Successful business continuity strategies: how to conduct business as usual in unusual times.

In today's fast-paced business environment, there is little tolerance for any downtime or business disruption. Therefore, enterprises of all types and sizes are bolstering essential corporate lifelines with comprehensive business continuity strategies that ensure the usual access to mission-critical data--even in unusual times. But when it comes to safeguarding vital information, enterprises continue to grapple with the distinction between business continuity and disaster recovery. While disaster recovery primarily involves protecting IT infrastructure and data from disabling data loss after an equipment or site failure, business continuity is a comprehensive, strategic approach to maintaining business operations when a catastrophic event occurs.

To properly address business continuity, it is important to recognize that technology is just a single component of an overall strategy. Truly comprehensive business continuity strategies include a number of processes by which an organization operates when all systems are available and defines how a seamless transition is made for both technical and business practices when any downtime occurs.

In his book, The Resilient Enterprise: Overcoming Vulnerability for Competitive Advantage, Yossi Sheffi offers pragmatic advice on how to bounce back from disruptions and disasters by building in company-wide redundancy and flexibility. According to Michael Cadenazzi, director of operations for Continuity Solutions LLC, a Reston, Va.-based provider of engineering and operational solutions, The Resilient Enterprise delivers valuable lessons from dozens of large and small companies that faced adversity with varying levels of success. "Companies that take an architectural approach to business continuity planning are ultimately the most resilient," he explains. "It's essential to start at the top and work through all levels of the business to determine the critical interconnection points between people, processes, technologies, suppliers and customers."

Beyond Disaster Recovery

High profile disasters such as hurricanes, fires, terrorist attacks, earthquakes and tsunamis aren't the only kinds of disasters that can cripple an organization. Even mundane events such as cable cuts, power outages, computer viruses and equipment failures can jeopardize a company's business survival. Successful business continuity strategies provide more than the ability to restore or recover data; they improve the financial performance of the business by ensuring uninterrupted workforce productivity and revenue generation. In some cases, the ability to continue operations--albeit at a reduced level--is sufficient for a specific period of time. Not being prepared can result in overwhelmingly detrimental consequences. According to Gartner Group, 40 percent of organizations that suffer major interruptions go out of business within two years.

Most companies cite downtime and its impact on revenue generation as the major drivers creating demand for a comprehensive business continuity strategy. Among the most tangible consequences of service downtime, besides the adverse effect on revenues, is the derailment of everyday business systems that help organizations operate productively. Reportedly, carmaker Subaru calculated that the company loses $20,000 an hour on wages alone when its inventory tracking system is down. This realization shows the high degree of direct impact that not having a business continuity strategy can have on a company's bottom line.

While any interruption to revenue generation undeniably plays a major role in the need for business continuity, it is not the only factor that should be considered when analyzing the optimal business continuity approach. As the chart in Figure 1 illustrates, there are a variety of intangible costs that indirectly impact the bottom line, which all accelerate the growing demand for greater business resiliency.

For Cbeyond, a managed services provider based in Atlanta, becoming a publicly traded entity in November 2005 created new compliance and reporting challenges. Since its inception in 1999, the company continually invested in leading-edge network infrastructure, state-of-the-art operations support systems (OSS) and robust data protection solutions to ensure top-notch delivery of integrated voice, mobile, and broadband services to small businesses in six tier one cities. Following its Initial Public Offering (IPO), however, business continuity became a top corporate imperative.

According to Allen Thomas, senior director of systems operations, the demand for robust financial and IT audit controls was the impetus for improving the company's backup and recovery architecture as well as the formation of a crisis management team to spearhead the development of a company-wide business continuity plan. "We have an additional responsibility to Cbeyond's public shareholders now," he says. "We need to ensure them along with our customers, partners and employees that we can keep the business running, even if we have issues with our main production data center."

To that end, Cbeyond embarked on a nine-month business continiuty plan, which involved replacing its current backup and recovery platform with a streamlined, heterogeneous solution. The action entailed working with a traditional disaster recovery provider for offsite call-center operations in the event of a prolonged outage and deploying redundant data center capabilities with failover procedures--all documented in a comprehensive, tested business continuity plan.

On the Road to Resiliency

While myriad business drivers may lead to the need for improved business continuity planning, a series of steps should be followed once on the path. "In getting started, you need to develop an in-depth understanding of what is really needed to serve customers and generate revenue," says Cadenazzi. "Once you have identified the essential elements that must be protected first, it becomes a lot easier to prioritize other components and outsource or get rid of non-essential items."

