Business Continuity And

Disaster Recovery
Gabriel Castro and Tiffany Bennett
6/6/2014
IT 486-Critical Issues in Information Technology, Analytical Paper
Prepared for Terrance Linkletter, Central Washington University




Table of Contents


Abstract Page 3
Introduction Page 4
Why Create a BC/DR Plan? Page 5
Understanding the Whole Picture Page 6
Collaborating Across theOrganization Page 7
Improving BC/DR Plan Adoptions Page 8
Conclusion Page 9
References Page 10
PAGE | 2 BUSINESS CONTINUITY AND DISASTER RECOVERY
Abstract

The purpose of this paper is to discuss the importance of business continuity and disaster
recovery. With the advancement and lower cost of technology these days, businesses are relying
on more and more on technology for critical Data management and storage needs. There isn't a
business today that does not utilize servers, workstations or cloud services at one point or another
in their daily workow. Unfortunately, regardless of so much reliance in technology, Businesses
are not prepared to continue doing business in the event of a disaster that indenitely suspends
core technology operations. A thoroughly planned and documented business continuity and
disaster recovery plan can prepare any business to continue operations with minimum downtime
and minimum loss of revenue and prot.



PAGE | 3 BUSINESS CONTINUITY AND DISASTER RECOVERY
An Introduction
There is no doubt that we live in a technologically advanced world these days. A quick
glance at Google's news site or any major news website is sure to feature some sort of new
software, hardware or technological advancement that is in the works or soon to be released. Not
only is the cost of technology going down year-after-year, businesses and enterprises are
increasing their IT budgets every year as well. More and more investment is being made in
servers, workstations and mobile technology in order for businesses to stay competitive and work
as efciently as possible. In fact, Forrester Research released it's annual IT spend report for 2013,
which predicted that globally we would be spending $2.06 trillion across software, hardware, and
IT services by the end of 2013 (See Image 1 below) (Lunden, Ingrid 2013).

No one would argue that technology isn't a necessary part of a growing and competitive
business. However, the problem lies in the belief that basic precautions and various backup
PAGE | 4 BUSINESS CONTINUITY AND DISASTER RECOVERY
Image 1: Global business and government spending on IT products and services (US$ billions)
solutions are enough to protect against any kind of failure. While researching this topic, for the
purpose of this paper, we discover the reasons why businesses choose to not prepare a business
continuity and disaster recovery plan. With the results from Central Washington University IT
students surveys, we come up with solutions on how we can improve these statistics and
encourage more businesses to better prepare themselves against all odds.

Why Create a BC/DR Plan
In November 2009, A power failure disrupted service to both Halifax and Bank of
Scotland (HBOS) which left customers unable to access their online banking services and aTMs
(Computer Weekly, 2009). Although power and services were restored the next morning, it left a
lot of people wondering just how prepared corporations and enterprises are in the face of both
pre-meditated and natural disasters. Someone could argue that the restoration of services the
next morning is not necessarily a slow response, nor did it display a lack of preparation. However,
I believe Neil Stephenson, CEO of Onyx Group, said it best in the following quote:
The power failure that affected HBOS could have been avoided if its contracted
supplier had provided not only back-up power generators, but also insured that
secondary or tertiary sites at which to store back-ups of data were made
available. (Stephenson, Neil 2009)
The HBOS incident is not being used as an example of a business without a BC/DR plan, but
instead as an example of how important it is to have one made and tested. Neal points out that
HBOS could tighten its BC/DR plan even more by securing data access to its customers even in
the midst of an outage or disaster. Merely having a plan is not sufcient in most cases. A BC/
PAGE | 5 BUSINESS CONTINUITY AND DISASTER RECOVERY
DR plan must be tested and improved on through-out the creation process and then audited
several times a year to ensure its still the most efcient plan available.

Understanding the Whole Picture
According to the American Red Cross, 40% of small-business that suffer a disaster will
never we open for business. Of the 60% that do, another 30% will close their doors within two
years (American Red Cross, PDF). Hopefully the point that is being driven home is an obvious
one: the best way for any business of any size to be best prepared for a disaster is to prepare a
thoroughly documented business continuity and disaster recovery (BC/DR) plan. One must
wonder then, why dont most businesses have a BC/DR plan? The answer lies in two areas, lack
of understanding and the lack of dedicated resources.
A BC/DR plan is broken down into two different sections, Business continuity and
disaster recovery (Slater, Derek 2012). Business continuity refers to a business being able to
continue operations in the event of a disruption. Normally, the type of disruption that a business
continuity plan prepares for is any type that would cause a substantial negative effect to the
business. Each business must determine the amount of outage hours that would qualify for a
business continuity plan to kick into effect before it begins to hurt the business nancially. The
business continuity portion of the plan would then describe how employees and clients will
continue business operations, whether that be switching over to backup systems, moving
employees to off-site ofces (Disaster Recovery Hot, Warm, Cold Sites) or other similar preparations
of the same affect.
The disaster recovery portion of a BC/DR plan refers to a disaster which would destroy
or damage any assets that a business relies on substantially. That could be buildings, technology,
PAGE | 6 BUSINESS CONTINUITY AND DISASTER RECOVERY
paperwork and other similar assets. Disasters can come from natural weather or pre-planned
attacks and network hacks from malicious people. The disaster recovery portion of the plan
would describe the steps that the business should take to begin the recovery of lost assets.
Returning back to our original point in this section, the lack of understanding what a
complete business continuity and disaster recovery plan is ultimately the reason why many
businesses are not prepared. Directors and managers of critical departments in an organization
believe they have a complete BC/DR plan in place where in fact they only have certain portions
of the plan. Their understanding of what a BC/DR plan is does not equal what a complete BC/
DR plan actually is. Of course, there are those businesses with managers and directors who
understand what a complete BC/RR plan is but prefer not to invest time, resources and people to
put one together.

