Business Continuity and Disaster Recovery

Transcription

1 Business Continuity and Disaster Recovery All about Business Continuity and DR & How to Assess the Financial Impact of Downtime Planning for a Fall? Check your parachute Page 1

2 Taking a leap without a safety line? Now that s risky business. Page 2

3 PMS 201 Pantone 536 Pantone 7545 Pantone 201 c25 - m99 - y81 - k15 27 Letter from the President As we move through 2013, the business world abounds with opportunities and risks. Now, more than ever, it s critical to take steps to protect your enterprise from disaster, downtime, and data loss. The enclosed Business Continuity and Disaster Recovery Workbook is a valuable tool that will help you assess your organization s state of readiness, including a step-by-step guide for making your business more resilient. For instance, basic data replication is one thing and high availability, which includes application backup is another. The Workbook provides the means to evaluate financial and operational risks, and includes information on how to initiate an availability and recovery plan that s right for your business. My personal commitment to building a Disaster Recovery and Business Continuity practice is evident by the substantial investments Mid-Range has made in technology, people, and resources including our highly secure 120 seat disaster recovery data centre. I hope you ll find the Workbook informative and useful. At Mid-Range, we ve got your back. Best regards, Dan Duffy President Mid-Range vegotyourback ORIGINAL Page 3

4 Bite down on disaster. Give your recovery plan some chops. Page 4

5 PMS 201 Pantone 536 Pantone 7545 Pantone 201 c25 - m99 - y81 - k15 27 ORIGINAL All about Business Continuity and DR Introduction This is the place to start if you are only somewhat familiar with disaster recovery, information availability, and business continuity. This introductory workbook gives you a quick understanding of the building blocks in keeping your business protected, recovering quickly and sustaining a resilient organization. Written in a Q&A style, you will learn the answers to the five most critical DR questions and how to develop a data protection and disaster recovery plan. Page 5

6 Defining Your Business Continuity and DR Needs What is availability? Most organizations define availability somewhere along a continuum between multiple hours of downtime with significant data loss to real-time 24/7 uptime with zero data loss. Your definition depends on your business needs, your data and applications requirements and your organizational structure. The goal, however, should be to prevent the inevitable system downtime from affecting business uptime. What is the difference between disaster recovery, high availability, continuous operations, continuous availability and business continuity? Page 6

7 Disaster Recovery is the ability to handle site failures with minimal disruption to the business. High Availability (HA) is the ability to handle application failures with minimal disruptions to the business. It is focused on continuous operations and recovery of server failures eliminating both planned and unplanned downtime. Continuous Availability (CA) means the continuous availability of critical business functions. It is focused on eliminating planned and unplanned downtime as well as server, site and enterprise protection. Business Continuity is focused not only on eliminating the risks of downtime to your IT assets, it includes the people and processes to handle an unplanned event that affects the entire business or a region in which the business operates. Business continuity includes IT functions as well as the pre-arranged processes for alerting employees and customers to a disaster, the preparation and testing of disaster preparedness plans and the auditing of those processes to ensure effectiveness. Page 7

8 What is information availability? Page 8 Information availability encompasses an end-to-end view of a computing environment including applications, data, servers, operating systems, processes and infrastructure to ensure consistent, predictable access to any data or any applications wherever, whenever and however users require them. Information availability does not mean keeping systems available 100 percent of the time. For example, a business that does not need its systems between midnight and 6 a.m. will not be concerned about downtime during those hours. However, achieving the level of optimum information availability that s right for your business means that data and applications identified as vital will be available during pre-specified critical hours which may mean 24/7. 24/5. 20/7. 12/6 or any combination of hours and workdays that fits your business objectives. What is the difference between reliability and availability? It is important to note that reliability and availability are not synonymous. Reliability refers to the mean time between failure (MTBF) of a hardware component. Availability means that data and applications are accessible by users when needed, without regard to what might cause their inaccessibility. Reliability is, therefore, a component of availability, but, since most hardware is now very reliable, it may be less of a concern than other issues. Addressing availability issues implies also addressing reliability issues, but only as a subset of the bigger picture. Significantly improving hardware and software reliability will only slightly decrease the total number of hours of downtime over the course of a year. Compared to other factors such as hardware, software and database maintenance, unreliable systems are responsible for only a small percentage of downtime. Significantly improving availability is possible only by addressing all causes of unavailability, including, but not exclusively, reliability. What is information availability planning? Information availability planning takes a systematic, holistic view of the entire enterprise information infrastructure. The plan is designed to evaluate availability vulnerabilities,

