Lessons learned since 9/11

Everyone is most concerned about the bottom line. The anticipated consequences of showing lower earnings are more frightening than the small probability that the business will be put out of business.

Everyone is going through the motions, right up to the point where they have to spend a significant amount of money. Then they start calculating the expense in terms of earnings per share!

The first high profile case in which the surviving officers and directors are held liable for their failure to make adequate plans should have a galvanizing effect.

Unfortunately, I agree with Mike's observations. Being in the NYC area, we were directly affected by 9/11. Afterwards, one of two things happened -- either my guys were working 18 hours a day to get servers up and running, or the projects were cancelled. By January, disaster recovery was a hot topic, and we were doing a lot of strategy sessions and executive overviews, but I know of few companies who have actually implemented most of the recommended changes -- and not all of them took a lot of investment, either.

I've come to believe that it is part of the ostrich syndrome, where they can't believe anything that horrific will happen again, so they don't want to prepare for it. Meanwhile, it would take a lot less than a terrorist attack to wipe out many of these businesses.

I have been in the DR Planning field for over 12 years. While a budget is helpful, it is not necessary. The IT basics need to be considered first. I have a successful business model that uses what is already in place, in most instances.
Here are the elements necessary at a minimum:
Contacts: IT, Customer, Vendor; Inventory: Hardware, OS, Utilities and Applications; Procedures: Backup and Recovery; Document the above, and place it with the offsite data media. I always suggest that the data be sent offsite daily, no matter what the recovery time objective or recovery point object is. Also, all of the above can, and should, be implemented operationally. It should be part of the every day practice. No matter what your position within IT, youfulfill your responsibility in the above model and you can use your influence to get this initiated in IT. Be a leader from wherever you are in the organization. As you can see, the above model "touches" the budget in three areas: IT staff time, backup capability, and offsite storage (Could be another company facility). All of these are assumed to be in the budget, and are not necessarily in the "DR budget".

Here's some feedback from one of our readers:

Mike Talon's observations are IMHO, disappointingly accurate. Although I haven't been in the IT sector for some time, my contacts within have not mentioned "off site" data storage or any other "out ofarea" contingency plans.

This has relevance in reference to my location, as the city is in proximity to a major fault line. Though most businesses are now centralized in another city, that particular city also has some violent past because it's built on and around volcanoes.

I think that DR is like crying wolf. You continue to advise that "It will happen, it's when and how bad that I don't know," but because it doesn't happen, such cries are easily ignored.

Here's more reader feedback:

Mike Talon's observations on the DR lessons organizations have learned since the terrorist attacks of 9/11 are right on target! However, people and businesses are slow, and still resistant to making the necessary changes and preparations for DR. Even before 9-11-2K1, I was attempting to set up a small business that offered remote (offsite) backup services to individuals and other small to medium size businesses. Up against stiff resistance and a disaster of my own (a flood), I finally got up and running in late July of this year. I offer a high level of service at a bargain basement price, yet people are still holding back, thinking that they can do it them selves, or they are still just unconcerned about it. It seems that they would rather risk going out of business just to save a few bucks a month. However, these same people don't think twice about spending 4 to 8 times as much a month for their home owners and/or car insurance, cable or satellite TV service, video and/or game rentals, etc. I just can't understand their logic, can you?

True indeed, online backup services are expensive, and if you're in a financial or securities firm, you will still have to use tape to meet SEC and FDIC requirements. However, find out how much one day's worth of lost data will cost, then weigh that against using online data protection systems.

Remeber that off-site online data protection IS something you can do yourself if your company has more than one office. Many products exist that allow you to replicate servers either with or withoutadditional hardware. It all comes down to needs versus budget, but there is a solution for every budget, so don't settle for less!

Mike Talon