Data Center Leaders: Business Continuity & Disaster Recovery Planning With Susan Snedaker

Business Continuity Expert Susan Snedaker

Data center professionals are in a unique position in today’s marketplace.  It is data center professionals who develop  in-demand strategies designed to do the most work with the fewest resources, whether it’s minimizing costs by virtualizing physical servers or creating sound data recovery plans ensuring companies recovers from natural or man-made disasters.

Evolving Solutions is proud to launch our blog’s newest feature, “Data Center Leaders.”  Evolving Solutions will interview data center leaders for their thoughts regarding topics ranging from server virtualization to business continuity with everything in between.

First up, is our interview with Susan Snedaker.  Principal Consultant with VirtualTeam, and author of Business Continuity & Disaster Recovery Planning For IT Professionals, Susan is an accomplished consultant, speaker and author. Equally versed in business and technology, Susan specializes in defining successful business models that increase profitability, reduce turnover and define a clear vision for future success.  Susan’s insight can also be found at her blog, Starting Up, Starting Over – Business Fundamentals.

Below, Evolving Solutions discusses business continuity and disaster recovery planning with Susan:

Evolving Solutions:
What factors play most heavily in developing a business continuity plan, for example, government regulations, client contracts, etc?

Susan Snedaker:
The factors that should be considered vary depending on the nature and size of the business. A large hospital will have to make very different decisions than a mid-sized optical manufacturing company or a small online retailer. The key considerations are tiered in this order:
1.    Government, legal or regulatory requirements
2.    Industry requirements
3.    Corporate requirements

For example, the hospital must comply with FDA requirements, HIPAA requirements and a whole host of other legal and regulatory requirements in the daily course of business. These should be primary considerations for any BC/DR plan. The manufacturing firm may have to comply with OSHA or EPA standards during the course of business. The online retailer may have few, if any, regulations governing their business activities.

Industry requirements may include adherence to certain standards. For example, in manufacturing, there may not be a governmental regulation of the product but there may be stringent industry requirements for precision, purity, etc.  Again, during the normal course of business, these things are typically addressed  in standard operating procedures and should be included in the BC/DR plan.

Corporate requirements include critical business applications, data and processes along with vendor and client contractual commitments. Using the same examples, the hospital must meet the needs of a variety of stakeholders (with respect to BC/DR) including patients, the community, medical supply providers, physicians, nurses and other health care providers. Each of these groups has specific needs and requirements that all focus on patient care and these form the foundation of the BC/DR requirements.

The manufacturing environment may focus on meeting contractual obligations with regard to just in time inventory management, logistics or sourcing to name a few. The online retailer may have contractual obligations with vendors for purchase levels or frequency of purchases or they may have specific obligations with respect to turning around customer orders.

Most companies these days are using a variety of technology solutions and each of these must be assessed as to their criticality in the functioning of the business.  Companies also have to address the interdependencies of systems and the order in which they would preserve and restore systems. Having assessed the regulatory environment, the firm can better assess which business data and functions should be considered highest priority.

In a hospital environment, life support systems  and those regulated via HIPAA or the FDA would be at the very top of the list while the gift shop inventory system may be at the very bottom of the list, for example. The manufacturing firm would include any systems used to manufacture product at the top and perhaps standard office systems (word processing, etc.) at the bottom of the list. The online retailer would probably consider their web-based shopping cart system to be their top priority followed by the inventory system then other internal systems.

If you approach the creation of a business continuity/disaster recovery plan from the top down, you’ll likely take the most important factors into consideration first.

Evolving Solutions:
What are the three biggest mistakes companies make when developing continuity & disaster recovery plans, and how can they be avoided?

Susan Snedaker:
Mistake #1 – Not Creating A Plan

The biggest mistake companies tend to make is to not create a plan at all. If you ask a room full of IT professionals how many of them have backups of key data on their home computers, you’re likely to find that perhaps 10-20 percent of actually do backups at home.

Clearly, IT and other business professional know they should have a plan but they rarely do. The biggest roadblock to creating a plan is often the seeming enormity of the task. Large companies  may choose to contract with third party providers to assist them through the process rather than re-invent the wheel. There are proven methodologies for assessing the company’s business continuity and disaster recovery needs . Stepping through  a defined process on an enterprise-wide basis yields a more reliable plan than an ad hoc approach.

Mistake #2 – Not Getting Executive Buy In

If you don’t have executive support for your business continuity and disaster recovery process, you’re not likely to make much progress. Creating a workable business continuity and disaster recovery plan can be time-consuming and (depending on your company and industry) expensive. You need to have executive support to help you get all the needed players to the table across the entire company.  You may also need to educate your executives about the cost of NOT creating a workable plan.

