Get the INSIDE TRACK on TECHNOLOGY and
MANUFACTURING BUSINESS

Minnesota Technology Magazine - Spring 2007

Helping Manufacturing Enterprises Grow Profitably

What's Your Plan?

Business-continuity planning is a high priority for companies these days. Here are four critical steps to consider when developing a plan of your own.

BY MELEAH MAYNARD

When it comes to data disasters, the folks at Kroll Ontrack in Eden Prairie have probably heard it all. Just last year there was that group of global telecommunications employees who accidentally dropped a laptop from a helicopter while working on a project in Monaco. Then there was the guy who forgot to remove the old banana he’d placed on top of his external hard drive before going out of town. Or how about the business traveler who packed his shampoo in the same bag as his laptop before jumping on a flight from London to Warsaw?

Businesses get stung by disruptions caused by lost data all the time. But having a plan for managing data emergencies and other serious events that affect day-today operations can significantly lessen the hurt, allowing your company to get back on track quickly and efficiently.

One key advantage to developing a disaster-recovery plan, says Jim Reinert, Kroll Ontrack’s senior director of software services, is that through the process, businesses learn that what may seem like an all-out disaster is really quite manageable. “A lot of people don’t think they can do anything about lost data,” Reinert explains. “But we tell people never to give up hope for their hard drive no matter what it’s been through. We’re able to recover data for most of our customers. We even recovered the files for the people who dropped the laptop out of the helicopter in time for them to make a meeting in Hong Kong the next day.”

The idea that companies need to plan ahead to prevent the potentially crippling chaos that can follow unexpected events like power failures, floods, communications services breakdowns, fires, earthquakes, tornados, theft, arson—the list goes on and on—is not new.

Yet, while studies suggest that as many as two out of three medium- to large-size businesses have put formal plans in place, decision-makers at many companies of all sizes have yet to act. Time, money, lack of buy-in from everyone involved, and not really knowing how to get started are just some of the reasons why planning never gets off the ground. All too often, says Reinert, it takes an actual disaster to get people to make the leap and put a plan in place.

But times may be changing. According to a recent survey of IT directors, chief executive officers and managers of large- and medium-size businesses conducted by HP and GCR Custom Research, nine out of 10 companies surveyed said they planned to increase their spending on disaster and recovery planning in 2007.

The reason is simple, the report adds. Businesses can clearly see how well-planned disaster-recovery and business-continuity plans offer solid ROI on the time and money it takes to create one. “Things move fast in today’s world,” says Robert Huber, president of USG, a Bloomington-based disaster-planning firm. “If disaster strikes and you don’t have a plan to get your company up and running within three to five days, there’s a good chance your company’s going to go out of business.”

If you’ve been thinking about putting together disasterrecovery and business-continuity plans for your company, there’s no better time than now to get started. To help, we asked Huber and other disaster-planning experts to share some of the tips and advice they give clients looking to put together their first plan. Here’s what they said.

STEP 1 — IDENTIFY YOUR RISK LEVEL

First off, says Stan Mork, managing director for the upper Midwest business consulting practice for RSM McGladrey, it’s important to understand the terminology that surrounds disaster planning. Years ago, everything used to be called disaster recovery, he says. Today, though, if someone uses the term, he or she is talking only about computers and data. Business continuity, on the other hand, encompasses all aspects of a company’s plan for getting back on track in the wake of any of business-disrupting event. “Disaster

recovery is only one small piece of a good businesscontinuity plan,” Mork explains. “We always tell people, ‘Sure, it’s a good idea to be able to get your computers back up and running. But what good will that do if your people don’t know what to do or where to go in the event of a disaster?’”

Consultants with RSM McGladrey, a national accounting, tax, and business consulting firm, have been helping clients with disaster-recovery and business-continuity planning for more than 20 years. During that time, one of the most important things they’ve learned is the need to create a plan that can grow and change as an organization grows. With that in mind, it’s best to start with small, simple steps, says Mork.

Start with the basics, asking yourself why your business needs a disaster-mitigating plan. What risks are you taking by not having one in place? What kind of financial loss could your company suffer if it were out of commission for a day, a week, a month? Might there be a legal or regulatory impact (think banks) if your company couldn’t function for a while? What would it cost to hire an outside firm to take care of your customers if you could not? Businesses that have the answers to these questions can better understand how much time and money to invest in developing a plan, says Mork.