9 assess the magnitude and probability of the threats, and identify and implement solutions that provide a favorable return on investment. Why systematic? Because in any business today especially for SMBs it is no longer acceptable or good enough for only one application to be continuously available or to be protected by a comprehensive disaster recovery plan. You must consider the data and the networks that integrate with this application and that the application depends on. Why holistic? Since the failure of any one element may make the whole environment unavailable. Therefore, focusing on a single component, such as just the disk drives, power supply or processors, will only marginally improve availability. For example, applications will not work without data and objects and vice versa. Your planning process should look at all data and all applications across the enterprise to determine your system- wide availability requirements. In this context, data does not mean just business data. It includes all of the security, middleware staging areas, data queues and other system data required to keep applications running according to specifications. Should I worry more about data or applications? Some managers worry most about losing data. Others, still wanting to protect data, lose more sleep over application downtime. Your specific requirements will be determined by your business strategies and objectives. For example, an internet-based retailer will probably be unwilling to lose any data as that can mean lost sales and significant customer hostility. While a vast majority of organizations depend on tape backups to protect their data, these backups cannot recover data that was lost between saves (orphan data). A logistics company or a manufacturer running three shifts in a highly computerized shop floor, will be more concerned about losing access to applications. What is downtime? Downtime is defined as any interruption in your IT processes when users cannot use or access data, applications or networks. There are two types of downtime. Unplanned downtime Unpredictable events that cause an outage; usually related to power, natural disaster or human error. Unplanned downtime typically represents less than 5 percent of all downtime. Page 9

10 Page 10 Planned downtime Planned downtime occurs when you purposely bring systems, databases, applications or networks down for maintenance or backup activities, including daily/weekly saves, batch jobs, database reorganizations, application and system upgrades, system maintenance, performance tuning and other activities. The majority of downtime that a typical user will experience is planned downtime. With infrastructure and server reliability improvements occurring on a regular basis, the likelihood that a server will fail is decreasing over time. What are the most common downtime challenges to information availability? Application and Database Backups One of the challenges in today s IT community is to make application and server backups on a regular basis. Without backups, the business is exposed due to the inability to recover the business. Also, IT departments are faced with the problem of making multiple types of backups. A large string of backups can create problems when it comes time to recover from the backup tapes. Some exposures are present at the time of recovery. For example, if one set of tapes is bad, the recovery can only go as far as the last good set of tapes. The main purpose for making backups is to be able to recover. If the backups are complex and unreliable, it defeats the purpose of the making the backups at all. Managing these backups usually requires downtime unless save-while- active technology is used. While this helps ease the requirement for the backup process, the objects on the tapes are not necessarily in sync. For example, a save of a complete library may not yield a complete backup because object locks could not be obtained. Sources of Unplanned Downtime: Disasters Natural Disasters Wildfires Floods & Flash Floods Hurricanes Tornadoes Thunderstorms & Lightening Man-Made Disasters Home & Building Fires Hazardous Materials Accidents Terrorism Aviation Accidents Ship/Maritime Accidents

11 Snow, Ice & Winter Storms Heatwave & Drought Landslides & Mudflows Tsunamis & Other Tidal Action Volcanoes Earthquakes Train/Railroad Accidents Riots/Civil Unrest Bridge Collapses Dam Breaks Nuclear/Radiological Accidents Also, backups tend to be system focused. If a server fails, the entire server and its applications must be recovered simultaneously regardless of whether the application is critical to the business or not. Application and Server Maintenance Maintaining server and application PTF or release levels is important to maintaining a well-tuned IT environment. Many times, applying application and server modifications is put on the back burner until time can be scheduled to perform the maintenance. Also, the maintenance often occurs on weekend or holidays, which limits access to vendor support and entails overtime expenses. Being able to stay current on releases is important to getting the best support from OS and application vendors. In the same vein, it is also vital that a business perform routine server and application maintenance to maintain the performance of a server. Database reorganizations, IPL s and other routines must be executed on a regular basis. While the latest OS releases help reduce the need for frequent maintenance, it can t be avoided altogether. Unfortunately, performing application and server maintenance requires downtime, which is painful to the business. Why is planned downtime a bigger challenge to an IT department? Since it happens so frequently. While unplanned events tend to attract the most attention, planned downtime actually poses a bigger challenge to business availability. Routine daily/weekly maintenance to databases, applications or systems, lead to interrupted services. Studies show that system upgrades, performance tuning and batch jobs create more than percent of downtime (95+ percent on IBM Power Systems servers). Page 11

