CXO Accent

Planning an effective DR strategy

DR planning requires detailed plans to enable the organisation to perform operations without disruptions in case of a disaster

Satish Naralkar

Many organisations have invested heavily in the areas of disaster recovery (DR) and business continuity since the 9/11 incident. Such elaborate measures are taken by companies to protect their investments and instill confidence in the public, as well as among employees and customers. While the concept of DR started as a safety measure, it is considered an important part of an enterprise today. The top management in most organisations now views DR capabilities as market differentiators. Customers and stakeholders feel secure as they realise that their supplier will be around even if there is a disaster. The goodwill generated by having DR capability can be considered as a form of return on investment. Also, regulatory bodies in a growing number of sectors such as financial services, insurance, energy and healthcare mandate DR requirements as part of business practice. DR planning is a meticulous approach and requires detailed plans to enable the organisation to perform operations without disruptions in case of a disaster.

DR requirements vary depending on the nature of the industry, operating environment, criticality of operations and impact of disruption on business operations. It is necessary to identify and obtain management approval for the following:

Critical operations: Identify all critical business functions and processes mandatory for continuous business operation.

Resources: Identify all the resources (IT as well as non-IT) required to perform the identified critical operations. Generally, people tend to overlook resources not related to information technology.

Recovery time objective (RTO): Establish the acceptable level of maximum time within which critical operations must be resumed after experiencing a disruption.

Recovery point objective (RPO): Establish the point in time to which data and systems must be recovered after experiencing a disruption.

The next step is to identify and establish all possible disruptions and outages. To make the strategy more effective, it is important to group all the identified disruptions and outages into a few high-level disruption scenarios. Alternate continuity strategies can then be identified for all such scenarios. After a cost-benefit analysis of all strategies, a practical and easy-to- implement cost-effective strategy should be selected for each business operation. Approval of the senior management should be obtained for these high-level disruption scenarios and the corresponding reaction strategy. Based on the approval of selected strategies, the implementation plan, including schedules and budgets, can be drawn.

Exposure to slowdowns or interruptions is directly related to an organisation’s level of dependence on technology. Manual work-arounds are no longer practical or available because technology is intrinsic to business processes. In the case of technology, determine if systems or applications are repairable and recoverable, and, if so, within what timeframe. While the role of technology is critical, it is essential for every person in the organisation to know his or her role in case of a disaster.

It is essential to conduct mock drills as processes that look fine on paper sometimes go wrong when put into practice. Management involvement and consent is necessary at every stage of DR planning and implementation.

The next challenge is handling change and maintaining the business continuity policy. You can create a business continuity plan that will hold good in the beginning. As time goes by, you upgrade infrastructure, install new applications and change existing applications and configurations—the existing plan may not stay comprehensive after six months. The challenge is to keep the backup site in sync with the primary site—at all times. In case of a disaster, the old data and the configurations will not be as effective as a well-updated policy.

Try to locate your DR site in a different seismic zone. Pune and Mumbai are in the same seismic zone. Therefore, it would make sense for companies to locate their DR sites in a different zone (such as Chennai).

In short, an effective disaster recovery strategy requires establishing critical operations, and identification and selection of the appropriate continuity strategy.

The author is Managing Director and CEO of NSE.IT