11

Distance is key. Access to a second site can be restricted as the physical scope of a disaster can go far beyond your local facility. Support people are cut off from the site, and site-to-site communications are often broken. Often, people are unable to travel from their disaster-recovery vaults to the recovery sites because streets, bridges, tunnels and airports are closed.

Tape as a medium of recovery is not effective. The recovery time from tape can be too slow for effective resumption of business processes. Although files can be accessed or restored from tape, at times they have been found to have degraded or to be unreliable. And the restore time often stretched to five days and the process typically had to be done more than once.

All applications are critical. On September 11, many businesses found that proposals in process, agreements for trades, and the ability to document transactions and agreements were all contained only in their e-mail systems. But, more than e-mail is at stake: today, most operations and applications are inter-dependent and loss of content or information assets in underlying or tertiary applications impacts upon higher-order applications such as CRM or ERP.

Inconsistent back-up is no back-up at all. Different back-up schedules and strategies for different applications mean that information necessary for broad-based business processes cannot be matched up or reassembled. Inconsistent back-ups also significantly increase recovery time.

People-dependent processes do not suffice. In a crisis like September 11, people think of their families and other personal responsibilities first, and rightly so. And even when people turned to the work at hand, many of them couldn't get to the second site to perform their duties, due to closed roads and safety considerations. IT systems that performed best were those that could automate the task of recovery and limit the need for human intervention and manual activities.

Two sites may not always be enough. Even with a second site, many companies were left completely exposed following a disaster — with business processes now dependent upon a single facility. Clearly, information and people need to be dispersed in new ways.

Managed services providers may be overwhelmed. Often, disaster recovery-providers, though key, plan for only a percentage of their customers to require services simultaneously. In many cases, companies that relied on tape or a third-party provider found that they had difficulty meeting their recovery time objectives.

People are irreplaceable; so is your information. The ability to conduct business depends on the availability of key personnel and the critical information and systems they need to function. Once people were protected, information was the one asset that businesses found they could not replace fast enough.

All disasters are possible. The reality of September 11 has heightened the urgency to have disaster-recovery plans in place to ensure business continuity. IT executives are now faced with an increased burden of responsibility for balancing the powerful need for protections with corporate fiscal and resource realities.

Get the difference right

Businesses must understand the differences between disaster recovery-planning and enterprise business continuance planning. The former anticipates recovering from a disaster while the latter achieves continuous information availability in a non-disaster scenario. Typically, we see two views of business continuity planning within an organisation — the business view and the IT view. Companies should appreciate that a comprehensive business continuity plan needs to anticipate the chain reaction across the entire enterprise.

In today's 24x7 economy, businesses want to have information access, no matter what. Yet studies show that 87 per cent of all downtime are planned outages, such as for back-ups and testing. Only 13 per cent of information unavailability is due to a real failure or disaster. According to a study by AMR Research, the costs of downtime, planned or unplanned, per hour can be as high as $400,000 for the investments industry and $250,000 for the banking industry.

Besides, the potential loss of revenue and the hassles of business interruption, businesses find that there are other intangible impacts such as company brand damage, litigation and market share losses.

Businesses can take a step-by-step approach to increase their level of information protection: Starting with platform integrity in an effort to eliminate the danger of a single point of failure in the server, the network or the storage, businesses can move on to the next levels of information protection — ensuring the integrity of information back-up and information recovery.

Storage players can help with an information storage infrastructure. Back-ups that are simple, consistent and non-disruptive to the business are important. What is also crucial is to be able to recover that information easily, quickly and accurately which can be provided by efficient technologies and software. The level of protection can also scale beyond a single data centre to multiple sites, be it whether replicating only the data to another site or providing multiple hot-site capability. In addition, organisations can integrate multiple sites so that workloads can be moved from one location to another as the situation changes.

There is no need to have a `dark' site. With all sites up and running, this means the organisation is always utilising its assets to best advantage while at the same time providing the highest levels of protection for the information.

The author is Country Manager, EMC.

Send this article to Friends by E-Mail
Comment on this article to BLFeedback@thehindu.co.in

Stories in this Section
Is your back-up plan crack-proof?

This call's for the kisan

Emerging from the shell

Setting off a chain reaction

Outlook Express hitch

Print trouble

File transfer from one PC to another

Coughing up more than cash

Big window to the small guy

An eye for change

IT counter's closed, buddy

Quiz

Cartoon

Quick on the uptake

Something to fit the pocket and wallet