12 How do I know I am at risk from unplanned interruptions/ downtime? Why should I be concerned? Although companies must be concerned about natural disasters, the inherent daily threat posed by application problems and human error should be your primary concern in developing a disaster recovery strategy that will enable your business to continue doing business even in the event of application failure. For example, a host of IT, business and governmental concerns compounds the risks from application downtime. Do you face any of these challenges? The need to retain, protect and audit , financial and other records under regulatory compliance mandates such as Sarbanes-Oxley, the USA Patriot Act, and others across the globe. The acceleration of security risks from both inside and outside the business including viruses, worms, hacker attacks and industrial espionage. Distributed applications that are accessed, maintained and updated by different classes of users and business partners. Multiple platform IT environments in which applications operate interdependently to accomplish business critical business tasks. Fewer IT personnel and labour hours available to maintain and troubleshoot increasingly complex and data intensive IT environments. How do I know if downtime may be a threat to my IT environment and business? Many organizations may believe that they remain unaffected by downtime issues. After all, few users complain; customers seem happy. Some important signals, however, may indicate that your current situation or availability solution may need re-evaluation. Shrinking Backup Windows ebusiness and supply-chain processes put the squeeze on backup windows. IT analysts, such as Gartner, report a 66 percent per year decline in available timeframes needed for quality backups. And what about the time it takes to Page 12

13 restore this data? Even if the unplanned outage is relatively brief say 24 hours your recovery strategy must consider the additional time (downtime) that it would take to recover so much data. Expanded Internet Dependence As business exploits the internet to improve customer satisfaction and reduce costs, dependence on internet-enabled access grows exponentially. When is integrated into business functions to improve customer communications, dependence becomes even greater. Globalized Computing Access to critical data from anywhere in the world improves collaboration and enables faster, more informed decisions, while mobile workforces, remote employees and consolidation of staff to a single application/server improve workflow and reduce costs. But such dependence requires continuous access to information and applications. Distributed Applications New applications are now running across multiple servers simultaneously, enabling them to capitalize on each server s varying strengths; however, should one server fail, the entire critical application may go down. Server Consolidation Ever-popular server, storage and data center consolidation projects drive down IT and application costs but create higher risks that unplanned or planned downtime will adversely impact the business. Summary You should now have an understanding of the basic ideas and issues involved in disaster recovery, business continuity and information availability. The next step is to determine the financial impact of downtime on your organization. For more information or assistance with this process please contact Mid-Range or call Page 13

14 Page 14 There s a fine line between a rock and a hard place.

15 PMS 201 Pantone 536 Pantone 7545 Pantone 201 c25 - m99 - y81 - k15 27 ORIGINAL How to Assess the Financial Impact of Downtime Introduction Written in a Q&A style, this Workbook helps you understand and determine the costs of downtime to your organization. This process can often seem complex and this workbook will help you break through this complexity. It provides some basic, easy to implement ways to help you calculate the cost of downtime to your organization and using that information to determine how much of a threat or risk downtime poses. Page 15

16 Assessing the Financial Impact of Downtime What is involved in calculating the cost of downtime? The answer may not be as obvious as you think. Unexpected IT outages can unleash a procession of consequences that are both direct and indirect, tangible and intangible, short term and long term, immediate and far reaching. These costs include: Tangible/Direct Costs Lost transaction revenue Lost wages Lost inventory Remedial labour costs Marketing costs Bank fees Legal penalties Intangible/Indirect Costs Lost business opportunities Loss of employees and/or employee morale Decrease in stock value Loss of customer/partner goodwill Brand damage Driving business to competitor Bad publicity/press The monetary value that can be assigned to each hour of downtime varies widely depending upon the nature of your business, the size of your company and the criticality of your IT systems to primary revenue generating processes. For instance, a global financial services firm may lose millions of dollars for every hour of downtime, whereas a small manufacturer that uses IT as an administrative tool would lose only a margin of productivity. Are there industry averages that I can use to benchmark my downtime costs? Yes. On average, businesses lose between $84,000 and $108,000 (US) for every hour of IT system downtime according to estimates from studies and surveys performed by IT industry analyst firms. In addition financial services, telecommunications, manufacturing and energy are high on the list of industries with a high rate of revenue loss during IT downtime. Page 16

