PREPARING FOR DISASTER RECOVERY—CLEAR QUESTIONS THAT MUST BE ANSWERED

The recent photo above shows a building on fire in Karachi, Pakistan. Think it’s unlikely to happen to you? Well this was the second time in six months that this building caught on fire.

In a recent project involving disaster recovery, the owner insisted that we clarify the issues confronting his business very clearly. It forced us to look for the best (i.e., clearest) questions. Here they are. The questions were distilled from information that was found at Sungard, Iron Mountain, Forsythe.

November 3 update: I added three more important aspects to consider in your disaster recovery and business continuity planning. Click here.

We came up with five questions.

1. How will disaster impact your key assets? Your key assets are your people, your property, your computing systems, and your data.
2. What are the most likely disasters to strike your business? Prepare a response for each one. You might need different plans for a building fire and an earthquake.
3. Which systems must be restored in sequence? This requires you to prioritize your systems.
4. Identify the possible points of failure in your current systems. Can you plug those possible points of failure in your most critical systems?
5. How much will you budget for disaster recovery? To accurately budget for disaster recovery, quantify your possible losses from the interruption of your most critical systems.

YOUR KEY ASSETS
Let’s return to the four key assets. Questions are posed for each asset. Your answers will get you started.

1. People - How will your employees be notified and evacuated? How will they be able to work after the disaster? If your building burns down today, how will your people be able to work tomorrow to restore your business?
2. Property - What equipment will you need for your people during and after the disaster?
3. Systems - How much downtime can you tolerate? To be prudent, which systems must be duplicated before disaster strikes? If that wasn't done, which systems must be brought back online urgently?
4. Data - Identify your most critical data. How will you protect it before disaster strikes? How will you recover any lost data?

ABOUT OUR SOURCES
This information came from their respective websites:

• SunGard’s robust infrastructure, pressure-tested processes, and expertise keep client people and information connected. Sunguard helps 10,000 customers worldwide achieve uninterrupted access to their mission-critical data and systems
• Iron Mountain helps organizations around the world reduce the costs and risks associated with information protection and storage. Iron Mountain is a trusted partner to more than 120,000 corporate clients throughout North America, Europe, Latin America and the Pacific Rim.
• From the boardroom to the data center, Forsythe helps organizations solve business problems through technology. Forsythe can help you align & operate IT, manage risk, protect & manage data, optimize the data center, enhance IT infrastructure, and source & manage technology.

WHY YOU SHOULD HAVE A FRAMEWORK FOR MANAGING YOUR INFORMATION!

Information is now recognized as an asset. It enters an organization as raw data and until it’s processed, i.e., organized, filtered, and presented in a meaningful way, data has little value. An organization needs a framework to manage this process.

Like any asset information can be useful if handled properly and dangerous if handled carelessly. Consider medical records-the electronic kind although this applies to paper as well. One set of medical record will assist doctors understand a patient's condition. But if the same record falls into the wrong hands, the hospital is liable for damages since it violated government regulations (HIPAA, for example).

Managing information is crucial therefore. Just as you would protect your equipment from the elements, so should you handle information carefully. Information management is a complex function. Data originates from many sources. Data that’s important must be segregated and only valuable data should be collected.

Managing information begins by creating a framework. The framework must deal with four issues and, therefore, has four layers. These four issues are:

1. What is the company's policy towards its data?
2. Who will govern it data?
3. How will its data be processed, and presented?
4. How will its data be stored and protected?

We might say that the framework is concerned with policy, governance, operations, and infrastructure.

POLICY

Senior managers must identify the information the organization needs. It needs to determine using broad strokes how it will store, collect, and organize data so that it becomes useful information that decisions can be based upon. Aside from the obvious sources of data, e.g., customer and supplier transactions, thought must be given to email and other internal documents that contain the communication steps of decision-making and the decisions that were made.

GOVERNANCE

This is concerned with the actual infrastructure that will store the data and convert it into useful information. It is also concerned with developing the life cycle of information within the company. The life cycle starts when raw data is collected to when it becomes information that is used for making decisions to the point when the data is either archived or destroyed. The following acronym summarizes these steps-CARD. It stands for Creation-Access-Retention-Destruction. IT must map the flow of information from origin to the different departments and to the decision makers. The flowchart must include the input of all functional managers whose departments get touched by data.

OPERATIONS

Operations will be driven by the processes that were developed by the preceding layers. This issue squarely deals with issues relating to disaster recovery and business continuity. It also deals with the steps that need to be taken to comply with government regulations. How will the organization protect its data and comply with government regulations? What is the architecture of the information solution that will be able to collect, store, process, and control access to the information?

INFRASTRUCTURE

Infrastructure is primarily about technology and the people that will maintain it. Regardless of infrastructure type, IT must be able to deliver information in the required format to the person who needs it at the moment they need it. Infrastructure is concerned with meeting the demands of the previous layer.

SUMMARY - SUMMARY - SUMMARY

After seeing how some organizations struggle with developing an information structure the wrong way, I decided to write this. Basically, you don’t start with the technology and develop your strategy and policy from the existing technology. That's akin to the tail wagging the dog.

The correct way to develop an information framework is to start from the top. The effort should be led by senior managers. The organization’s IT department only guides the effort. The top layer-policy-should be created with a view to external, financial, and operational factors. From this policy will flow strategies for managing the information life cycle, storage, data protection, and the like.

For the final time, it’s very important for an organization-especially one that conducts its business based heavily on data-must create an information management framework. The framework has four layers: (1) policy, (2) governance, (3) operations, and (4) infrastructure. Start from the top and progressively elaborate, i.e., go into more and more detail, as you work through the layers.