Mistake #3 – Not Getting The Right People In The Room

If you don’t have executive support, you may have trouble getting the right people to put in the requisite time and effort to create a viable business continuity and disaster recovery plan. Even with executive support, some companies miss their target because they create the plan in an information vacuum then try to roll it out to the organization.

Instead, each key department should have a representative weigh in during the creation of the plan to ensure it meets the entire organization’s needs. It often falls on the IT group to create the business continuity and disaster recovery plan, but in a hospital , manufacturing  or other complex environment, it’s not likely that the IT staff will have enough knowledge about daily operations to ensure that the plan is realistic.

Evolving Solutions:
What tips would you offer for a business as it develops a business continuity & disaster recovery plan for the first time?

Susan Snedaker:
Start with your data. What is your most critical data? Where and how is it stored? Create a viable plan for backing up and recovering your electronic data in the event of catastrophic loss. If your server room imploded, what would you do?

Do you know what kind of equipment you’re running, where you could purchase duplicate equipment, how you could restore your data to new equipment in an alternate location?  Do you have copies of operating systems, patches, configuration and passwords off-site in a secure (but accessible) location? Many companies don’t even cover the bases with adequate backup and restore capabilities and that’s the best place to start for all companies. Once you’ve secured your data, you can then enlarge the scope of your business continuity and disaster recovery plan.

Creating a business continuity and disaster recovery plan, especially for small and medium-sized businesses, is likely to be an iterative process where data is secured then physical assets then business processes. The bottom line: Keep it simple but create a basic plan.

For example, the online retailer may have a very simple business continuity and disaster recovery plan. They’ve ensured (contractually) that their web hosting company has a disaster recovery plan for web services. Their inventory database and financial system (QuickBooks (R)  most likely) is backed up using a real-time incremental backup service that backs data up to a secure Internet site during low usage times. Inventory would have to be replaced if the building was damaged, but with a new location and a couple of computers, the online retailer’s back in business.

Clearly, that’s the simple version but it shows that with just a bit of planning the basics can be covered. The online retailer can then go back through their plan once they get these pieces in place and begin planning for other potential problems such as the building being damaged or transportation to their facility being interrupted. The manufacturing company and hospital will have a much more complex plan, but it uses the same process and starts with securing critical data.

Evolving Solutions:
Your book, Business Continuity and Disaster Recovery Planning for IT Professionals takes the reader step by step through the process of developing their own continuity and disaster recovery plans.  Taking away the regulations of specific industries, do you feel the general process of creating a plan is able to be duplicated for most companies?

Susan Snedaker:
Yes, the process for business continuity and disaster recovery planning can be duplicated, which is why there are service providers out there who can be hired to assist in the process, regardless of industry. However, as you’ve seen, the details vary greatly from company to company.

The basics really start with protecting key data. Don’t fall into the trap of thinking it’s too big a job to complete so it never starts. Break it into manageable pieces and protect your data. Be clear about what is and is not included in the project so your CEO or CIO doesn’t incorrectly assume you have a full, robust and complete business continuity and disaster recovery plan if all you have is a solid data protection plan.

Evolving Solutions:
In 2006, CIO Magazine reported that many existing business continuity plans would likely fail in the instance of a global pandemic, as most plans were created to only take into disruptions caused by geographical disasters.  Two years later, do you feel this is still the case?

Susan Snedaker:
Most companies would probably not be ready for a pandemic, even now, but I’m not sure any government on the planet is really ready for a pandemic either. It’s an enormous scenario to consider.

However, I think companies are more aware of the potential for a pandemic and as a result, they’re beginning to consider these possibilities. In an economic downturn, companies scale back on non-essential costs and that often includes business continuity and disaster recovery planning. So, they’re most likely concentrating their efforts on ensuring critical data can be recovered and core business functions remain in tact and anything outside that scaled down scope has probably been cut loose. I would say most companies are prepared only to the extent the company’s primary business continuity and disaster recovery plan is also applicable in a pandemic.

Evolving Solutions:
Wild Card: Anything else you’d like to add?

Susan Snedaker:
1.    Some interesting statistics your readers might find of interest. The most common disaster companies face is fire.

2.    The chances of a company staying in business after a “disaster event” (fire, flood, etc.) are directly correlated to how quickly they come back up after the event. The longer you’re down, the less likely you are to remain in business long-term.

3.    If your firm is scaling back on IT assets or investments in this economic climate, there’s a good chance it’s canceling or closing out disaster recovery contracts to save money. Be sure you review your plan and your contracts. Scale back if you need to, but update your plan accordingly and realize that you are exposing your business to additional risk. Though you may have to scale back, if you review your business continuity and disaster recovery plan you may find ways to save money on existing contracts and services in a soft economy rather than scrapping your plan altogether. The key is to make thoughtful decisions rather than yanking the plug on a plan and hoping for the best.