Midsize Enterprise Summit Business Continuity Questions

Transcription

1 Select Q&A, D. Scott, F. DeSalvo Research Note 6 February 2003 Midsize Enterprise Summit Business Continuity Questions Current events have created a new awareness of the importance of business continuity planning. Questions from participants in Gartner's Midsize Enterprise Summit deal with business process and source code protection. Core Topics Security and Privacy: Security Management Strategies and Processes Small and Midsize Business: SMB IT Project Manager Key Issues What strategies should enterprises employ to provide business process protection in the event of a disaster? How will small and midsize businesses most effectively manage their IT infrastructures during the next three years? More than any previous disaster, the events of Sept. 11 brought worldwide senior executive and board-level awareness to business continuity planning (BCP). It caused many enterprises to perform business impact assessments to identify gaps in coverage. Participants in Gartner's Midsize Enterprise Summit in November 2002 displayed a heightened awareness of business continuity gaps within their enterprises and asked questions about business continuity, recovery of source code, and gaining management commitment for implementation of a comprehensive BCP program. Since Sept. 11, senior management has become serious about investing in crisis management. However, senior management has not shown support for business recovery and business resumption planning initiatives. How do enterprises get management in the business units to take BCP seriously and commit resources? Despite their concerns for business continuity after Sept. 11, only a fraction of midsize and large enterprises have adopted comprehensive business continuity plans, which include the components of crisis management, disaster recovery, business resumption, business recovery and contingency management plans. Rather, enterprises have chosen specific areas of investment they believe have the highest return on investment, which have tended toward investments in disaster recovery (to protect IT) and crisis management (to manage the overall event and maintain confidence in the enterprise). The lackluster state of the economy has also contributed to lower investment than otherwise might be made in BCP. In fact, many enterprises are focusing on lower-cost investments for protection for example, improving processes that increase preparedness, such as in crisis management. Crisis Gartner Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.

2 management describes the enterprise's first response to an event that could change the way its business operations are normally conducted. A well-managed approach will bolster confidence in employees, customers, partners, investors and the general public regarding the ongoing viability of the enterprise. Like crisis management, business recovery and business resumption plans require little to no capital investment to implement. Instead, business process owners must take the time to think through various disaster scenarios (such as building evacuation, regional natural disaster, fire, flood or loss of technology) and develop a course of action regarding recovery of the business process. Although the business impact assessment prioritizes business process recovery times, it does not detail how to recover in that time frame or the work-around plans necessary while recovering. This is the job of the business process owner, in the form of business recovery and resumption plans. Also, although these plans are not expensive to implement, recovery from a business process interruption can be very expensive (with significant manual processing often required), and it would be catastrophic without planning. Gaining Management Support: To obtain additional support and commitment for business recovery and business resumption planning, enterprises should take the following steps: Walk through a crisis scenario, taking it one step further than the crisis management plans. Show senior management how critical business processes could be affected by a disaster. Managing the crisis and recovering the technology are critical to the survival of the enterprise. However, lack of employee, department and business process plans will lead to chaos, seriously undermining any recovery efforts and perhaps even canceling out the positive efforts of the crisis management and disaster recovery planning efforts. The worst time to plan is during a disaster. All employees must know their course of action when disaster strikes. Perform a business impact assessment. This includes assessing the impact of business interruptions over varying time periods on each business process: direct costs (such as lost revenue and productivity) and indirect effects (such as relationships and reputation with customers, suppliers and business partners). Such an assessment can be done directly by each business process owner, or with assistance from IT or other project managers that understand the process and can pull together the results across business units. The project manager would interview line-of-business managers to determine how various disaster scenarios that interrupt specific business processes for varying time periods would affect the enterprise. Findings can then be used to win 6 February

