If there is a bright spot in any disaster, it is that business, government and education institutions seem to gain a better understanding of the requirement for business continuity and disaster recovery.
Yet, CDW’s Report on Small Business Resilience found that even though 99 percent of small business leaders believe they could recover their data in the event of a loss, only 35 percent actually have a business continuity plan in place. As the findings testify, there is still a chasm between understanding the requirements and generating the organizational commitment to meeting them, which greatly decreases the odds of surviving the unexpected.
Like all business leaders with priorities, SMB owners and executives must juggle a number of compelling draws on time and resources. As a result, they tend to defer business continuity into the “solve tomorrow” column until right before (or right after) an incident. This is a critical, sometimes disastrous mistake. Like all business-essential Information Technology (IT) programs, designing and implementing a functional continuity plan is a multi-month process. Here is why:
Business Continuity is a Business Process: A functional business continuity plan is more about understanding and protecting key business processes than it is about managing IT assets. As such, it will require input from key business leaders and will necessitate in-depth planning and preparation so that every person in the organization knows what to do in the event of an emergency
Assessment and Design: Developing the core business continuity plan is not a one-person job. It requires input from a cross-functional team that includes sales, communications, finance, back office, human resources and IT leaders. Without that input, it is literally impossible to correctly prioritize and tier support systems such that they will meet demands during a disaster incident
Entering the Telecommunication Queue: Most telecommunications providers offer very slow service levels for connecting backup lines to SMBs, for several reasons. As the backup service provider is (we would hope) different from your primary provider, you will have to initiate a new business relationship, including all of the associated legal and administrative hurdles. Also, as the backup line will not represent a sizeable business opportunity, you will have to wait in line behind the more profitable opportunities – including some that enter the queue after you do
Implementation: Once all of the pieces of the continuity solution are in place, building the system, connecting it to ongoing IT programs and aligning it with the corresponding business processes takes time. Assuming that the IT staff (or person) will also have to focus on their regular job at the same time that they implement the new system, view this commitment in days or weeks as opposed to hours
Temporary Relocation: In many disaster scenarios, resuming operations at the same location will no longer be possible. Within that reality, it will be necessary to have plans and agreements in place for a backup location and the logistics for resuming operations in the new facility. This also involves having an IT layout pre-planned for the backup location to ensure that all of your critical systems will function at the secondary facility
Testing: Your business continuity system is only as good as its last test. Like flashlight batteries, smoke detectors or brakes, you don’t want to find out about shortfalls during an emergency. Regular and systematic testing in a number of different situations will consume time and effort, but it is really the only way to know if systems are functioning properly. Plan to extend tests over weeks and months to make sure that the system aligns fully with business operations
In the end, you can beat the odds, but not the percentages. CDW’s experience across thousands of customers leads us to believe that the link between business continuity and disaster survivability is significant. If you are inclined to agree, we would recommend that you get started today with the following steps:
Conduct a business impact assessment: As mentioned above, convene a cross-functional team to evaluate the business requirements and tier data based on its importance to operations
Take steps to protect data: Organizations should back up data frequently to ensure records are kept, and consider upgrading the backup equipment to a faster version to reduce the time it takes to complete a backup cycle. Additionally, implement a knowledge management system to ensure company procedures and best practices are on file and accessible
Review power options: Organizations should add uninterrupted power supplies (UPS) for critical servers, network connections and selected personal computers to keep the most essential applications running
Document, test and update the disaster preparedness plan: Documentation should include updated configuration diagrams of the hardware, software and network components to be used in the recovery. The plan should also include logistical details, including travel to backup sites, and even who has spending authority for emergency needs
Consider telecommunications alternatives: Telecommunications backup must involve both redundancy and alternatives. In the case of spot outages, redundancy may be enough. For larger outages, alternative communications vehicles, including wireless phones, wireless data cards and satellite phones, should be considered.
Form tight relationships with vendors: A strong relationship with hardware, software, network and service vendors can help expedite recovery, as these vendor contacts often can work to ensure priority replacement of critical telecommunications equipment, personal computers, servers and network hardware in the event of a disaster. This is especially important for small- and medium-size organizations, which may lack the resources that larger companies can tap in an emergency
In the end, there is no guarantee against a natural or man-made disaster, only a very high probability that you will fail without a detailed business continuity plan. Though the time and resources required will pull against other organizational priorities, executives need to dedicate the time to ensure business survivability. Tomorrow is already too late.