FOREWORD. Richard L. Arnold, CBCP Publisher, Editor-in-Chief. Disaster Recovery Journal (DRJ)

Transcription

1 FOREWORD Richard L. Arnold, CBCP Publisher, Editor-in-Chief Disaster Recovery Journal (DRJ) Disaster Recovery Planning: The technological aspect of business continuity planning. The advance planning and preparations that are necessary to minimize loss and ensure continuity of the critical business functions of an organization in the event of disaster. Disaster Contingency Planning: The method of assessing the potential for disasters. This includes, but is not limited to, risk analysis and mitigation. Human Resource Contingency Planning: This segment entails planning for the human side of disaster recovery. It is vital to consider employees when making your plans. Evacuation routes, personnel planning, and staffing issues fall under this category. These three segments of contingency planning are but some of the many you will find discussed in this book. I have written the definitions here to detail the intricate differences between the many sectors of contingency planning that have emerged over the past decade. I do this not only for the readers, but also for myself. The business continuity industry is constantly growing, changing, and evolving, and even an experienced contingency planner like myself sometimes has trouble discerning and defining the many areas. I began working in the disaster recovery field in the early 1980s. At that time, the role of contingency planner was mainly considered a part-time position focused on two areas: data backup and disaster recovery. By the mid 1980s, I recognized that the industry was beginning to expand rapidly and knew many contingency planners would be caught unprepared and unaware of how to handle the increasing number of risks. I began publishing Disaster Recovery Journal in 1987 in order to educate and disseminate information to those in the field who, at that time, had very few resources for current information. Shortly thereafter, my company began hosting annual conferences so contingency planners would have a common meeting place for education, networking, and problem solving. I have watched as my own endeavors have grown and I know that it is a direct reflection of the unbridled growth in the contingency planning industry. Over the past 10 years, I have seen more emphasis on business contingency planning not just disaster planning or technical planning. The real goal is sustaining business processes and not just looking at the recovery of technology. Integrated planning of both business and the technology that supports the business is the goal.

2 Today, to protect a business, it is critical to ensure ongoing enterprise operations. The smallest detail to the largest task must be comprehensively attended to and even then, no business is 100 percent safe. A tornado, a terrorist attack, or a T-1 failure could be lurking right around the corner. I am sometimes overwhelmed by all that business continuity planning entails, and I do not even work in the trenches of BCP anymore. I have been here on the sidelines monitoring, reporting to, and educating those in the industry. Many other contingency planners who are out in the field on a day-to-day basis have often been as equally overwhelmed. It can be a daunting task to pull together all the plans, tests, and strategies needed to protect a business from every potential threat. Over the years I have met, consulted, questioned, and clasped hands with thousands of contingency planners from all across the world. Some were at the top of their game; others were struggling with new decisions, new budget cuts, and new technology. But all shared a common goal to completely protect their company from any business interruption. That goal is a daunting task. But it is far from impossible. A changing industry such as business continuity requires motivation and dedication. Lessons learned have been the foundation of our industry and have launched many a new process or plan. I will share with you some of the top concerns of today s planning professionals and hope that the issues discussed here, and in this book, will lead to solutions for you and your organization. Critical Issues in Business Continuity Planning Business continuity planners of the 21 st century face a variety of critical issues that must be tackled. At the same time, they are facing obstacles not known a decade ago. Some of the greatest challenges include the following: The recovery time objective (RTO) continues to grow shorter for most organizations. The RTO is the window of time that can elapse before the lack of a business function severely impacts the business entity. In many cases, the window has either closed or has almost closed, and downtime is not acceptable. Forty years ago organizations measured their acceptable downtime in terms of days or weeks. This was acceptable to manufacturers who maintained inventories that lasted several weeks and to businesses that ran on paper-based systems. However, as the use of technology and automation has increased over the years, the RTO has been reduced to hours, minutes, or seconds. As the RTO has shortened, organizations have had to find a means of restoring their electronic data in a timely manner. To ease this problem, they have turned to the development of systems such as: Electronic vaulting and journaling. Database mirroring and shadowing. Hot standby systems. Load balancing solutions.

