Five steps to evaluating business continuity services

by Stacy Collett

January 8, 2008 —

In the past, most enterprises defined a disaster as an act of nature--a hurricane,
tornado, flood or fire that wipes out their ability to conduct business as usual.
Today, with worldwide networks, 24/7 customer call centers and Web applications,
a common electrical failure could spell disaster when communication is interrupted
in the supply chain, online transactions are halted or networks are down. Online
resource Dictionary.com
has even added "business failure" to the list of calamitous events
that define a disaster.

With this in mind, companies are stepping up their use of hosted business continuity
(BC) and availability services--not just for those acts of nature, but also
for everyday occurrences that might interfere with stringent uptime requirements.

Business continuity and disaster recovery are intertwined. While disaster recovery
is the set of steps and processes involved in restoring a data center to normal
operation after it has been partially or totally taken offline by some event,
business continuity involves managing emergency coordination, notifying employees
and interacting with emergency officials.

The frequency of common business interruptions has boosted the market for external
disaster recovery services--which include data center services, backup and mobile
recovery services--to US$3 billion to $4 billion a year, according to Gartner.

The market size for capital expenditures on in-house servers, storage and internal
staff used for business continuity and disaster recovery is harder to quantity.
Very often, that server and storage infrastructure can be brought in to support
other applications and initiatives. Although it still needs to be backed up
and may have to be managed, restored and brought back to life, it is not always
counted in the disaster recovery budget.

Here are some points to consider when evaluating business continuity and availability
services and software.

1. Weigh the benefits of specialized business continuity planning software.

Business continuity planning software can help large companies formalize the
BC framework and continually update the plan. "Of companies that actually
have plans, 50 percent use software and 50 percent use informal software"
such as Excel spreadsheets, says Stephanie Balaouras, a senior analyst at Forrester
Research in Cambridge, Mass.

Software providers such as Strohl
Systems Group and SunGard
Data Systems, and emerging players such as eBRP
Solutions and U.K.-based Office-Shadow
offer BC planning solutions. Regulated industries that face audits, such as
life and health insurance companies or financial institutions that require uniformity
in how they build their plans, may benefit from one of these software packages.

Reviews are mixed, however, about how beneficial they are in an actual emergency.

"Business continuity plans that are generated by people within the department
with known [software] like MS Word and Excel have always proven to be more successful
in a real disaster," says Jack Smith, first vice president and manager
of global IT business continuity at ABN
Amro in Chicago. "Multimillion-dollar solutions can help you get through
your audit, but they're an albatross because they have to please so many masters.
By the time you fully implement them, your grandchildren are running [the company],"
he adds.

Smith saw his business continuity plan in action in December 2004 when the
LaSalle Bank Building in Chicago, a subsidiary of ABN Amro, caught fire and
became the largest skyscraper fire in the history of the city. More than 6,000
workers were displaced--4,000 of them bank employees.

With Smith's simplified BC plan in place, the financial institution mobilized
and kept business running. "We filed $50 million in property damage and
zero in business interruption," Smith says.

At Southern Farm Bureau Casualty
Insurance, Larry Marler has also reviewed packaged BC planning software
and taken a pass. "I discovered I could write my own software to meet the
company's needs without all the overkill," says the disaster recovery coordinator
at the Ridgeland, Miss., insurance company. When the company was hit hard by
hurricanes Katrina and Rita in 2005, Marler had a chance to see his business
continuity plans in action.

But Forrester's Balaouras sees problems with simple planning tools. "Without
the software, how do you keep plans updated, collaborate, invoke a plan and
track that all the tasks are being executed?" she asks. "Software
makes it easier to turn BC planning from a one-time event into an actual program."
Her rule of thumb: Companies with more than 50 entities that must have a coordinated
business continuity plan should take a serious look at BC planning software.
"Everyone uses the same templates; plans have all the key components that
are thorough and meet company standards for quality and consistency."

2. Consider the major business continuity/availability service providers
and some niche players.

Hosted business continuity/availability providers typically provide cold sites
(data center space to house your own equipment and backup tapes), warm sites
and hot sites (an operationally ready data center), as well as data archival,
restoration capabilities, managed services--you name it.

SunGard, IBM
Business Continuity Resiliency Services (part of IBM
Global Services) and Hewlett-Packard
own the worldwide market share in this segment with the broadest set of services.