Collaborating Across the Organization
A BC/DR plan must be put together by directors of every critical department in an
organization. That includes the nancial department, the engineering department, the
technology department, the legal department, the sales department and others as well. Critical
staff from every department must be able to give detailed input of what it takes to operate their
department. It is only then that a proper BC/DR plan can be put together to ensure that every
department is able to operate efciently in the face of a disaster. As humans, we know that
tackling a project this big can be overwhelming and does require collaborating with a lot of
people.
Some of the people that are required to deliver their feedback would rather be doing
other work instead of putting together a plan to prepare for a disaster they feel may not even
PAGE | 7 BUSINESS CONTINUITY AND DISASTER RECOVERY
occur. That is why executive level management must fully back and support project leaders that
are in charge of developing a business continuity and disaster recovery plan for the organization.
Without upper-level support, it can be near impossible to get all of the necessary feedback,
resources and support that is required to accomplish the task.
Lastly, a well-developed plan must be delivered to every employee in order for it to be a
successful plan. In the face of a disaster, every employee must be prepared to put the BC/ DR
plan into action, which usually means teaching them how to nd the plan and subsequently
deploying the procedures. Building a disaster recovery plan but failing to test it with employees
causes the plan to lack validity. Small to large scale drills should be prepared and initiated to test
employees ability to deploy the BC/DR plan. The feedback from those drills will also assist in
putting any holes that the plan may have and preparing additional employee trainings necessary
so that all questions are answered.

Improving BC/DR Plan Adoptions
How can we make sure that every business puts forth the effort to create a BC/DR plan?
The rst step is to get the information out there. Inform people of the benets of having a plan
in place, or better yet, inform them of the consequences that will take place if a disaster happens
and they are not prepared. The topic of BC/DR plans should be mentioned on every business
website, every text book about business, and so forth. The more people are informed, the better
chance we have of incorporating a uniformed standard in business.
One suggestion of achieving such a standard is to create government regulations that
require businesses to have a proper BC/DR plan in place. Such a regulation should exist much
like the already deployed OSHA laws and regulations which require businesses to be responsible
PAGE | 8 BUSINESS CONTINUITY AND DISASTER RECOVERY
for providing a safe and healthful workplace. OSHA's mission is to assure safe and healthful
workplaces by setting and enforcing standards, and by providing training, outreach, education
and assistance (Osha). If there are regulations in place to keep people safe, there should be
regulations to ensure business continuity. Not only will the assurance of such plans in place
benet the business, but it will benet the community too, because the community is affected by
the downtime of businesses too.
Businesses not following such regulations should have consequences. That way we are
sure that all businesses will adhere to the rules. Getting such laws in place may be a challenge, but
it is a challenge that needs to be addressed for the benet of us all.

Conclusion
Carlos Ruiz Zazon, author of The Angels Game, once said, Don't be afraid of being
scared. To be afraid of the sign of commonsense. Only complete idiot are not afraid of
anything. Carlos helps me drive the point home: there are many things that can disrupt business
operations. Wise IT and businessmen will recognize the value in awareness and preparation for
their business. Yes, a business continuity and disaster recovery plan does take a lot of effort,
planning, collaboration, and resources. However, any effort and cost that occurs in preparing a
business to tackle outages and disasters will always be less than the cost of a business shutting
down or going bankrupt due to lack of preparation. With disasters and tragedies like September
11 and Hurricane Katrina, it is safe to say we live in a world full of uncalled-for chaos. We'll wait
to our employees, customers and stakeholders to be prepared for any chaos that comes our way.
PAGE | 9 BUSINESS CONTINUITY AND DISASTER RECOVERY
References
"Disaster Recovery Hot, Warm, Cold Sites: Key Differences." Disaster Recovery Hot, Warm,
Cold Sites: Key Differences. Zayo, n.d. Web. 05 June 2014.
Feinglass, David. "Top 10 Mistakes Businesses Make with Disaster Recovery Planning." Top 10
Mistakes Businesses Make with Disaster Recovery Planning. Latisys, 23 Nov. 2013. Web.
05 June 2014.
Lunden, Ingrid. "Forrester: $2.1 Trillion Will Go Into IT Spend In 2013; Apps And The U.S.
Lead The Charge | TechCrunch." TechCrunch. N.p., 15 July 2013. Web. 05 June 2014.
"OSHA Law & Regulations." OSHA Law & Regulations. Occupational Safety & Health
Administration, n.d. Web. 05 June 2014.
"Plan Now, Worry Less After: Make a Post-Emergency Punch List." Disaster Recovery 101. Iron
Mountain, n.d. Web. 06 June 2014.
"Power Failure at HBOS Disrupts Banking Services." Power Failure at HBOS Disrupts Banking
Services. Computer Weekly, 19 Nov. 2009. Web. 05 June 2014.
Preparing Your Business For the Unthinkable. N.p.: American Red Cross, n.d. PDF.
Slater, Derek. "Business Continuity and Disaster Recovery Planning: The Basics." CSO Online.
N.p., 13 Dec. 2012. Web. 04 June 2014.
Stephenson, Neil. "HBOS Power Failure Highlights Importance of Business Continuity
Planning." HBOS Power Failure Highlights Importance of Business Continuity Planning.
Computer Weekly, Nov. 2009. Web. 05 June 2014.
PAGE | 10 BUSINESS CONTINUITY AND DISASTER RECOVERY