Infrastructure

E m m G o o d To Gi^eat
COMPANIES NEED TO STEP UP THEIR BUSINESS-CONTINUITY PLAN
EVERYTHING FROM EMERGENCIES TO VIRUS AnACKS
B
USINESS-CONTINUITY PLANS are good, but
not good enough. Almost 80% of 300 re-
spondents to InformationWeek Research's
Outlook for 2005 survey, part of our quar-
terly Priorities series, say business-conti-
nuity plans are in good enough shape to ensure oper-
ations continue even in the event of a terrorist attack,
but nearly 70% also cite business-continuity planning
or disaster preparedness as a key priority this year.
"There's always this dichotomy because companies
include operational recovery and disaster recovery
under business continuity," says David Hill, an analyst
at IT market-research firm Mesabi Group. "Disaster
recovery is in place, but few companies have covered
all operational needs." They may have smart processes
and technology to deal with extreme emergencies but
not, say, for recovering data after a virus attack.
Other areas for business-continuity improvement
may center on performance issues. Companies are
protected with backups on
tape but likely would pre-
fer a faster medium when
they need to recover data.
"With tape storage, recov-
ery could take hours, and
even days," Hill says.
MidAmerica B ank, a
wholly owned subsidiary
of financial holding com-
pany MAF Bancorp Inc.,
has set up mirroring and
recovery between sites on
hard-disk storageusing a
combination of Sym-
metrix Remote Data Facil-
ity and MirrorView soft-
ware from EMC Corp., the
bank moves information
from headquarters to a
hot-standby data center.
That's the highest form of
availability, with the com-
pany able to assure busi-
ness units of data recovery
within four hours, but the
bank still wants to finesse its continuity efforts.
That's because not all applications need to be re-
covered within four hours. So in 2005, Paul Stonchus,
first VP and data-center manager at MidAmerica
Bank, plans to create a multitiered recovery infra-
structure. Under that plan, only five applications re-
quire recovery within a four-hour period. No hot-
standby server will need to be at the recovery site for
lower-ranked apps, so the bank could redeploy those
servers as needed. If a case can be made to add other
apps to the fast-recovery list, they will be added. "Our
business units review their business-continuity pro-
cesses, and we tie contingencies to our disaster-re-
covery plan," Stonchus says. "Our IT perspective is to
always make data available to our users."
There's always room for improvement in planning
because companies learn from experience. Doug
Smith, IT disaster-recovery manager at Southern Co.,
a utility-holding company, says Hurricane Ivan tested
plans last year. "We al-
ready have much-im-
proved communications-
infrastructure views, but
we're finding out what
went wrong with our han-
dling of Ivan," Smith says.
"Our plan in 2005 is to
combine the right combi-
nation of IT and opera-
tions so we have the right
resources for support."
But not everyone puts
business-continuity plans
into practiceand that's a
problem. "Most business-
continuity plans sit on a
shelf, and they're never
tested," says Peter Gerr, an
analyst at IT market-re-
search firm the Enterprise
Strategy Group. "One out of
five recovery efforts fails."
MARTIN J.GARVEY
(mgarvey@crnp.coni)
Jaa 3. 2005 45