STEP 2 — ASSESS WHAT’S CRITICAL

The next step is to do what’s called a business impact analysis. “We basically ask organizations to think about what’s most critical to do within the first 24 hours after a disaster hits,” Mork continues. “A sales order processing desk might need to be up and running right away. But you could put off setting up accounts payable for a week or two if you had to. Not everything has the same level of criticality.”

Huber takes a similar approach with his company’s clients. “We go into each department of a company or government agency and talk to people about what they are responsible for and how their job fits into the whole operation.”

Figuring out how all the pieces fit together makes it possible to create a business-continuity plan that does what it’s supposed to do. Restore an organization’s most critical functions as quickly as possible following a destructive event. “Our goal,” says Huber, “is to make sure that if you get a call at 3 a.m. saying your building just blew up, you’re going to know what to do. Your business depends on that because in an emergency you’re not going to go look for a book to tell you what to do. It’s got to be automatic.”

STEP 3 — DEVELOP A RECOVERY STRATEGY

Once you’ve mapped out the most critical aspects of your business, it’s time to talk recovery strategies. If disaster strikes, what will you do about your phone system? How about your computers? And, most importantly, where is everyone going to work? “If a company has more that one site this is easier to handle,” Mork says. “You can just move employees to one of your other locations. But for small businesses, this is tough.” While companies are generally more apt to think about restoring computer files and phones, says Mork, figuring out where to put people and set up operations is always much harder to sort out. “In a lot of cases, you just need a few employees to get started again,” he notes. “So maybe you don’t have to find space for everyone.”

Of course all bets are off when it comes to staffing in the wake of a disaster of Katrina-like proportions. “Businesscontinuity plans can’t cover everything,” he continues. “With Katrina, people had much bigger issues to deal with than going to work. Those kinds of catastrophes are really hard to plan for because how can you plan for suddenly having no employees?”

Fortunately, the probability of suffering a devastating hurricane such as Katrina is far lower than the chance that a fire in your building will kick on the internal sprinkler system and destroy your papers and equipment.

And then there is the PR aspect of a disaster to consider. Huber advises his clients to think hard about a media strategy. “If there’s a disaster, you’re going to get calls,” he says. “Companies need to have a call-response team in place to take care of all of the news media and provide information that’s clear and concise. If 100 people call, all 100 of those people should get exactly the same message.”

STEP 4 — GO BEYOND A BACKUP

By now, most companies know the importance of backing up data. But too often a backup is not enough. “Everybody may not do backups that often, so your last backup might not have been recent enough to have captured current data,” says Reinert. “Data recovery fits nicely with disaster-recovery planning because if you don’t have a full backup, we can get your data back from a broken computer or crashed hard drive. We recover files from a lot of computers that have been through floods and fires.”

Kroll Ontrack advises the companies it works with to think about these four things when drafting the data recovery portion of a business-continuity plan. Backup and backup often. Test your backup to be sure it works. Store backups away from your computers, preferably off site. And always include a data recovery vendor on your list of people to call in the event of an emergency. “We’ve found that we can add a lot of value to companies by helping them realize how important it is to include data recovery planning in their disaster plans,” Reinert adds.

WRITE IT UP AND TRAIN, TRAIN, TRAIN

Even the best of plans won’t help in time of crisis if it sits on a shelf and no one knows how to implement it. RSM McGladrey recommends that businesses conduct regular training sessions to ensure everyone in the company knows what his or her responsibilities will be in an emergency.“We tell people it’s good to practice at least once a year,” says Mork. “But we have some clients that are heavily reliant on one department or another do some level of testing quarterly.”

What it comes down to is this, says Mork: When he talks to companies that have well-developed plans, they all say that the big advantage was their ability to implement recovery faster. “It’s not that you couldn’t gather a whole bunch of people together after something happens and ask, ‘OK, what are we going to do now?’ But that delays your recovery by days.”

What could those lost days mean to you?

©2008, Enterprise Minnesota. All rights reserved. Reproduction encouraged after obtaining permission from Enterprise Minnesota. Additional Magazines and reprints available for purchase.

 Want to read more? Sign up for Enterprise Minnesota Magazine or our e-Trends newsletter today!