Sept. 11: Assessing Infrastructure, Balancing Risks Are Key

But now, one year later, some solution providers are going a step further by investing in technology designed to improve business performance and reduce the need to position disaster recovery as a stand-alone offering.

In the wake of the attacks, several factors have pushed disaster-recovery solutions to the forefront of corporate thinking, said Bob Sidik, owner of The R.A. Sidik Co., a Palatine, Ill.-based management consulting firm specializing in disaster-recovery and business-continuity planning. For one, many insurance companies have hiked premiums and/or deductibles and are nudging their policy-

holders to prove the validity of their disaster-recovery programs, he said.

"Insurance companies aren't willing to take on the risk," Sidik said, adding that one client's deductible soared from $1 million to $40 million.

One snag in disaster planning is that many companies have focused on recovery, not business continuity, industry observers say. Disaster recovery primarily involves the duplication of computer operations when a catastrophe occurs, including routine off-site backup and procedures for activating key systems in another location. But that's only a subset of business-continuity planning, which ensures that an organization's entire infrastructure and processes can function in the event of an interruption. Continuity planning focuses on technologies such as fault tolerance, data mirroring and distributed systems.

As a result, many businesses that reassessed their disaster planning since Sept. 11 found it woefully inadequate, Sidik said. In the past, a typical disaster-recovery program was based on "hot sites" where staff with data backup tapes could be sent if needed, he said. "But disaster-recovery plans were predicated on airline schedules," Sidik said. "Companies thought they could get to Chicago in six hours but found they needed to drive for two days. So they are now looking a lot more at electronic data movement [such as more mirroring and other technology to lessen the reliance on tape for recovery."

Mike Croy, business-continuity consulting practice manager at Forsythe Solutions Group, Skokie, Ill., said many corporations may be able to take advantage of low-cost bandwidth and multiple sites, along with technologies such as server clustering and high-availability networks, to reduce the risk of a disaster and improve IT performance.

"These [technologies can streamline the organization and help the bottom line by being more efficient," Croy said. "With technology advancing at an incredible rate, such capabilities are becoming available to even smaller and midsize firms. Any company that takes a good look at their business and infrastructure,and their risks,can find ways to increase their capabilities."

Instead of focusing on disaster recovery, customers should focus on ensuring that their valuable data is available regardless of the situation, said Brad Wenzel, president and CEO of Wenzel Data, a Stillwater, Minn.-based solution provider. "Disaster recovery is a failure of availability," he said.

A decline in disk storage prices and increased use of technologies such as Fibre Channel are giving IT departments a broader choice of vendors and more flexibility in setting up their technology infrastructures, Wenzel said. Today, the key is to understand how much risk a customer can handle and to make sure its infrastructure can mitigate that risk, he added.

"We tell customers, 'If you can be down for two to three days, we have a solution for you. If you can be down for only one minute, we have a solution for you,' " Wenzel said. "We ask questions: 'How long can you be down?' "

Despite the threat presented by the Sept. 11 attacks, small businesses have been slower to adopt disaster-recovery practices, solution providers said.

Matt Frauchiger, engineering manager at The Carlson Co., a Madison, Wis.-based wooden fixtures company, said his firm takes backup tapes outside the building every week and has a local solution provider come in to conduct tests, such as pulling power cords. Still, the company has no specific disaster-recovery plan, he said.

Yet many SMBs, especially banks, are changing their attitudes toward disaster recovery and becoming more concerned about having a comprehensive solution, said Carl Palmieri, CEO of Computer Resolutions, a Bridgeport, Conn.-based solution provider. "They're looking at everything from taking tapes home at night,something they didn't do before,to alternative sites to duplicating their infrastructures," Palmieri said.

The anniversary of the Sept. 11 attacks will again spotlight the need for sound disaster planning, Sidik said. "This will be an opportunity for companies to be reminded, at least internally, of the need for disaster recovery," he said.