17 Typical Hourly Cost of Downtime by Industry Brokerage Service $ 6.48 million Manufacturing $ 1.6 million Energy $ 2.8 million Retail $ 1.1 million Telecom $ 2.0 million Health Care $ 636,000 Media $ 90,000 Sources: Network Computing, the Meta Group and Contingency Planning Research. All figures U.S. dollars. What is the true cost of downtime? While idled labour and lower productivity costs may seem to be the most substantial cost of downtime, any true cost of downtime estimate should include the value of the opportunities that were lost when the applications were not available. For example, consider a company that averages a gross profit margin of $100,000 per hour from web and telemarketing sales. If its order-processing systems crash for an hour, making it impossible to take orders, what is the cost of the outage? The easy, but erroneous, answer would be $100,000. Some customers will be persistent and call or click back at another time. Sales to them are not lost; cash flow is simply delayed. However, some prospects and customers will give up and go to a competitor. Still, the value of the purchases that these customers would have made during the outage likely underestimates the loss to the company since a satisfied customer can become a loyal customer. Dissatisfied customers, or prospects that never become customers, do not. Consider a prospect that would have made an immediate $100 purchase and then repeated that purchase once a year. Using a standard discounted cash-flow rate of 15 percent, the present value of those purchases over a 20-year period is $ In this example, the company s loss is more than seven times the value of the first lost sale. (A lower discount rate produces an even higher value.) How do I determine the true cost of downtime for my organization? While it is difficult to precisely calculate a definitive cost of downtime, the following steps will help you develop a very close estimate. Page 17

18 1. Understand Your Current Reliability One step in projecting the number of hours that a system will be down each year is to estimate the system s reliability. This does not equate to the reliability numbers provided by hardware vendors because a system depends on a combination of hardware, software and networking components. To use a network-based system, at a minimum, all of the following must work: Power supplies. Central processing units (in all relevant servers and client computers). Operating systems running all participating systems. Server disk drives. Database management system on the servers. Application software. Network switching and routing devices. Network connections. Page 18

19 For example, 99 percent CPU reliability does not necessarily mean that the system will experience 99 percent uptime. If the system depends on 10 components, each of which is 99 percent reliable, reliability for the whole system is , or about percent, according to statistical probability. Therefore, this system is expected to be unavailable about 9.56 percent of the time, which, in a 24-hour-a-day, 365-day-a-year environment, translates to almost 838 hours (35 days) of downtime each year. 2. Determine the Amount of Planned Downtime Although unplanned downtime may be significant, often more than 90 percent of downtime is planned. Estimates of yearly planned downtime are usually more accurate than estimates of the unplanned variety as maintenance activities typically either follow rigid schedules or their frequencies are, on an annual basis, reasonably predictable. The first step in deriving an estimate is to perform a rigorous audit of all normal maintenance activities, such as database backups and reorganizations. For each such activity, multiply the historical average downtime per occurrence, adjusted for any growth trends, by the number of times the activity is performed per year. The timing of other planned activities, such as hardware and software updates, is less consistent, but historical averages provide a sufficient guide as to frequency and duration of the required downtime. These averages can be adjusted to incorporate any knowledge of upcoming upgrade requirements. 3. Calculate Hourly Costs As it is impossible to predict the precise loss from an outage, it is important to derive reasonable estimates. Only then is it possible to evaluate the economically appropriate level of investment in data recovery or information availability software solutions. Losses in the areas of labour, revenue and service all contribute to the total cost of downtime. A good starting point for evaluating these factors is to collect statistics on both the duration and associated costs of past downtime as recorded by the accounting department. These include: Labour employees generally continue to receive full pay even if an out-of-service system cripples their productivity. A historical analysis usually provides a sufficient prediction of the cost of this lost time. The first step is to examine which, how many and to what extent employees were Page 19

