Peer to Peer Magazine

www.iltanet.org 52 Peer to Peer Before pitching your plan, obviously, you need to prepare a budget that spells out the cost of downtime and be able to explain that to management very clearly. So let's talk about that. We all agree that even a minor BlackBerry outage turns out to be very expensive in many ways. You bet! Downtime means lost and often unrecoverable revenue in lots of ways, and those dollars add up quickly. Obviously law firms bill by the hour in servicing clients. If you can't do research because a system isn't accessible, you've got a loss of productivity. That's one aspect. If you can't service your clients they may go elsewhere because they're dissatisfied. Here's another example of a downtime loss: Many IT infrastructures currently use tape backup systems. Tape can be expensive to purchase, maintain, archive, recover and ship compared to other solutions. Those are costs you can't recover. And don't forget, many if not most activities attorneys are involved in for their clients are running on deadlines. Miss a key date because you can't get access to data, and you risk losing the case and the client. Brace, when assembling a BC plan, are firms typically able to use at least part of their existing IT infrastructure, or do you see them buying lots of new technology? Usually a firm's existing infrastructure can be used because they've taken really good care of it and don't need to replace it. Sometimes, however, if their servers are a few years old, they'll invest in new hardware to replace those and then use the older ones as their continuity structure. This kind of recycling is great, because they're getting newer, more efficient hardware to use as their primary systems. Also, the recycled servers will work nicely as secondary systems to enable resumption of business operations to a functional level when needed. And really, that's the ultimate goal for any business continuity plan –– to be able to resume business operations to a functional level. It may not be as fast as everybody likes and maybe not every single system is immediately available, but the firm can get back to servicing their clients, billing hours, sendin/receiving e-mail, getting access to mission- critical data while, in the meantime, IT can work to resolve the original issue or bring up other systems in order to increase overall performance. I would think that in a law firm, client-facing services go to the head of the line. True? Absolutely right. If staff can't communicate with clients, do research or access documents, you're stuck. In order to get back to a functional level, you need to focus BC on three key areas: communication and messaging, Internet access for legal research, and content and document management systems. Other services –– print servers, for example –– aren't quite as important to get online immediately, or even up to eight or 10 hours. The company will go on until all systems are up again. Do you find that larger law firms are quicker to adopt BC plans than smaller firms? Definitely. They're dealing with world-wide office locations where any interruption can mean significant loss of revenue. Where you see the hesitation is in the smaller law firms or startups. They're putting all their capital into getting the company off the ground, so they're less willing to put money in IT infrastructure, let alone a redundant system. Brace, how does a firm go about determining which BC controls are right for them? Start with risk analysis, where you determine what the most likely risks in your location(s) are –– hurricanes in Florida, for example. You follow that up with a business impact analysis in which your entire infrastructure is analyzed and systems categorized as to which ones are critical to keeping the business running and which are less so. It really all starts with identifying what the business-critical systems are and discovering what their recovery time and recovery point objectives are; then you can select the appropriate controls. What mistakes do companies make when putting together a business continuity plan? Here's a big one: Some companies race out and spend millions on the biggest, grandest system with features like "no downtime" and synchronous replication, before asking a key question: Is this what we really need? They might find out they're protecting everything when they only need to protect a small subset starting with business-critical systems. That's where cost, risk and impact analyses come in. So it's important to know the problem before you start spending money on the solution. Couldn't have said it better myself. Thank you, Brace, for reminding us once again how essential business continuity is to our livelihoods, and how important it is to do it right! ILTA brace Rennels is a certified business continuity professional (cbcP) and project manager at Double-take software. he has been involved with over 1,600 installations, managing resources and coordinating with multiple vendors and partners to provide business continuity solutions. he can be reached at brennels@doubletake.com. find more resources online at iltanet.org search for "business continuity"

• Cover