3. Let recovery requirements dictate the level of dedicated BC services.
Subscribing to a data recovery service that you can trigger when a disaster strikes is fine if data can be restored in two to four days. But increasingly, as businesses require 24/7/365 availability, more dedicated data recovery services are required.
"If you have to recover within 24 hours, that requires some form of dedicated infrastructure in terms of remote SAN [storage area network]. If you're using asynchronous replication or data mirroring, you've got to have fixed assets that are using the data backup," Gartner's Morency says. "You have to have that space on a dedicated basis because when disaster strikes, you need to get your staff out quickly and be able to get everything up quickly."
That's at odds with the shared capacity model, especially in the case of a regional disaster like Hurricane Katrina or a major earthquake, where multiple businesses declare disasters at the same time. After all, if everybody needs the same rented facility at the same time, somebody is going to be out of luck. Companies that can't afford to wait their turn are either evaluating building their own facilities or looking for service providers that can meet their needs.
These faster recovery requirements are bringing new players into the market. Colocation vendors such as NaviSite in Andover, Mass.; Equinix in Foster City, Calif.; and Houston-based VeriCenter are capitalizing on increased demand for data center space.
Organizations that already use SunGard, IBM and HP "are engaging with colocation providers to rent floor space where they can put two to three racks, their SAN equipment and server equipment in the cage in a dedicated facility," Morency explains. "All they're doing is renting floor space and communications capacity. In many cases, it can provide a more available service either at the same cost or at a lower cost [than full-service business continuity providers]. It gives those businesses more predictability in responding to disasters and supporting those [24 hour or less] recovery times."
Major BC service providers also see a growing need for data center space to address customers' needs. Case in point: In July, SunGard acquired VeriCenter, which brought seven data centers to the table.
4. Don't forget emergency notification systems.
During the LaSalle Bank building fire, Smith says the most valuable business continuity tool "by far" was the automated call system. Key IT people, facilities managers, security directors and the key business managers throughout the building were automatically notified of the emergency and where to report.
"We get them all in the room, and everyone has to execute their biz continuity plan. They used the automated call system to call all their people and tell them to go to the secondary site to restore servers and other things to process from another location the next morning," Smith says. "We worked throughout the night and called every two to three hours to touch base. Between that, groups talked amongst themselves to work toward recovery."
Emergency notification systems can use many different means of communication--phone calls, text messages, e-mail--to contact employees, vendors or other critical personnel.
While the Big Three business continuity service providers don't offer their own emergency notification systems, they do support outside systems with their service. SunGard, for instance, supports Paragon software, which can be offered as a managed service.
Other players include Strohl Systems' LDRPS software, Seattle-based Varolii and Verizon business services, which just announced a managed service offering for emergency notification.
Smith prefers the same simplicity with a notification system as he does with his BC planning tools. "Although [emergency notification systems] may have slick bells and whistles, I have found that you don't need them," Smith says. "You need a system that will call a lot of people all at once and have them call into a central conference call number."
He also suggests having an automatic phone forwarding system through your phone company. That way, clients whose only contact is an office phone number can be rerouted to an employee's cell or home phone.
5. Use caution when outsourcing business continuity functions overseas.
Because of terrorism and natural disasters typically not seen in the United States, such as tsunamis and monsoons, companies should take caution when outsourcing backup, recovery and business continuity operations offshore. Some popular outsourcing countries may not have the recovery capabilities found in the United States. "A Third World company doesn't have the recovery capabilities that we do [in the U.S.]," Smith says. "As you outsource [abroad], you increase your risk of significant disruption."