3 The tremendous growth of databases and online applications has increased the pressure on disaster recovery plans to increase the speed of recovery while the amount of data to be restored continues to increase. One answer to this problem is the use of active archiving, which, according to Jim Lee s article in the spring 2003 Disaster Recovery Journal, allows companies to remove rarely accessed data from production databases and manage archived data efficiently, while providing easy access to the archived data on demand. Other solutions are also available for managing the excess data. The key is researching what is available and choosing the application or service that meets your company s needs. The Decrease in Staffing and Budgets Though the situation has improved in some larger organizations, there are still many who struggle with lack of funding and staffing. Even with the increased awareness that has occurred and the improved management support, many organizations still have limited resources to devote to contingency planning. A survey taken on DRJ s Web site in 2001 reflected these statistics. The question was, What is the biggest challenge in your planning efforts? Responses were: Funding 38%; Staff Shortage 33%; Complexity 27%; and Nothing 2%. The decision of many organizations in the last 10 to 15 years to centralize business operations as the result of mergers, downsizing, or cost-saving strategies has created additional challenges for the business continuity plan. When making this business decision, an organization must ensure that it has not jeopardized its ability to successfully recover from a disaster at the new central location. Increase in Risks, Vulnerabilities, and Threats Continuity planners of today face a tremendous amount of potential risks. Terrorism is certainly the most dominant threat to arise in the past few years, but there are many more. In today s environment, risks can include technology failures, Internet hackers, viruses, software glitches, media relations, natural disasters, and a variety of human resource concerns. Terrorism Adds New Dimension to BCP As I noted earlier, terrorism is the most dominant threat to emerge over the past few years. None of us will ever forget the images we saw September 11, 2001, as terrorists attacked the World Trade Centers and the Pentagon. Along with the devastating loss of life, there were an incredible amount of businesses that suffered as a result of those terrorist acts. More than two years later, many companies have not fully recovered. Some have folded; others are struggling to return to a stable point. It has become vital for companies to protect themselves against this type of threat. In today s political environment, plans need to consider: The loss or unavailability of many key personnel during the recovery effort.

4 The need to provide additional security safeguards to protect the safety of employees and customers from acts of terrorism. The possible restriction to travel services such as a shutdown of the airlines during a time of national emergency. Many business continuity plans are designed for the use of an alternate facility that could be hundreds or thousands of miles away and impossible to reach within the RTO if the airlines are not operating. The possibility that an organization s facility might be off limits if it is located in close proximity to a bombed area or other disaster. It could be part of the crime scene. I recently spoke to Jay Bender, former executive director for Disaster Recovery Institute International. Mr. Bender and I have worked together for many years, first at DRJ and later at DRI, an industry certification program. He, like myself, has watched this industry expand rapidly in the last decade. He noted a new dimension in business continuity planning since the World Trade Center bombing. While the risk to the health and safety of an organization s personnel, and to the loss of an entire facility, has always existed, very few, if any, organizations were willing to address this issue prior to 9/11. According to a poll on DRJ s Web site, the increased awareness from 9/11 is continuing. The poll taken in 2002 asked if disaster recovery/business continuity was still getting increased exposure from 9/11 in your organization. Of the 3,042 responses, 71 percent of respondents said Yes; 29 percent voted No. The terrorist attacks of 2001 are only one in a long line of catalysts that have raised awareness of the continuity planning industry. Other events that stand out are the 1995 Oklahoma City bombing, the 1993 World Trade Center bombing, Hurricane Andrew, the Oklahoma City tornadoes, and Y2K. Each of these in its own way enlightened many CEOs and top managers that continuity planning was a necessary business tool. It could no longer be considered a part-time profession or an optional department. A plan should not be written and placed on a shelf. Planners must be vigilant on assessing risks and putting plans into place to mitigate those risks. Training and education for employees is crucial. Business Continuity Industry Continues to Evolve This increased awareness in business continuity is just one of the positive changes that has occurred throughout the business continuity industry in the last decade. There is an increased awareness and commitment on the part of top management to the need for a viable business continuity plan, said Bender. The professionals in the industry have worked to promote the need for business continuity planning, and events such as Y2K and 9/11 have provided a point of focus.

5 Other positive changes have included: 1. Increased professionalism through certification programs and by organizations expanding their business continuity planning staffs from a part-time project to a full-time, multipleperson commitment. As I said earlier, staffing and budgeting are still a concern, but it is refreshing to see an improvement in funding and awareness. Management has grown much more aware of the threats and vulnerabilities, and now actively fund resources to promote business continuity in their industry. 2. Increased cooperation between the public and private sectors for emergency management and business continuity. I have recently been involved in several projects that reflect the cross-coordination between the different sectors of business continuity planning. One was the development of an organization that fosters that relationship and is working to better define the terminology. Another is a credential verification program that will allow approved employees early access to a facility after a crisis or disaster has been declared. Programs such as these are cropping up across the nation, and are a very important asset in improving the business continuity industry. Summary On the whole, I have seen a great improvement in the business continuity industry over the past decade. While we are still not without our problems, there has been great progress made in bringing this industry into the 21 st century. Though it is easy to credit the many disasters that have occurred recently with raising awareness, I also must credit the individuals who make up this complicated and vast industry. The thousands of contingency planners I have met during my tenure as magazine publisher and conference host has been instrumental in furthering the awareness and professionalism in this industry. They have always been very enthusiastic and very interested in educating themselves and those around them. I m sure that business contingency planners from all experience levels and all segments will find this book informative and educational. It should be a great contribution to the resources available in this complicated and ever-growing industry.