Companies Not Ready for Disaster

In an article over at WindowsITPro, Elliot King discusses two new research reports that indicate most companies do not really have a disaster recovery plan for their computer systems. Disaster recovery planning usually involves at least keeping an up-to-date mirror of crucial operating data at a physically distant location so that, for example, a hurricane that destroys the main facility will not keep the company from getting its computer systems up and running again in short order.

On to the damning statistics:

• 62% of IT pros don't have a "comprehensive, integrated disaster recovery and business continuity plan."
• 56% don't even use backup software for disaster recovery.
• 70% of companies of all sizes do not maintain a remote mirror of their data.
• 92% of IT pros figured their employer would "face serious consequences" if their computer systems were wiped out.
• But, 40% of the same group couldn't even estimate how long it would take them to get up and running again if disaster struck.
• More than half figured the cost of all their entire systems being down at more than $10,000 per hour.

It's a little hard to beleive that a really large company has no effective disaster plan for their computer systems, but a lot easier to believe in the case of small- and medium-sized companies. We're really fighting human nature here. A disaster plan costs money up front (for example, to keep mirroring data to a remote site for safety), but you can't prove it's ever going to save you money -- we don't know when disaster will strike or what form it will take.

The solution for many companies probably lies in grasping the principles of risk management. You don't want to pay the high cost of being able to survive every possible risk, but you do want to pay enough to survive the most likely disasters.

Also, the cost of a data disaster plan can be somewhat proportionate to the ease of recovery. Thus, you might not want to pay what it would cost (in terms of software, hardware, bandwidth, and people) to maintain such an up-to-date mirror of data that you could be operating again within minutes even if your main building is hit by a meteor. However, it might be quite affordable to make sure that you can be up and running again within a few days, with at most a week's worth of lost data.

The key is to approach this as a risk management problem, and the process of enumerating and assessing the likelihood of various risks will implicitly help overcome our very human tendency to downplay the need to plan for disaster.

October 04, 2004October