20 Page 20 Don t get stung by the impact of downtime

21 affected by past outages. Some employees can continue to do some productive work during a system outage, while others may be totally idled. Estimate each group of employees decline in productivity as a percentage of normal output. Next, estimate the value of an hour of lost productivity. A good surrogate measure is the total average salary, benefits and overhead costs for the affected group. The human resources department can usually provide this number. Since businesses try to earn profits, the value contributed by employees is usually greater than the cost of employing them. Therefore, using salaries, benefits and overhead costs as an estimate of lost productivity yields a very conservative cost/benefit analysis. The following equation can be used to calculate the average labour cost of downtime. Since labour costs and the impact of outages vary, to achieve a high degree of accuracy, this equation must be repeated for each department and employee classification. However, a shortcut that groups similar employees into a single class is usually sufficient. LABOUR COST = P x E x R x H Where: P = number of people affected E = average percentage they are affected R = average employee cost per hour H = number of hours of outage Revenue The simplest way to project the potential annual revenue loss from downtime is with the equation: LOST REVENUE = (GR / TH) x I x H Where: GR = gross yearly revenue TH = total yearly business hours I = percentage impact H = number of hours of downtime The first two elements of this equation provide an estimate of the revenue generated in an hour. The percentage impact is an adjustment that scales the hourly revenue number based on a best estimate of both the company s ability to recover business lost during an outage and the lifetime value of customers who are permanently lost to the competition. Page 21

22 Loyalty Factor The sales-per-hour number does not include the value of customer loyalty. To more accurately assess total lost sales, the impact percentage must be increased to reflect the lifetime value of customers who permanently defect to a competitor. If a large percentage of customers typically become very loyal after a satisfactory buying experience, the impact factor may significantly exceed 100 percent, possibly by a high multiple. Since determining lifetime value requires a long history of data and assumes, often inaccurately, that the future will reflect the past, an educated guess must suffice. Intangible Costs This category covers some of the more intangible downtime costs and other miscellaneous costs that don t fall into any of the categories above. Questions that must be considered include, among others: Will there be any late delivery surcharges? Will overtime pay be required to make up for lost productivity? Will any critical financial filing deadlines be missed? If so, will penalties be assessed? Will frequent and/or long system outages tarnish the company s image in the minds of customers and investors, particularly if the media report on the problems? Will there be an adverse effect on the company s stock price? Will a loss of customer goodwill erode the company s ongoing revenue stream? Will it be necessary to plan and execute campaigns to explain and apologize for the lack of service? Service costs are rarely zero. Downtime usually leads to a cascade of related costs. The accounting department can help to identify all such service costs incurred during or after a previous outage. The total of these costs must be divided by the total number of hours the systems were down to determine the cost per hour. Page 22

23 Time-Dependent Costs The hourly cost of downtime varies depending on the time of day. In most companies, few employees work in the middle of the night, so a system shutdown then would have only minimal impact on corporate productivity. Likewise, even companies selling round-the-clock experience busy and slow periods. For instance, if a North America-focused retailer s web site is not available (for whatever reason) at 4 a.m., the impact would likely be significantly less than if it is down at 2 p.m. Similarly, downtime costs usually vary depending on whether an outage occurs on a weekday or on a weekend or holiday. Since unplanned downtime can occur at any time, one approach to calculating its hourly cost is to use an average of all hourly costs across a whole week. However, since some problems result from system overloading, which occurs at the most costly times, a more conservative approach is to weight the average accordingly. Unlike unplanned downtime, planned downtime can be scheduled for the least costly times. However, if scheduling maintenance at night or on weekends necessitates the payment of overtime and/or shift premiums, these costs must be factored into the calculation. Total Costs Summing up all of the above costs gives a reasonable forecast of the expected loss from an hour of downtime for a particular system. (Costs will vary depending on the nature of the application, so this calculation must be performed for each system.) To calculate the expected annual cost, multiply this number by the number of expected annual hours of downtime. When considering all factors, the potential loss from downtime shocks most people the first time they calculate it. To benchmark your cost of downtime against averages for your industry, see the Typical Hourly Downtime Costs by Industry chart in question 2. Information-Sharing Opportunity Costs The above discussion considers only the cost of downtime for systems as they exist now. It does not estimate the value that could be derived by making data that is currently inaccessible due to isolated and/or incompatible systems available to those who could benefit from it. Nor does it calculate the costs that could be eliminated by automating or eliminating the manual transfer or re-entry of data that must be available in two or more incompatible systems. Some of these costs are relatively easy to calculate. Page 23

