The headlines are constantly filled with news of disaster — fires, floods, earthquakes, tornadoes, hurricanes, and other events that can devastate a business. What the news media don’t mention are the other day-to-day tragedies that can destroy mission-critical applications and data, including system failure, human error and power outrages. And how do you keep your business running if employees cannot reach the office due to weather-related travel restrictions or flu pandemic?
The risks are certainly real enough, and the potential costs have never been higher. Depending upon the size of the business and the industry, the cost of downtime can range from tens of thousands to millions of dollars per hour.
Protecting against data loss and downtime once meant nightly tape backups of centralized systems and — for very large enterprises — a “hot site” where data could be restored and operations resumed within a matter of days. Not anymore. The spiraling growth of data storage has effectively closed the nightly backup window, although few organizations could withstand the loss of 24 hours worth of data anyway. Centralized systems have been supplanted by distributed servers and virtual machines scattered about the enterprise. Geographically dispersed employees, telecommuters and mobile workers all depend on remote access to these systems.
“An increasing number of organizations are finding that no amount of downtime is acceptable,” said Vince Conroy, CTO, FusionStorm. “The success of virtually every organization depends upon the continuous availability of business-critical systems. A disaster that wipes out those systems can effectively wipe out the business, and tape backups offer little consolation.”
The Road to Recovery
Most larger organizations recognize that business continuity planning involves much more than data protection. An effective disaster recovery plan should address not only backup and recovery procedures but offsite data storage and electronic and physical network access. It should also include a list of business functions, ranked in priority according to which must be back in operation first. Once these priorities are established, recovery time objective (RTO) and recovery point objective (RPO) should be established for each function. The RTO is the allowable amount of downtime before the function is brought back online, while the RPO is the allowable amount of data loss since the last backup.
AT&T’s eighth annual business continuity survey, released June 1, 2009, reveals that organizations have become increasingly focused on RTOs. The survey — which asked IT executives in U.S. companies with at least $25 million in annual revenue their views on disaster recovery and business continuity — found that nearly 74 percent set target recovery times for their key business processes, compared with just 67 percent in 2008. These companies also have special arrangements for communicating with key executives spanning voice, e-mail and text messaging in the event of a natural or man-made disaster.
“These organizations understand that a business continuity plan needs to identify goals and expectations for recovery should it be invoked,” said Conroy. “With the ability to access the most critical applications and data, an organization can resume at least some operations even if it has lost its physical infrastructure.”
In addition, the study found that companies are giving increased attention to not only their own business continuity plans but to those of their key partners and suppliers. One-third of the respondents require suppliers and other vendors to have a business continuity plan in place.
“That should be a real wakeup call for many smaller organizations that think they can continue to fly under the radar. In today’s globally connected economy, the resiliency of the business infrastructure is only as strong as its weakest link,” Conroy said.
Beyond Backup
Small to midsize businesses (SMBs) remain woefully unprepared for disaster, however. One problem is that many continue to confuse data backup with business continuity. Another is that many smaller organizations believe that business continuity solutions are too expensive and too complex. However, the latest technologies are making business continuity easy and affordable for even the smallest organization.
“Virtualization in particular has really changed the business continuity equation. You can provision multiple servers on a single box and you don’t have to restore to like machines. Some disk-based backup solutions even include virtualization technology that enables them to be used as a server in an emergency,” Conroy said. “Or you can take advantage of FusionStorm’s enterprise-class, fault-tolerant data centers for both production and disaster recovery hosting. We can implement a cost-effective DR site using physical or virtual servers and a dedicated storage array or shared utility storage. Our experts provide ongoing monitoring, problem resolution and testing of the recovery process.”
Old notions of disaster recovery are no longer enough. Organizations need a comprehensive business continuity strategy that enables the business to keep running during minor disruptions and recover quickly from a major catastrophe — without data loss. True, the potential risks are great. But the good news is that new technologies are making comprehensive business continuity solutions easier and more affordable for businesses of all sizes.