3 support, commitment and funding for comprehensive BCP, including investing in business recovery and resumption plans. Make the senior management team aware of incidents that have occurred within and outside the company: inventory and report all incidents, specifically focusing on facility outages; show videotapes of actual incidents and their aftermath, discussing how a more coordinated, planned response could have been undertaken for the advantage of the enterprise; and talk with other regional enterprises that have experienced disasters. In addition, for publicly traded companies, the CFO, internal audit committees and external auditors can help raise awareness of risks and corporate responsibilities. For non-publicly-traded enterprises with high visibility (such as government, hospitals and nationalized industries), training for handling the press after an incident can also raise awareness of the need for comprehensive BCP. Fewer vendors are allowing software source code to be stored in escrow accounts. Are there any alternatives to addressing software source code access if my vendor is struck by a critical disaster? This question actually poses two entirely different business problems: first, "What happens when the customer has a disaster?" and, second, "What happens when the customer's software provider incurs a disaster?" The Alternative Data Center: When an enterprise declares a disaster and invokes its disaster recovery plan, it recovers its mission-critical applications and systems in an alternative data center. The data center may be owned and managed by the enterprise but located in a different place, or it may be outsourced to an independent organization, such as BCP service providers SunGard or IBM. To make the alternative data center operable, servers can be rebuilt 1) by tape-based recovery (first the operating system, then applications, then data) or 2) through a real-time replica or "hot standby" of the environment. If either method is used, recovery of independent software vendor (ISV) software does not require access to source code. It simply requires access to the runtime version of the software that is in production use. Depending on the ISV and method of recovery (tape based vs. replica based), the right to re-establish the software in another location for this purpose may require additional license fees, up to the full cost of the primary license fees. 6 February

4 Hot Standbys: Increasingly, enterprises are maintaining continuous backup by using a hot standby for their most-critical applications. Hot standbys thus have become an additional source of revenue for some ISVs. Their cost is generally tied to the degree of "warmth" of the continuity method (meaning how much incremental work would be required to use the hot standby as a production machine). If an enterprise pays for the right to have a hot-standby site, its agreement with the ISV should include language that specifically addresses the right to use that site and the circumstances under which it can be used. Also, if the ISV requires a hardware-related authorization code to execute its software, the enterprise must implement administrative procedures that will allow access to the software when it is run on a different computer. Escrow of Source Code: In contingency planning, one component of a business continuity plan, the enterprise identifies critical partners and assesses the potential impact of the interruption or loss of critical services of each partner. Establishing escrow agreements typically falls under contingency planning, but sometimes it is included in an enterprise's disaster recovery planning scenarios. Such agreements afford the enterprise some protection against critical partners experiencing a disaster, bankruptcy or going out of business, and will help the enterprise maintain its ability to continue running and supporting mission-critical packaged software. An escrow agreement provides for the regular, timely placement of the vendor's current source code in an agreed-on location that the enterprise could access, should certain events occur. Approximately 70 percent of escrow agreements are three-party agreements in which an independent agent holds the code and is authorized to release it to an enterprise if any such events occur. The largest worldwide independent escrow agent recently reported 94 releases of escrow in 2002, compared with 12 releases in A variety of factors have caused this increase, including 32 percent because of bankruptcies, 25 percent due to support-related issues, 25 percent for out-of-business conditions and 18 percent for dispute-related issues. Gartner believes that it is necessary for all source code to be escrowed. However, few software vendors offer escrow accounts of their own accord. Such accounts must be specifically negotiated into software license contracts. Although software vendors may imply that they do not support escrow agreements, in reality they must do so to satisfy customer requirements. Any vendor that refuses should lose its preferred vendor status. 6 February

5 Escrow Agreement Specifications: Simply having an escrow agreement is not enough, however. Midsize businesses should specify within the agreement: The specific circumstances under which they would gain access to the code The time frame required before gaining that access The rights that would be available to the enterprise once the source code is in hand Furthermore, any organization that uses escrow agreements should have plans in place as to how the code would be supported and maintained if it were necessary. 6 February