Computerworld

Five steps to evaluating business continuity services

In the past, most enterprises defined a disaster as an act of nature--a hurricane, tornado, flood or fire that wipes out their ability to conduct business as usual. Today, with worldwide networks, 24/7 customer call centers and Web applications, a common electrical failure could spell disaster when communication is interrupted in the supply chain, online transactions are halted or networks are down. Online resource Dictionary.com has even added "business failure" to the list of calamitous events that define a disaster.

With this in mind, companies are stepping up their use of hosted business continuity (BC) and availability services--not just for those acts of nature, but also for everyday occurrences that might interfere with stringent uptime requirements.

Business continuity and disaster recovery are intertwined. While disaster recovery is the set of steps and processes involved in restoring a data center to normal operation after it has been partially or totally taken offline by some event, business continuity involves managing emergency coordination, notifying employees and interacting with emergency officials.

The frequency of common business interruptions has boosted the market for external disaster recovery services--which include data center services, backup and mobile recovery services--to US$3 billion to $4 billion a year, according to Gartner.

The market size for capital expenditures on in-house servers, storage and internal staff used for business continuity and disaster recovery is harder to quantity. Very often, that server and storage infrastructure can be brought in to support other applications and initiatives. Although it still needs to be backed up and may have to be managed, restored and brought back to life, it is not always counted in the disaster recovery budget.

Here are some points to consider when evaluating business continuity and availability services and software.

1. Weigh the benefits of specialized business continuity planning software.

Business continuity planning software can help large companies formalize the BC framework and continually update the plan. "Of companies that actually have plans, 50 percent use software and 50 percent use informal software" such as Excel spreadsheets, says Stephanie Balaouras, a senior analyst at Forrester Research in Cambridge, Mass.

Software providers such as Strohl Systems Group and SunGard Data Systems, and emerging players such as eBRP Solutions and U.K.-based Office-Shadow offer BC planning solutions. Regulated industries that face audits, such as life and health insurance companies or financial institutions that require uniformity in how they build their plans, may benefit from one of these software packages.

Reviews are mixed, however, about how beneficial they are in an actual emergency.

"Business continuity plans that are generated by people within the department with known [software] like MS Word and Excel have always proven to be more successful in a real disaster," says Jack Smith, first vice president and manager of global IT business continuity at ABN Amro in Chicago. "Multimillion-dollar solutions can help you get through your audit, but they're an albatross because they have to please so many masters. By the time you fully implement them, your grandchildren are running [the company]," he adds.

Smith saw his business continuity plan in action in December 2004 when the LaSalle Bank Building in Chicago, a subsidiary of ABN Amro, caught fire and became the largest skyscraper fire in the history of the city. More than 6,000 workers were displaced--4,000 of them bank employees.

With Smith's simplified BC plan in place, the financial institution mobilized and kept business running. "We filed $50 million in property damage and zero in business interruption," Smith says.

At Southern Farm Bureau Casualty Insurance, Larry Marler has also reviewed packaged BC planning software and taken a pass. "I discovered I could write my own software to meet the company's needs without all the overkill," says the disaster recovery coordinator at the Ridgeland, Miss., insurance company. When the company was hit hard by hurricanes Katrina and Rita in 2005, Marler had a chance to see his business continuity plans in action.

But Forrester's Balaouras sees problems with simple planning tools. "Without the software, how do you keep plans updated, collaborate, invoke a plan and track that all the tasks are being executed?" she asks. "Software makes it easier to turn BC planning from a one-time event into an actual program." Her rule of thumb: Companies with more than 50 entities that must have a coordinated business continuity plan should take a serious look at BC planning software. "Everyone uses the same templates; plans have all the key components that are thorough and meet company standards for quality and consistency."

2. Consider the major business continuity/availability service providers and some niche players.

Hosted business continuity/availability providers typically provide cold sites (data center space to house your own equipment and backup tapes), warm sites and hot sites (an operationally ready data center), as well as data archival, restoration capabilities, managed services--you name it.

SunGard, IBM Business Continuity Resiliency Services (part of IBM Global Services) and Hewlett-Packard own the worldwide market share in this segment with the broadest set of services.

