Once you’ve begun to outsource
functions of disaster recovery (DR), your job is not over. In order to
ensure that you don’t overlook future developments, or get caught short in an
emergency, you’ll have to perform an ongoing review of your outsourcing and
your internal DR plans.
Coordinating system changes and upgrades with your outsourcing partner
Once the contracts are in place, if you’ve followed best
practices, then you’ll find that you will be properly protected against
foreseeable disasters. However, changes to your systems or software are
inevitable, and if you don’t review how these things will affect your DR plan,
all of your good work will be in vain. When changes occur within the
environment, they may seem minor in appearance, but they can have a serious
impact on your DR planning if you have to coordinate the changes with your
outsourcing firm. For example, many software packages upgrade or issue service
packs and emergency fixes on a regular basis. The policy of your firm may be
(and in many cases should be) to immediately apply any security or other
necessary software upgrades on your production servers. While this can protect
you from many disasters, you must ensure that the same upgrades are performed as
required on the DR data systems. This may be a relatively easy job with good
internal change control policies, but if you outsource your DR, you end up with
some interesting problems.
Most notably, unless you have already contracted for the
service, you will need to ensure that the updates are pushed out to DR systems
yourself, or via communication with the outsourcing firm. In many cases, those
systems may be shared with other clients, and in order to update your own
systems, the outsourcer may require prior authorization for you make any
changes that could affect its other clients. Also, keep in mind that you may
not have routine physical access to the data center where your DR systems are held
without prior scheduling. That could mean delaying the upgrade process or
performing it remotely.
Many outsourcing firms contract for this type of service as
part of their DR packages, but even if they do, you must regularly review the
contracts and services—not only to ensure that you get the amount of services
your business requires, but also to ensure you’re not paying for things you’re
not going to use. If you only need a few hours of hands-on time per year, then
paying for several hours per month is a waste of resources. So even if your
updates are getting done properly, you should review the outsourcing systems
from time to time to make certain that you are not getting shortchanged on services, or paying too much for them.
Regular and routine re-examination of your contracts is an
important part of DR outsourcing. Generally, quarterly reviews will give you
the best mix of timeliness without overkill. Of course, if there are major
changes to your environment, you should immediately review your contracts;
preferably, you should include contract reviews as part of your change process.
