Understanding Disaster Recovery in Business

Disaster recovery is a subset of business continuity.  It refers to the policies, procedures and processes related to preparing for continuation or recovery of technology infrastructure in the event of a human-induced or natural disaster.  Disaster recovery primarily focuses on the technology systems or the IT aspects that support business functions, while business continuity involves planning for keeping all aspects of a business functioning in the midst of disruptive events.

In the mid 1970s, the concept of Disaster Recovery, or in espanol Continuidad de Negocio, was developed.  In those days, most systems were batch-oriented mainframes that could be down for numerous days when a problem occurred.  Computer center managers recognized the dependence of their organizations on their computer systems and saw the significant amount of damage that could occur to the organization during down time.  Backup computer centers soon grew into an industry, with Sun Information Systems in 1978 becoming the first major United States vendor.  By the 1980s and 1990s, the disaster recovery industry grew further with the advent of real-time processing and open systems. 

Increasing government regulations also contributed to the growth of the IT disaster recovery industry as well.  Fundamental propositions and regulations for mandating business continuity and disaster plans for numerous organizations in various sectors of the economy were implemented.   The rapid growth of the Internet from the late 90s into the 2000s, initiated further dependency for companies to have continuous availability of their IT systems.  Many corporations set an objective of maintaining 99% availability of critical systems.

The importance of IT systems being reliable and available to ensure the success and smooth operation of a company is paramount.  As these computer systems have become so critical within today's world, the need to ensure the continued operation and rapid recovery of these systems has greatly increased. 

Many large companies spend approximately 2-4% of their IT budget on disaster recovery planning.  Statistics show that businesses who have suffered a major loss of data may never be the same as only 6% survive long term, 43% never reopen and 51% close within 2 years of their disaster.   Companies spend their budget on disaster recovery planning with the aim of avoiding larger losses in case the company cannot continue to function due to the loss of IT data and infrastructure.  Therefore, preparation for continuation of data systems needs to be well thought out, involving a major investment of money and time in order to ensure minimal losses in the event of a disruptive situation.

Eliminating Threats and Protecting Yourself

In order to reduce or eliminate threats for organizations, various control measures are put into place.  Different specifics can be included in Business Continuity Planning or BCP and Disaster Recovery Planning or DRP.  Disaster Recovery Planning should include planning for resumption of data, communications, applications and other IT infrastructure.  A Business Continuity Plan or BCP also includes planning for other aspects such as facilities, key personnel, reputation protection, crisis communication and other non-IT related aspects.  The BCP should refer to the disaster recovery plan for IT related continuity and recovery aspects.

Planning for Disaster Recovery

Before choosing a disaster recovery strategy, a disaster recovery planner needs to refer to their company's business continuity plan.  This will indicate the key points of the Recovery Point Objective or RPO, and the Recovery Time Objective or RTO for various business processes.  The metrics specified for the business processes are then mapped to the IT infrastructure and systems that support those processes.  The disaster recovery planner can determine the best strategy for each system once the RPO and RTO metrics have been mapped. 

Many business management heads would like to honor a zero data loss and a zero time loss level of protection, but the cost associated with that level of protection would ultimately make those solutions impractical.  As the corporation usually sets the IT budget, the RPO and RTO metrics are required to fit within the available budget.

The most common strategies for data protection include: backups made to tape and sent away to an off-site location regularly.  Replication of data to an off-site location, usually making use of storage area network or SAN technology, this overcomes the need to restore the data as only the systems then need to be synchronized.  Backups made to disk on-site and made directly to off-site disk or automatically copied to off-site disk.  Finally, high availability systems that keep both the system and data replicated off-site and enable continuous access to both. There are numerous situations when an organization may choose hire an outsourced disaster recovery provider to provide a stand-by site and systems instead of using their own remote facilities. 

Organizations must also implement precautionary tactics with an objective of preventing a disaster from occurring.  Some of these precautions include: installing antivirus software and security programs, fire preventions such as alarms and fire extinguishers, local mirrors of systems and/or data and utilizing technology such as RAID for disk protection, and installing surge protectors to lessen the effect of power surges on delicate electronic equipment.  Finally, incorporating uninterruptible power supply or UPS to keep systems running in the event of a power failure, or even having a backup generator on hand are some of the most common features implemented.