"If you look at mainframe-based recovery, there are really only two players in the world that can do that--IBM and SunGard," says John Morency, research director at Gartner. "HP tends to focus more on the professional design, integration and consulting services around disaster recovery and continuity."

Smaller services players such as Rentsys Recovery Services are also making inroads into the market. The Houston-based company, historically a business equipment rental company, has grown its offerings to include mobile recovery data centers. The company can deploy large tractor-trailers equipped with electrical power, satellite communications, PCs, faxes and other equipment anywhere in the country to recover customer service operations or anything else. IBM and HP both subcontract their mobile recovery services to Rentsys, while SunGard has its own trailer fleet of 30 mobile data centers.

Page Break

3. Let recovery requirements dictate the level of dedicated BC services.

Subscribing to a data recovery service that you can trigger when a disaster strikes is fine if data can be restored in two to four days. But increasingly, as businesses require 24/7/365 availability, ­more dedicated data recovery services are required.

"If you have to recover within 24 hours, that requires some form of dedicated infrastructure in terms of remote SAN [storage area network]. If you're using asynchronous replication or data mirroring, you've got to have fixed assets that are using the data backup," Gartner's Morency says. "You have to have that space on a dedicated basis because when disaster strikes, you need to get your staff out quickly and be able to get everything up quickly."

That's at odds with the shared capacity model, especially in the case of a regional disaster like Hurricane Katrina or a major earthquake, where multiple businesses declare disasters at the same time. After all, if everybody needs the same rented facility at the same time, somebody is going to be out of luck. Companies that can't afford to wait their turn are either evaluating building their own facilities or looking for service providers that can meet their needs.

These faster recovery requirements are bringing new players into the market. Colocation vendors such as NaviSite in Andover, Mass.; Equinix in Foster City, Calif.; and Houston-based VeriCenter are capitalizing on increased demand for data center space.

Organizations that already use SunGard, IBM and HP "are engaging with colocation providers to rent floor space where they can put two to three racks, their SAN equipment and server equipment in the cage in a dedicated facility," Morency explains. "All they're doing is renting floor space and communications capacity. In many cases, it can provide a more available service either at the same cost or at a lower cost [than full-service business continuity providers]. It gives those businesses more predictability in responding to disasters and supporting those [24 hour or less] recovery times."

Major BC service providers also see a growing need for data center space to address customers' needs. Case in point: In July, SunGard acquired VeriCenter, which brought seven data centers to the table.

4. Don't forget emergency notification systems.

During the LaSalle Bank building fire, Smith says the most valuable business continuity tool "by far" was the automated call system. Key IT people, facilities managers, security directors and the key business managers throughout the building were automatically notified of the emergency and where to report.

"We get them all in the room, and everyone has to execute their biz continuity plan. They used the automated call system to call all their people and tell them to go to the secondary site to restore servers and other things to process from another location the next morning," Smith says. "We worked throughout the night and called every two to three hours to touch base. Between that, groups talked amongst themselves to work toward recovery."

Emergency notification systems can use many different means of communication--phone calls, text messages, e-mail--to contact employees, vendors or other critical personnel.

While the Big Three business continuity service providers don't offer their own emergency notification systems, they do support outside systems with their service. SunGard, for instance, supports Paragon software, which can be offered as a managed service.

Other players include Strohl Systems' LDRPS software, Seattle-based Varolii and Verizon business services, which just announced a managed service offering for emergency notification.

Smith prefers the same simplicity with a notification system as he does with his BC planning tools. "Although [emergency notification systems] may have slick bells and whistles, I have found that you don't need them," Smith says. "You need a system that will call a lot of people all at once and have them call into a central conference call number."

He also suggests having an automatic phone forwarding system through your phone company. That way, clients whose only contact is an office phone number can be rerouted to an employee's cell or home phone.

5. Use caution when outsourcing business continuity functions overseas.

Because of terrorism and natural disasters typically not seen in the United States, such as tsunamis and monsoons, companies should take caution when outsourcing backup, recovery and business continuity operations offshore. Some popular outsourcing countries may not have the recovery capabilities found in the United States. "A Third World company doesn't have the recovery capabilities that we do [in the U.S.]," Smith says. "As you outsource [abroad], you increase your risk of significant disruption."