"If you look at mainframe-based recovery, there are really only two players
in the world that can do that--IBM and SunGard," says John Morency, research
director at Gartner. "HP tends to focus more on the professional design,
integration and consulting services around disaster recovery and continuity."

Smaller services players such as Rentsys
Recovery Services are also making inroads into the market. The Houston-based
company, historically a business equipment rental company, has grown its offerings
to include mobile recovery data centers. The company can deploy large tractor-trailers
equipped with electrical power, satellite communications, PCs, faxes and other
equipment anywhere in the country to recover customer service operations or
anything else. IBM and HP both subcontract their mobile recovery services to
Rentsys, while SunGard has its own trailer fleet of 30 mobile data centers.

3. Let recovery requirements dictate the level of dedicated BC services.

Subscribing to a data recovery service that you can trigger when a disaster
strikes is fine if data can be restored in two to four days. But increasingly,
as businesses require 24/7/365 availability, more dedicated data recovery services
are required.

"If you have to recover within 24 hours, that requires some form of dedicated
infrastructure in terms of remote SAN [storage area network]. If you're using
asynchronous replication or data mirroring, you've got to have fixed assets
that are using the data backup," Gartner's Morency says. "You have
to have that space on a dedicated basis because when disaster strikes, you need
to get your staff out quickly and be able to get everything up quickly."

That's at odds with the shared capacity model, especially in the case of a
regional disaster like Hurricane Katrina or a major earthquake, where multiple
businesses declare disasters at the same time. After all, if everybody needs
the same rented facility at the same time, somebody is going to be out of luck.
Companies that can't afford to wait their turn are either evaluating building
their own facilities or looking for service providers that can meet their needs.

These faster recovery requirements are bringing new players into the market.
Colocation vendors such as NaviSite
in Andover, Mass.; Equinix
in Foster City, Calif.; and Houston-based VeriCenter
are capitalizing on increased demand for data center space.

Organizations that already use SunGard, IBM and HP "are engaging with
colocation providers to rent floor space where they can put two to three racks,
their SAN equipment and server equipment in the cage in a dedicated facility,"
Morency explains. "All they're doing is renting floor space and communications
capacity. In many cases, it can provide a more available service either at the
same cost or at a lower cost [than full-service business continuity providers].
It gives those businesses more predictability in responding to disasters and
supporting those [24 hour or less] recovery times."

Major BC service providers also see a growing need for data center space to
address customers' needs. Case in point: In July, SunGard acquired VeriCenter,
which brought seven data centers to the table.

4. Don't forget emergency notification systems.

During the LaSalle Bank building fire, Smith says the most valuable business
continuity tool "by far" was the automated call system. Key IT people,
facilities managers, security directors and the key business managers throughout
the building were automatically notified of the emergency and where to report.

"We get them all in the room, and everyone has to execute their biz continuity
plan. They used the automated call system to call all their people and tell
them to go to the secondary site to restore servers and other things to process
from another location the next morning," Smith says. "We worked throughout
the night and called every two to three hours to touch base. Between that, groups
talked amongst themselves to work toward recovery."

Emergency notification systems can use many different means of communication--phone
calls, text messages, e-mail--to contact employees, vendors or other critical
personnel.

While the Big Three business continuity service providers don't offer their
own emergency notification systems, they do support outside systems with their
service. SunGard, for instance, supports Paragon
software, which can be offered as a managed service.

Other players include Strohl Systems' LDRPS software, Seattle-based Varolii
and Verizon business services, which just announced a managed service offering
for emergency notification.

Smith prefers the same simplicity with a notification system as he does with
his BC planning tools. "Although [emergency notification systems] may have
slick bells and whistles, I have found that you don't need them," Smith
says. "You need a system that will call a lot of people all at once and
have them call into a central conference call number."

He also suggests having an automatic phone forwarding system through your phone
company. That way, clients whose only contact is an office phone number can
be rerouted to an employee's cell or home phone.

5. Use caution when outsourcing business continuity functions overseas.

Because of terrorism and natural disasters typically not seen in the United
States, such as tsunamis and monsoons, companies should take caution when outsourcing
backup, recovery and business continuity operations offshore. Some popular outsourcing
countries may not have the recovery capabilities found in the United States.
"A Third World company doesn't have the recovery capabilities that we do
[in the U.S.]," Smith says. "As you outsource [abroad], you increase
your risk of significant disruption."

CSO