Is DR in the budget?

I have been involved with DRP situations and planning for about 10 years. I disagree with the writer of the article. I think the worst thing you can do in a recovery situation is decide to try and look good by slapping in upgrades and improvements. At best, the end user will receive something he did not want at that moment in time (he has other more important things on his mind); at worst, you will cause unnecessary problems and delays. ......Ed

The BIA tells MIS what the business feels is important, and how much the business process is worth. MIS provides options at various recovery times and varying costs (none exceeding the BIA value). We usually tie recovery options to the BIA, so a denied group of MIS recovery options is essentially management saying the corresponding BIA business process has less value than the options.

If the business wont fund one of the options for the BIA business process:

1. Look for vendors that cansupply the denied resources under emergency conditions and prepare emergency options that management can decide on after the disaster has occurred.
2. Build emergency options and denied resources into existing and future approved projects.
3. Let business managers know that their business process recovery options have been denied so they can carry the torch to executive management, and update their business continuity plans accordingly.

MIS projects must support business processes, or theyare simply expensive fluff. If your ineffective at putting the recovery options in business terms to get approval, then you better find someone who can.

In a disaster, it's better to have options for management rather than 'You can't recover that business process because you denied our recovery budget for it.'

Truthfully, a properly managed business will always be able to recover. What isn't covered under MIS recovery must be covered under business continuity processes. If not, it isa problem with management.

Keep MIS records of all decision making offsite for proof that management has denied business needs. Management usually wont bother to keep records of decisions offsite, and the board may be very interested in how management has responded. Just be sure you can get the boards ear when management is staring into the headlights of a real disaster.

Eacy and every level of funding the DR of a business process will produce a recovery time for that process. The only way I've found to have a useful discussion with senior management (CFO/CEO) is to focus on the metric. If they think that the metricis too large (to long a time) then funding will always be forthcomming. They may inquire rather throughly on what you want to spend the money on, but once you have passed the validation process they will spend the money - if they have it.

Sometimes they decide that the recovery time is acceptiable - in which case execute the plan you've got.

Rarely they decide that a longer recovery time is acceptiable and cut the budget some more. However, the good news here is that tendency is to tellyou to rebudget for "X" recovery time, so you have time to cut in a rational fashion.

Occasionally the decision is to decrease the recovery time for "A" and fund it by increasing the rest of the proceses recovery time. This case should be documented fully.

In all cases the IT manager should produce and publish a document specifying the recovery time for each and every business process covered. Most important, completely list all uncovered business processes. Sections of the document should detail exactly what that means for each major business process. The more detail the better - but always specify the detail in terms of the availability metric - it will be x time before y function will be available again. Note any possible conditions where x time might not be sufficient (end of month? etc.).

This may not actually get you the budget needed to insure DR for the corporation. It will reduce the ability of the businesses to scapegoat IT.

As the manager and part owner of an online data backup & recovery company, we have discovered that many companies will continue to play Russian Roulette with their data even after a severe data crash. Their attitude seems to be one of 'lightning doesn't strike twice in the same place'. Despite our best efforts to educate these companies and others, they continue to uphold the statistics which show that anywhere from 40% to 93% of businesses suffering a data crash will be out of business within 18 months; half will never reopen their doors. Even after we recover data for non-clients and offer to allow them to use all or part of their data recovery bill towards our online service, they still are willing to take uncnecessary risks and not back up their data or back it up with a system that just failed them. I find it ironic that most of the companies that call us for data recovery services, had a back-up procedure in place and were using it regularly. They just couldn't recover their data. All of this shows that it's not about backing up data, it's about being able to recover your data when you need it most. Unfortunately, most businesses put more emphasis on backing up the data than they do on recovering it. Kind of like putting money in the bank and not giving a hoot if you can get it back out.