Eight-day IT outage would cripple most companies

Computerworld - A Gartner Inc. poll of information security and risk management professionals released today shows that most business continuity plans could not withstand a regional disaster because they are built to overcome severe outages lasting only up to seven days.

Gartner analyst Roberta Witty said that the results of the poll show that organizations must "mature" their business continuity and disaster recovery strategies to enable IT operations and staffers to endure outages of at least 30 days. Such efforts would require additional IT budget spending and collaboration across enterprise business units at most corporations, she noted.

Gartner surveyed 359 IT professionals from the U.S., U.K. and Canada during 2007 on their business continuity efforts, and nearly 60% said that their business continuity plans are limited to outages of seven days or less.

Further, results showed most companies focus on rebounding from internal IT disruptions, not from regional disasters that could also damage facilities. A very shortsighted tactic, remarked Witty, considering damage caused by Hurricane Katrina in 2005, as well as potential harm from outages, terrorist attacks, pandemics, service provider outages, civil unrest or other unpredictable event.

"If you start looking at some of the events we've [experienced] over the last few years, companies must plan for events that actually take much longer to recover from," Witty said. "This is an issue [businesses] have to deal with -- it's in front of everyone's face right now." 

The survey found that 77% of companies have come up with a business continuity plan covering power outages caused by fire, while 72% have a plan to get up and running after a natural disaster. Only 50% of companies are prepared to rebound from terrorism-related IT outages.

Witty did say that companies are starting to take pandemic concerns more seriously than in the past. The survey showed that 29% of organizations now have pandemic recovery measures in place, up from just 8% in 2005.

To withstand an outage of up to 30 days, companies must improve cross-training efforts and streamline emergency management, notification and incident management techniques for quicker response, she added. "That's what [business continuity] is about. If you don't have people to manage it, a data center is useless," Witty remarked.

Read more about Business Continuity in Computerworld's Business Continuity Topic Center.