Once you've begun to outsource functions of disaster recovery (DR), your job is not over. In order to ensure that you don't overlook future developments, or get caught short in an emergency, you'll have to perform an ongoing review of your outsourcing and your internal DR plans.
Coordinating system changes and upgrades with your outsourcing partner
Once the contracts are in place, if you've followed best practices, then you'll find that you will be properly protected against foreseeable disasters. However, changes to your systems or software are inevitable, and if you don't review how these things will affect your DR plan, all of your good work will be in vain. When changes occur within the environment, they may seem minor in appearance, but they can have a serious impact on your DR planning if you have to coordinate the changes with your outsourcing firm. For example, many software packages upgrade or issue service packs and emergency fixes on a regular basis. The policy of your firm may be (and in many cases should be) to immediately apply any security or other necessary software upgrades on your production servers. While this can protect you from many disasters, you must ensure that the same upgrades are performed as required on the DR data systems. This may be a relatively easy job with good internal change control policies, but if you outsource your DR, you end up with some interesting problems.
Most notably, unless you have already contracted for the service, you will need to ensure that the updates are pushed out to DR systems yourself, or via communication with the outsourcing firm. In many cases, those systems may be shared with other clients, and in order to update your own systems, the outsourcer may require prior authorization for you make any changes that could affect its other clients. Also, keep in mind that you may not have routine physical access to the data center where your DR systems are held without prior scheduling. That could mean delaying the upgrade process or performing it remotely.
Many outsourcing firms contract for this type of service as part of their DR packages, but even if they do, you must regularly review the contracts and services—not only to ensure that you get the amount of services your business requires, but also to ensure you're not paying for things you're not going to use. If you only need a few hours of hands-on time per year, then paying for several hours per month is a waste of resources. So even if your updates are getting done properly, you should review the outsourcing systems from time to time to make certain that you are not getting shortchanged on services, or paying too much for them.
Regular and routine re-examination of your contracts is an important part of DR outsourcing. Generally, quarterly reviews will give you the best mix of timeliness without overkill. Of course, if there are major changes to your environment, you should immediately review your contracts; preferably, you should include contract reviews as part of your change process.
