Planning for business continuity means weighing risk: What systems can your business not live without? How can you get access to that data or computing power if something bad should happen? And, perhaps most importantly, how much do you want to spend to have a backup plan -- a plan that you hopefully will never need?
Taking the first step and conducting a business impact analysis not only shows executives the importance of planning for business continuity, but also highlights which areas need immediate attention and which can be pushed out or planned for future budgets.
"Making [business continuity] a business issue, not an IT issue, is top of the list," says Jim Harding, CIO at Henry Schein Inc., a distributor of health care products and services in Melville, N.Y. "If they think it's just an IT thing, then it's very difficult to get anybody to participate and have an effective plan. And if something does go wrong, they're going to say, 'Hey, how come you didn't have that covered?' "
Business continuity has evolved beyond IT, encompassing more than technology and moving toward a more communications- or people-centric view. Nevertheless, IT remains an important part of business continuity, often serving as the common link that ties everything together. Companies adopt business continuity plans in many different ways and for different reasons, but all agree on one thing: It can no longer be ignored.
CIS: All about accessibility
Michael Zepernick, president of Computer Integrated Services LLC (CIS), a systems integrator in New York, learned just how important accessibility can be when operating in a distributed business model. CIS had been backing up, among other things, a Windows 2000 server, all its office applications, a Red Hat Linux database server, a NetWare server and its SQL-based help desk dispatch software as part of an in-the-works plan to possibly create a remote backup option for customers.
On Sept. 11, CIS's office lost all phones, power and Internet connectivity, and because the office was inside the "frozen zone" near the World Trade Center site, no one could enter, Zepernick says. But by restoring the most recent data from its tape libraries and setting up Fort Lauderdale, Fla.-based Citrix Systems Inc.'s MetaFrame application-access solution, CIS was up and running again within 24 hours.
The company adopted multiple locations -- a rented site in Manhattan with a fluctuating T1 line for sales staff, technical staff working from CIS customer sites, a network of help desks throughout the city for customer calls, and a good number of employees working out of their homes. "We were accessing our data whether it was over dial-up lines, DSL, cable modems, T1 lines, and it didn't matter, MetaFrame handled it," Zepernick explains.
Despite the scattered locations, everyone was able to get to the information they needed to be productive. The key, says Zepernick, was the commitment to doing remote backups consistently "because the need to have your servers and data in the same place to us seemed silly.
"At the end of the day, because we had the distributed environment ability, our sales and service -- compared to what had happened -- was really not impacted. ... We just had to inform people where to report to and where to go. People could choose to work where they felt most comfortable, not in a location dictated by where our systems were," Zepernick says.
Zepernick is convinced of the importance of backing up systems and data on a regular basis and testing those backups to make sure everything is being correctly copied.
"[A business continuity plan] is all about staying in business -- that's of paramount importance. It's the continuation of your operations, period," Zepernick says. "If you don't have a plan and something happens, you can almost just start to assume that you're going to be out of business completely."
Henry Schein: Protecting centralized resources
Henry Schein's mix of distributed call centers and distribution centers and a centralized network and computing architecture presents an interesting business continuity planning challenge for Harding.
"If we lost one of our distribution centers, because we have eight of them, we can easily reroute that volume to other distribution centers," he says. "But if we lose our centralized computing or our network, we're down for the count, basically."
Because of its centralized computing structure, the company put great emphasis on revamping its entire disaster recovery plan last year. This included working with AT&T Corp. to shore up and back up various systems, both centralized and decentralized. For example, by working with AT&T and adding call center technology from Basking Ridge, N.J.-based Avaya Inc., the company can automatically reroute customer calls if one call center goes down or if too many calls flood a single location.
But the main networking resources required a more complex plan. According to Harding, Henry Schein changed its disaster services provider to IBM and added network capabilities from AT&T to back up systems, data and other resources to IBM's off-site location, contracting with these companies to allow full recovery within 24 hours.
"We could have gone for a four-hour recovery, which means pretty much every time you record a transaction, you're rewriting that to a disk drive at the IBM location," Harding explains. "We opted out of that because the cost is about 10 times what it is to do what we're doing. Now, if you're a financial institution, 24 hours might be the end of the world -- but for us, it's OK."