24 For example, an operator may manually extract data nightly from one system into a flat file and then load it into another. By automating such a transfer, the cost of that operator s time could be eliminated. Other costs, particularly the value lost by not having ready access to enterprise data, are more difficult to estimate. For instance, consider a company that cannot give customers online access to billing information because that data currently resides on a platform that is incompatible with the systems that customers can access. It is impossible to determine conclusively how highly customers would value online access and, more importantly, how that would affect their purchase decisions and long-term loyalty. Yet, this value must be estimated in order to evaluate the potential return on a data recovery/information availability software solution. Does downtime affect my compliance readiness? Yes. Many current regulations require companies to support more stringent information availability standards. Several new laws and regulations, directed at specific industries or a broad cross-section of companies, mandate the protection of business data and system availability. Businesses may incur government penalties for failing to comply with these data or business availability requirements. Any downtime calculation should include an estimate of the financial penalties, legal liabilities, etc., of failure to provide the required data or responsiveness within the specified time period. Some of these compliance obligations include: PIPEDA - An Act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions and by amending the Canada Evidence Act, the Statutory Instruments Act and the Statute Revision Act. New Basel Capital Accord (Basel II) requires financial institution capital reserves to include operational and credit risks and to include IT security risk as a principal operational risk. Page 24

25 Sarbanes-Oxley Act stipulates that CEOs and CFOs attest to the truthfulness of financial reports and to the effectiveness of internal financial controls. Section 404 of this regulation requires that an audit trail be available for any financial data that are changed. Sarbanes- Oxley also requires a mandatory timeframe for reporting financial information. Gramm-Leach-Bliley Financial Services Modernization Act of 1999 limits access to non-public information to those with a need to know and requires safeguarding of customer financial information. Health Insurance Portability and Accountability Act (HIPAA) ensures that only properly authorized individuals have access to confidential patient health data and provides long- term guidelines to secure confidential information. It establishes a timeframe for providing requested information. What is a business impact analysis? And why do I need one? The goal of a business impact analysis encompasses several areas, but ultimately helps you determine the cost associated with downtime. It will identify the critical business functions based upon data or application integrity and the sensitivity of each to downtime. You will want to determine the maximum outage time that a specific business function can sustain before the business is impacted. The major benefit of a business impact analysis will be to identify the costs associated with downtime as well as the financial impact to the business. It will address both long and short-term outages and will help you determine what the recovery point objective should be for each business function (see what is a recovery point? in Workbook 3: Determining Business Resiliency). A business impact analysis will determine the most critical data and resources to the organization and the different methods and alternatives required to sustain availability and continuity. Finally the business impact analysis will help define the various solutions or tactics that are required to offset the costs incurred during a business function outage. Page 25

26 9 Steps to Business Impact Assessment 1. Identify critical business functions based on data/application integrity and time sensitivity to downtime. 2. Determine the maximum outage that a specific business function can sustain before it impacts the business. 3. Determine the costs associated with the various disruption scenarios. 4. Identify the financial (revenue), productivity (expenses) and personal impact (good-will) of a business function disruption. 5. Assess both long-term (permanent) and short-term outages or disruptions. 6. Determine the recovery priority of each business function. 7. Identify the most critical or vital data and the resources required to resume a business function. 8. Define alternatives to sustain continuity. 9. Define the various solutions/tactics that can be used to offset the costs incurred during a business function outage. What should I include in a downtime threat analysis? In order to understand the potential impact downtime can have for your organization, you should identify the threats from both internal and external sources. These could include natural events as well as man-made events. Spend time thinking about what could actually happen in your region of the world and plan accordingly. There could be accidental as well as planned events that could cause or contribute to downtime. Some events may be within your control, while others are not. Some events, like hurricanes, will give you ample warning; some events may happen quickly and give you very little reaction time. Once you determine what types of events could likely affect you, create methods of information gathering. Perhaps s or alerts from local weather stations should be added to your plan so that you are aware of weather events. With some types of events, Page 26

