Hope for the Best, Prepare for the Worst

Star Tribune (Minneapolis)

June 26, 2012

Whether it’s a computer virus, oil spill, tornado or flood, all companies should have a plan to keep operating when disaster strikes. In the field, those are called “business continuity” and “disaster recovery” plans.

Patrick Dunn, a consulting manager for Eden Prairie, MN-based Datalink Corp., advises organizations on business continuity, disaster strategies and best practices. He has more than 20 years of industry experience working with Fortune 500 companies and Big Five accounting firms in the United States and Europe.

More organizations are planning and implementing business continuity and disaster recovery strategies, especially with regulatory practices that enforce more stringent safety measures. But headlines about Colorado wildfires, Texas droughts, flooding in Minnesota or the latest computer virus are daily reminders of the need for planning. Yet some businesses don’t put a priority on continuity and disaster recovery planning. That omission can prove fatal.

Q: Talk a little more about disaster recovery.

A: All companies should have a disaster recovery plan. For example, if you’re on the East Coast and you have hurricane warnings, you have to be able to get people out of harm’s way, and you have to be able to shut down your systems efficiently. You also have to have a strategy of how you’re going to store your backup data so you can recover it later.

Disaster recovery could have helped prevent the BP oil spill. Or BP could have used a recovery plan to clean up the spill more efficiently. Disaster planning could have also addressed events like the tsunami in Japan.

Q: What if companies don’t have these recovery or continuity plans?

A: A Gartner study shows that, typically, 90% of the companies who don’t have a plan will never recover their operations. This 90% of companies that lose data will go out of business within two years. But for the ones who do have a plan, 95% of them recover their data. But you can’t just have a plan. You have to test it, exercise it, so people know what to do in such a situation. You have to provide a real-life scenario.

Q: What is the difference between business continuity planning and disaster recovery?

A: In a nutshell, disaster recovery is more concerned with the IT side of things. This includes technical aspects of security, such as IT infrastructure. Business continuity planning is more of the people side, such as how people actually operate and oversee the recovery strategies.

For example, how should people get to work if, say, there’s an emergency weather alert or if there’s a chemical spill on the street outside your building? Both continuity planning and disaster recovery are needed for each plan to be successful.

Q: What do you recommend companies do to prepare?

A: No one should operate in a silo. In the past, IT and business kept to their sides of the office. That can’t happen anymore. There needs to be communication between IT and the business side. There needs to be a high-level conversation about how IT can be of value to people so they can apply their expertise to security.

Typically, these conversations weren’t happening, but now they are more common because people are realizing more and more how important this is. IT has become more communicative, which helps businesses meet their objectives.

Q: How much does this planning cost?

A: Cost is relative because it depends on how you interpret the data you have. How do you determine the financial implication of your data being gone? How much data are you willing to lose if, say, your electricity went out for two hours? Two days? It really depends on the company.

Q: Can social media be used to aid disaster planning?

A: Absolutely. If a company knows something bad has happened or is happening, they can be posting status updates about it on Facebook, they can be Tweeting about it, or they can text message people about it to let them know what is going on. Don’t reveal any proprietary information on social media, of course, but reveal enough so that people know what course of action to take.

Q: How does geography play a role in recovery planning?

A: Every company should be aware of its environment. For example, if you’re on the West Coast, you’re going to be more alert to earthquakes than you are to tornadoes. But being aware of your environment also includes knowing whether you’re located next to a major highway or if there’s hazardous chemicals nearby.

Companies have to keep all scenarios in mind. Every company should be prepared for anything. You have to be diligent, especially if you’re a publicly traded company.