After losing some network capacity when a previous carrier was affected by the Sept. 11 events, Henry Schein consolidated more services with AT&T "because their own internal recovery capabilities are so far superior to most carriers," Harding says. Still, the company is going a step further and is in the process of adding a third frame carrier to its major sites as a backup to the Integrated Services Digital Network dial-up line that backs up the AT&T connectivity.
"That wouldn't normally be necessary if we weren't so highly centralized," Harding adds. "There's a price for being centralized, and that's part of it. We still think the efficiency of it and our ability to service the market is superior because of our centralization, but there are some costs associated with the redundancy and recovery systems you need to put in place."
The entire continuity plan, including the IBM and AT&T services, will be put to work in July when Henry Schein tests its resiliency by building systems from scratch based on a previous night's backup tapes, and then cuts the network over for a little while to test recovery plans. Harding says the company expects to do this kind of full test "at least annually," with more moderate continuity tests performed semiannually.
One key concern for Harding was finding providers that had excellent business continuity and disaster recovery plans of their own, something he says every company should consider when making any outsourcing or service decisions -- especially if it involves access and communications.
"Without the capability, I don't care what the price is," Harding explains. "Part of that is not only 'Do you have this hardware and connectivity and so forth,' but 'How can you handle a regional disaster? If 10 of us go down, do you have the capacity to handle that?' That was a big criteria in making our selection."
Another criteria was company buy-in; at Henry Schein, executives understood the need for a full business continuity plan involving not just IT but the support and participation of other business units as well, and were willing to make the necessary investments of time and money. From there, it was a matter of putting all the pieces in place over time, Harding adds.
"There is nothing particularly clever about it: It's just basic, fundamental, good, solid IT management," Harding says. "Getting it done, getting people to focus on it, getting organized -- easier said than done."
Tracey Edwards: Seeking storage
After experiencing a lot of growth during the past three years, advertising agency The Tracey Edwards Co. had a legacy network and a need for better storage strategy, as well as "no real business continuance plan, which is to say: none. It was really an absolute nightmare waiting to happen," says Scot Villeneuve, vice president of e-business at Manchester, N.H.-based Tracey Edwards.
The company's advertising business creates numerous massive graphics and text files in both PC and Macintosh formats that must be stored and remain accessible for long periods of time. This information is "crucial -- the No. 1 thing to keeping our business alive if a disaster happened," Villeneuve explains.
Because Tracey Edwards needed to upgrade its network and technology platform, Villeneuve was able to use that upgrade process to also add some business continuity elements, choosing to add an network-attached storage solution from Storage Computer Corp. in Nashua, N.H. The new deployment, put in place about four months ago, includes hot spare drives and runs RAID 5 to add fault-tolerance, as well as a "pretty robust" nightly/weekly/monthly backup system with 80GB DLT tapes, says Villeneuve.
"Those [tapes] are removed off-site, put into safe deposit, and if something happened to that network room and everything was destroyed, we could recover all our data a week back and only be out a week's worth of work, so the disaster recovery problem is addressed nicely," Villeneuve adds. Also, if something should go wrong within the network such as a failed drive or a server getting too hot, Villeneuve and his team get an alarm or a page to notify them of the event.
The weekly schedule was chosen after examining and balancing the agency's specific backup needs with the built-in redundancy of the Storage Computer product and the cost of data backups, which become more expensive if done more frequently. Although the business continuity elements were added as a subset of the network and storage upgrade, they were still a good chunk of the project budget.
"To be honest, the business continuity component of our hardware and software deployment purchase was probably 10% of the total cost of the network, so we're talking a lot of money to have this tape backup automated and configured," Villeneuve says. However, he adds that getting support from your ownership or executives for business continuity is extremely important to formulating a successful plan, because it will require some added costs and some cooperation from each part of the business to work well.
"The bottom line for us is, if our building was all of a sudden beamed away by aliens and I was still here on Earth, I could take these tapes and probably -- within a matter of a few weeks with a serious reinvestment of capital [to replace hardware] -- get back up completely," Villeneuve explains. "We sleep a little bit better at night."
This story, "Considering continuity" was originally published by InfoWorld.