Small businesses spend much less money than they should on disaster recovery. Consider the cost to your business for every hour or every day without IT services.
By Chaz Popovich
Article published with permission from Small Business Technology Magazine1
It's nearly impossible to predict how your small business will be affected in the event of a fire, flood, or a civil emergency, but as a business owner or manager, you must plan for such disaster scenarios. The time and financial implications should reflect the likely risks to your business and how much the expected impact needs to be mitigated or avoided.
If a disaster occurs, it probably won't happen like you planned. However, a good plan will decrease the impact to your business by helping to protect your assets, improve your operations, and get you up and running faster after the disaster.
Where to start and stop planning for disaster recovery can seem daunting; fortunately much of this planning can be distilled to a few critical factors by answering some basic questions and considering their combined answers before beginning to develop a disaster recovery plan.
How long?
Day care centers, financial services firms, retail stores and law firms use information technology (IT) differently. A normalizing metric is how long can the business run without IT. Initially, the answer is "no outages" or "five minutes". However, implementing a disaster recovery plan around very rapid recovery times can be extremely expensive for small companies.
The most common IT disasters typically center on internal hardware issues (i.e. failed hard drives, failed power supplies, failed network cards). With a good backup and basic IT equipment, 95 percent of these can be fixed in less than eight hours. During that time you will likely have some of your services like e-mail, but no file or print services.
However, all other disasters will operate on a timetable outside of your control. Even after a small fire you may not be allowed back into your building for a few hours or days. One example involves a business in a multi-floor building. When their upstairs neighbor had a fire, the water poured down into the business' office space, forcing an evacuation. The business had to wait several days for the insurance adjuster before they could re-enter their space.
How can you estimate how long your business can run without IT? Consider whether you need IT services if you can't enter your facility. If you do need IT services and can't re-enter your facility, then you will need a disaster recovery solution that has offsite components. This might include storing a copy of your backup offsite (a must) or housing your data live on a server offsite. Bottom line, disaster recovery planning does not have to be cumbersome, complex or expensive.
How much?
Small companies typically spend less than they should on disaster recovery. Consider the cost to your business for every hour or day without IT services and use this as a guideline for budgeting your disaster recovery planning.
Coupling disaster preparedness planning with an upgrade or other technology initiative is a great way to offset the cost.
How long can your business run without IT services?
Typical components (Cumulative)
Cost, with services (Cumulative)
A few days or until there is access to the facility
Regular onsite back-ups with tapes tested weekly and stored off site daily
One-time cost $1,000 to $5,000 per 100 Gig of data for the tape drive(s), plus about $1,000 a year for replacement tapes
One day or until there is access to the facility
Add redundant subsystems for all servers, near line spare hardware, organize inventory of software and spare hardware, IT staff must practice restores quarterly
Add $8,000 to $25,000 or more per server
One day even if there is no access to the facility
Off site data replication to standby server
Add very, very roughly about $1,000 per month per Gig of data replicated
Several hour even if there is no access to the facility
Off site replication to online server, mobile IT equipment for all staff, semi annual staff training in use of backup systems
Add initial purchase price of spare online equipment and training cost to teach staff how to access backup data, add about $500 a month for bandwidth charges
No downtime at all regardless of access
Two or more operational offices, 25 or more miles apart, trained to duplicate each others functions
Double everything
How likely?
Next, consider what threats are likely to affect your business. Many are location-specific; the most common is an unreliable electric power supply. For example, if you are located next to a levy, minimize risk by placing backup generators on the roof instead of the basement. Are you next to a construction site? There's a chance that the construction crew will drive over your communication cabling with a bulldozer; a risk that can be minimized using cellular broadband technology.
Execution
Extensive training of your employees on the disaster recovery plan is critical to diminishing recovery time. For example, you may need to define when and how IT staff will commute to a different location from usual; how they will have the appropriate back up of hardware, software, and license keys on hand to rebuild a and the adequate number of workstations needed in order to provide connectivity and LAN services (printing, Internet, e-mail) to all employees.
Rapid communication will be critical. A lesson from Hurricane Katrina is that if some cell towers are destroyed it will be difficult to get access to your cellular network to speak to others. However, text messaging will typically work even in extremely busy networks. Because of its small bandwidth requirement and because of cell towers' ability to store messages until a moment is available to forward the message, text messaging may be your most reliable means of communication during a disaster. Naturally this means your staff will need to know how to send each other text messages.
Beyond IT
When planning for even larger disasters to encompass ever more scenarios, do not forget that just basic precautions, security, and staff education will protect your small business from almost all events.
The financial impact of a disaster can be minimized with proper insurance coverage, as well as establishing lines of credit that can be accessed if necessary. When negotiating with vendors, determine if you can add a clause to your contract that will allow for an extend credit terms in a disaster situation.
A crisis communication plan should be in place to advise on who speaks to the media, customers, vendors, and any other critical partners. How will business be affected during the first few days and weeks of a disaster? A post-disaster business resumption plan also needs to be in place.
Disasters of all sizes happen. Fortunately, it is possible to be prepared.
Rate this information
1Chaz Popovich is an IT executive and Vice President at OSI Technologies.
Small Business Technology Magazine and its guest contributors are responsible for the information in this article.
Printable version