To jumpstart Cbeyond's business continuity planning, major corporate stakeholders were assembled, including senior managers from each part of the organization as well as their first-level reports. As a team, they defined the company's business functions and systems--ranging from CRM, billing and OSS to marketing, accounting and systems as well as network engineering. Next, they ranked each functional area in order of importance as it pertained to keeping critical business operations up and running while also taking into consideration which people and technology systems were required to support each vital area.

During the business impact analysis phase, it's not unusual for companies to discover that their systems, people and processes are much more intertwined and connected than initially suspected. "Tracing the links between departments, business functions and applications is vital to determining how long you can be without certain areas without causing irreparable harm to the business," says Cadenazzi.

Determining an "acceptable level" of business continuance is a daunting task, but it can be alleviated somewhat by developing a broad understanding of which applications and data deliver the highest levels of value to the organization. "You need to take all your applications and put them into different 'buckets' and then rank their importance from a business perspective," says Arun Taneja, founder and consulting analyst of the Taneja Group. "In assessing value, first determine what level of downtime and data loss is acceptable. Next, assess how long you can survive without having access to these core applications and critical data."

By linking applications to their underlying business processes, organizations then can start determining the business value and potential impact on revenue generation or productivity for each specific application. Based upon this data, organizations must identify the acceptable amount of downtime for each application. Assessing these calculations both in terms of downtime and data gaps will help organizations set recovery point objectives (RPOs) as well as recovery time objective (RTOs) by application.

As part of a comprehensive business continuity strategy, organizations should also evaluate the availability and resiliency of their network infrastructure, including servers and connections that may impact targeted RTOs and RPOs. This can be an extremely time consuming and tedious task, but spending time upfront to determine the business value of each area and application will prove instrumental in creating a flexible but solid blueprint for business continuity.

The answers to the questions in Figure 2 often prove invaluable in measuring the worth of specific systems and applications, especially now that certain applications have moved up the corporate ladder to become high-impact areas. According to Taneja, companies of all sizes no longer rely on protecting just one or two core applications to ensure business survival in the event of a major disruption. "It's not just a case of protecting the crucial corporate databases anymore now that email has become the lifeblood of many organizations," he explains. "No matter the size or business segment, all companies are vulnerable to the potentially devastating effects of losing mission-critical data unless they have a solid business continuity plan in place."

Obviously, the areas that receive high-impact answers should be addressed first with other, less critical areas incorporated into the plan in terms of their relevance to business continuance and ultimate value to the organization.

Identifying downtime and data loss or gaps will help organizations set their RPO and RTO by application. "At some point, most companies will reach zero tolerance for any application downtime or data loss, which will put Continuous Data Protection (CDP) products in the limelight," comments Taneja. Today, the challenge is easing the integration of different data protection solutions--backup and recovery, replication, vaulting and snapshot--to ensure they work together seamlessly and across different computer platforms, including Windows, Linux, UNIX and Macintosh. "It's important to recognize that not all applications are of equal value to the organization," notes Taneja. "The goal is to take measured steps that balance technology requirements with business needs to lower risks, reduce complexities and keep operations up and running in the event of a failure."

Achieving Business/Technology Balance

The evaluation of different technologies that best meet an organization's needs starts with the RTO and RPO objectives. "In assessing our needs, it was clear that backup and recovery was the first line of defense," explains Thomas. "To reduce complexities while delivering enterprise-class data protection we replaced our current backup environment with BakBone's NetVault: Backup." In addition to improving its backup and recovery capabilities, Cbeyond also sought a cost effective way to add redundancy to its main data center. "We weighed the costs and advantages of being able to instantly failover to a secondary site," says Thomas. "It all came down to reducing risks while increasing resiliency."

After identifying the impact of both technological and business components, an all-encompassing business continuity strategy must address these elements globally in both scope and implementation in order to protect against a variety of disruptions. Organizations must carefully balance their local, remote and offsite capabilities to ensure the implementation of a balanced strategy. For example, having multiple copies of data at several local locations might help overcome a hardware-related failure, but this approach could be ineffective if there was a site failure due to something as mundane as a loss of power in transit.

Every business continuity planner must identify and make trade-offs in costs relative to objectives-a task made much simpler when there is a full analysis of the impact of interruptions to critical business systems. For Cbeyond's Thomas, one of the biggest challenges was justifying the cost typically associated with building a fully redundant, standby environment. With ingenuity and some equipment upgrades, however, Cbeyond was able to increase capabilities at the company's redundant data center to mirror the main data center.

