Six sensible steps to keep disaster recovery real

Unless we’re living under skies of brimstone and hellfire, most companies shouldn’t have to replicate every piece of data to protect their business from the next cataclysmic event. Nor should they necessarily have to cough up millions for a mirror site that traces every network transaction. And let’s face it, unless you’re cyber-cynical, catastrophes are extremely rare. Be that as it may, enterprises­ are increasingly being held accountable for their data, and prudence points to being prepared. We asked three experts what the most commonly overlooked elements are in today’s disaster recovery plans.

Understand business needs

Ultimately IT is there to serve business, and disaster recovery planning should be no different.

Sound hackneyed? Well, most IT shops still don’t get it, according to EMC Canada consultant Iain ­Anderson. People are still making technology decisions, and not business decisions.

According to Paul Saxton, lead consultant in business resiliency at IMB Canada Ltd., recovery capabilities have to be matched to the business requirements.

“Understand that disaster recovery and business continuity are part of overall risk management,” he says. “It’s not just an IT thing.”

Anderson says IT has a responsibility to understand how business workflow ties in to business applications, and how those applications in turn are supported by infrastructure. “One of the challenges I see all the time is that business continuity and disaster recovery fall back to the responsibility of IT, and IT’s normal response is to throw technology at it,” says Anderson, client director at EMC Corp. of Canada.

“We tend not to spend enough time communicating out there with the business units and understanding what their business problems are,” he says.

Know your enemies

As a type of insurance policy, it’s helpful to know what threats and vulnerabilities you’re likely to come up against.

Unless you’re in a tornado area, on a fault line or flood plane, you probably won’t be building a mirror site of your entire IT infrastructure.

But going through that vulnerability and risk assessment can be a heated debate, says George Kerns, president and CEO of Fusepoint Managed Services Inc. The budget for a recovery plan is large compared to the operating budget, and if the chance of a disaster occurring isn’t high, how do you avoid spending too much?

“I think this has to come down to a rational conversation between the CIO and the CEO,” says Kerns. “They have to be aligned on what risks they’re willing to take with their business.”