27 you will want to be able to determine with certainty the likelihood of the event as well as the potential severity, in order to properly react. Once you have the process in place for determining and monitoring for various events, you will need to put procedures in place to ensure that this is a sustained effort. For example, if you are receiving s to alert you of weather status, then you need to take steps to delete old alerts, keep the recipient information current, and update the evaluation processes as time goes on. Also, be sure to identify the key security and legislative issues that may impact your response. For example, if you must move locations when a disaster occurs, be sure to have the proper security in place for users or for devices attaching to the new server. The last step will be to establish a cost benefit analysis to be associated with the identified loss potential. Cost Benefit Analysis Process 1. Identify threats from both internal and external sources. These should include, but not be limited to, the following: Natural, man-made, technological or political disasters. Accidental versus intentional. Internal versus external. Controllable risks versus those beyond the organization s control. Events with prior warnings versus those with no prior warnings. 2. Determine the probability of each event. Create methods of information gathering on each event. Identify information sources. Assess and assign a credibility factor to each information source. Develop a suitable method to evaluate probability versus severity. Page 27

28 3. Identify the relevant key security, legislative or compliance issues. Establish a cost to be associated with each compliance issue. 4. Establish a way to support your evaluation process on an ongoing basis. How do I present my findings to management? Document the costs of downtime including the effects on the company s brand image. Base the recommended solution on the cost of planned and unplanned outages versus the cost of the solution. Show how the solution offsets the costs of downtime especially planned downtime. Show how the additional benefits can increase the ROI from the solution. Present various options and costs against several typical scenarios. Summary You should now have an understanding of the basic steps involved in determining the financial impact of downtime on your organization. For more information or assistance with this process please contact Mid-Range or call Vision Solutions, Inc. is the world s leading provider of information availability software and services for Windows, Linux, IBM Power Systems and Cloud Computing markets. Vision s trusted Double-Take, MIMIX and itera high availability and disaster recovery brands support business continuity, satisfy compliance requirements and increase productivity. Affordable and easy-to-use, Vision products are backed by certified worldwide 24x7 customer support centers and a global partner network that includes IBM, HP, Microsoft, VMware and Dell. For more information visit visionsolutions.com, workbook content created and supplied by Vision Solutions. Page 28

29 High Availability with IBM s Power HA High availability, business continuity, disaster recovery. Power Systems is committed to investing in and bringing to market solutions designed to keep your IT environments resilient. IBM engineers work continuously to optimize IBM Power Systems hardware and operating systems to keep pace with the increasing demand for 24x365 availability. For more information visit: workbook sponsored in part by IBM Partner Program. Page 29

30 Page 30 Don t risk going down without back up.

31 About MID-RANGE Mid-Range = Reliable, customer-focused Disaster Recovery, High Availability, ERP and IT solutions. Founded in 1988, Mid-Range is a leading provider of IBM hardware and software, Oracle JD Edwards software and services, Disaster Recovery and High Availability Solutions and Managed Services and Hosting Solutions to businesses across North America. Our clients represent a cross-section of industries, from small and emerging organizations to large enterprises. At Mid-Range, we pride ourselves on providing the best over-all value to our customers through proactively sharing our knowledge and expertise. We offer more than just cutting edge products and award winning service; we provide complete solutions that are designed to solve your unique business challenges. For more information visit or call Easy. Affordable. Innovative. Vision Solutions. Vision Solutions, Inc. is the world s leading provider of information availability software and services for Windows, Linux, IBM Power Systems and Cloud Computing markets. Vision s trusted Double-Take, MIMIX and itera high availability and disaster recovery brands support business continuity, satisfy compliance requirements and increase productivity. Affordable and easy-to-use, Vision products are backed by certified worldwide 24x7 customer support centers and a global partner network that includes IBM, HP, Microsoft, VMware and Dell. For more information visit visionsolutions.com, workbook content created and supplied by Vision Solutions. High Availability with IBM s Power HA High availability, business continuity, disaster recovery. Power Systems is committed to investing in and bringing to market solutions designed to keep your IT environments resilient. IBM engineers work continuously to optimize IBM Power Systems hardware and operating systems to keep pace with the increasing demand for 24x365 availability. For more information visit workbook sponsored in part by IBM Partner Program. Page 31

32 85 Idema Road, Markham, ON L3R 1A9 Tel: Fax: Website: Page 32