Embracing Best Practices

Perhaps most importantly in any business continuity preparation is continually validating the viability of business processes with the technology solutions that support them. "Technology should be an enabler that supports a series of best business practices," says Cadenazzi. "Once you have the right tools, you can reduce vulnerabilities while being flexible enough to adapt the plan to ever-changing corporate environments."

Organizations that are most successful take the time to quantify their requirements and continuously measure their results against the requirements. According to the best practices recommendations of the Business Continuity Institute, plans must be tested at least once a year. Testing is best treated not as a single event, but as an ongoing process with multiple layers that need to be evaluated, tested and re-tested over time.

"Testing is crucial, so is communicating what you're doing to the rest of the organization," concludes Thomas. "If you want to turn business resiliency into a top corporate asset, you need to make the commitment--both in time and resources--to do all the systems and process analyses and then be serious about supporting all the steps along the way."

10 Steps to a More Resilient Organization

To assist companies in planning and executing successful business continuity strategies, the following steps are recommended:

Step 1 -- Define strategy objectives by performing needs analyses and create a framework for strategy implementation;

Step 2 -- Determine the business value of the organization's applications and define recovery objectives through data risk and recovery time profiles;

Step 3 -- Match technologies for safeguarding data, including backup, disaster recovery, vaulting, snapshot and replication, based on business value;

Step 4 -- Define infrastructure and personnel plans, including organizational and communications processes;

Step 5 -- Implement technologies and educate critical personnel as to which business processes are impacted;

Step 6 -- Test the documented plan continuously and under different circumstances;

Step 7 -- Measure and validate test results relative to the plan's overall objectives;

Step 8 -- Implement required enhancements that have been prioritized as a result of continuous testing and evaluation;

Step 9 -- Continuously review and enhance the business continuity plan to reflect organizational changes, fluctuating business conditions and the addition of new technologies;

Step 10 -- Repeat the entire process continuously.

Ken Horner is senior vice president of corporate strategy and development at BakBone Software 

www.bakbone.com

Within your organization, what are the drivers for increasing IT
resilience?

Desire to protect brand             28%
Greater broad awareness of IT risk  48%
Growing security threat             32%
Regulatory compliance               35%
Others                              49%

Figure 1: Key Drivers for Increased Business Resiliency (Source:
Infoconomy)

Note: Table made from bar graph.

Question               High Impact     Medium Impact       Low Impact

What is the impact     Direct          Peripheral          No
of the system on       correlation     correlation to      correlation
revenue generation?    to revenue      revenue             to revenue
How many internal      Entire company  One or more         Select
users does the                         departmens          users
systems support?                                           throughout
                                                           the company
What is the cost       Material to     Material to         Peripheral
of the supported       the company     departmental        departmental
users?                                 budgets             expense
What is the impact     Directly        Perripherial        No impact
on compliance of       regulated by    impact
the system?            guidelines or
                       legislation
How will customers     Revenue         Gather information  No
or prospects interact  generation or   on company          interaction
with the system?       customer        and products
                       support
Which buisiness        Any externally  Critical internal   Non-critical
processes interact     facing          processes           internal
with the system?       processes                           processes

Figure 2. Assessing the Value of Key Applications

Technology   Function             Benefit                       Media

Backup       Creates copies of    Provides copy of data that    Disk or
             data                 can be physically moved off-  tape
                                  site
Disaster     Creates recover-     Provides rapid recovery of    Disk
Recovery     able versions of     systems and data              and/or
             systems and data                                   tape
Vaulting     Creates a copy of    Provides copies of data that  Tape
             data that can not    can not be modified to be
             be modified          physically moved offsite
Snapshot     Creates copy of      Provides copies of data that  Disk
             an active data set   can be created and retrieved
                                  quickly
Replication  Creates a real-time  Provides real-time data       Disk
             copy of data at      copies at geographically
             multiple locations   distributed locations

Technology   Recovery Point      Recovery Time

Backup       Days                Hours to days
Disaster     Days to weeks       Hours to days
Recovery
Vaulting     Days to weeks       Days to weeks
Snapshot     Minutes to hours    Minutes to hours
Replication  Seconds to minutes  Seconds to minutes

Figure 3. The most common business continuity components from a
technology perspective that meets the gamut of business objectives