Peer to Peer Magazine

the quarterly magazine of ILTA 51 Peer to Peer Careful Planning ensures Business Continuity ILTA: Brace, your company provides business continuity (BC) consulting and software for businesses in key market segments including law firms. Given the number of projects you've handled for so many different types and sizes of companies worldwide, we welcome your experience and expertise. So let's start with a basic question: What are the differences between business continuity (BC) and disaster recovery (DR) plans? BRACE: BC and DR certainly overlap, but to be precise, disaster recovery is when you're trying to recover from an environmental or natural event like a hurricane or earthquake, or from a manmade event that destroys, or at least prevents your access to, your entire facility. One minute it's business as usual, and then suddenly, you have to find a new facility and essentially rebuild an entire infrastructure as quickly as possible, typically in 24 to 48 hours, in order to resume business operations and keep servicing clients who depend on you. Business continuity focuses on day-to-day operations. Your challenge is to recover from a hardware, power or network failure quickly, even instantaneously. As we all know, thanks to the nature of technology, such a malfunction is bound to happen sooner or later. Whether the event is a surprise or planned maintenance, it's essential to be able to fail over from one system to another in a matter of minutes or even seconds and resume your business operations with minimal disruption to your users. So you could say disaster recovery is pulling yourself up from the ground, while business continuity is an always- up status. Well put. And I would add that the other big difference between the two is that BC operations are handled onsite, whereas a disaster recovery center is located and maintained offsite, for safety and security. Incidentally, business continuity is a great way for IT folks to "rehearse" for a disaster recovery situation. Obviously, both these plans require careful planning and sponsorship. How would a firm get started with its planning efforts? There are many online resources to assist. One I particularly like is DRI International (drii.com), which offers 10 steps, starting with getting executive buy-in. Like any project that requires capital outlay, you've got to have that executive support. What's the best way to go about that? Well, it's a best practice to first prepare a mission statement with your stakeholders and get buy-in from department heads, everyone involved. Then if there are any objections or questions along the way, you can go back to the original agreement. But probably most important, you need the support of HR, which helps coordinate evacuation of personnel. The number one priority of any BC plan is the safety of your most valuable assets: your employees. A first step in business continuity (BC) planning is organizing a team of stakeholders comprising executives, human resources and IT. Getting executive sponsorship can be difficult and will require a good explanation of the BC concept to ensure buy-in. The executive team must commit to the necessary investments of your final plan. Often, BC plans call for duplicate data centers, and that reason alone can seem cost-prohibitive for most small and medium sized businesses. However, it only takes one incident that prevents a firm from servicing clients to realize the cost of lost revenue and client dissatisfaction. Here are three key messages to communicate the benefits of having a business continuity plan for your firm. Define the Purpose: The concept of a business continuity plan is to prevent extended periods of outages that will cost the firm revenue and reputation. The number one priority of any plan is protecting the most valuable assets, which are the health and safety of the employees. Second, and very important, is the rapid recovery or restoration of business-critical systems. If you've ever had your messaging system go down for any period of time, you likely received calls from several partners who were greatly inconvenienced by their disruption of e-mail. Define the scope: Selling the "right plan" starts with understanding what keeps your business running and prioritizing the recovery of systems that are most critical. This is determined during a business impact analysis, but it's likely you already know the firm's business. Identifying business-critical systems should be pretty simple. Explain the value: It's important to articulate the firm's tolerance for disruption in order to determine the cost of mitigating it. Redundant systems and sites, regardless of size and complexity, will be expensive, but not as costly as the loss of services over a defined period of time. With the introduction and adoption of cloud computing, cost-effective options for business continuity and disaster recovery have surfaced. Why invest hundreds of thousands, if not millions, of dollars to create your own data center when you can rent computing power from someone like a commodity or utility service? Cloud providers like Amazon, Microsoft, Rackspace or Terremark offer "software as a service" (SaaS), "infrastructure as a service" (IaaS) or "platform as a service" (PaaS). As you propose your plan to your stakeholders, be prepared by presenting some numbers that identify the cost of downtime and how much firm revenue is at risk if business systems become unavailable for an extended period of time. By working alongside your executive team to truly understand the value of BC planning, selling the plan is easy. ILTA Selling a Business Continuity Plan to Stakeholders

• Cover