The following article was excerpted from a recent presentation by Steve Quigley of Clear North Technologies at the Minnesota Information Professionals Society on May 3^rd, 2006.

Disaster Recovery Planning for the SMB Business Space

For most medium and small businesses, planning for disaster recovery (DR) is much like buying insurance – everyone agrees it’s important but rarely is there a great sense of urgency to address it. In fact, some see it as a ‘victory’ of sorts to avoid investing in a disaster recovery solution for as long as they can.

Compounding the problem is the difficulty companies have in taking that first step on DR initiatives. To begin with, there are usually no defined budgets or target objectives, and like cleaning a basement, DR planning can be a large, unwieldy job with a scarcity of volunteers.

In some ways, disasters can have a greater effect on medium and small businesses than large companies. Even though every business in a given geography is susceptible to the same potential disasters (e.g., floods, snowstorms, tornadoes, etc.), small and medium businesses may just have the one location in harm’s way. Also, smaller businesses tend to have fewer resources that they can direct toward DR planning and solutions.

Nonetheless, there is still a lot most companies can do from an IT perspective to plan for, and mitigate the effects of, a disaster. The following is a simple framework to help businesses take their first steps toward DR planning. Keep in mind that DR technology solutions do not have to be extravagant – in fact, simply getting a secure, reliable copy of your data off-site is an excellent start.

The following suggestions are by no means a comprehensive approach to DR and Business Continuity (BC) planning. But even a cursory review of the following items can help bring a DR & BC project into tighter focus and make the whole process seem less intimidating. There are also a few technologies that are worth considering as a part of most DR and BC solutions.

• Establish “Recovery Time Objectives” (RTO) and “Recovery Point Objectives” (RPO) – RTO means, “How quickly does my location or my staff need to be up and running?” RPO asks, “How ‘fresh’ does my data need to be when I come back online?” The answers vary by industry – consider scenarios for retail versus financial, manufacturing, professional services, health care, etc. Answering these questions will guide you toward the most appropriate technology solutions and also help companies gauge the value and cost of the technology. Attaching cost to technology solutions is critical to striking that cost/benefit balance since it will become clear that the more aggressive your RTO & RPO windows are, the more expensive the technology solutions tend to be.

• Identify your most important systems – Be ruthless. Everybody will feel like their system is the most important. But which ones are tied to revenue, critical data, and to customers? Use the “80/20” rule – chances are, 20% of your systems provide 80% of your company’s value. And in a disaster, assume limited resources where only key people may be able to get to critical systems. Everybody else just might have to wait. If you need clarification, envision yourself presenting this prioritized list of systems to your company President.

• Start at the end – Trying to plan for every eventuality can seem overwhelming. Like “writing your own eulogy”, sometimes it’s easier to address a multi-faceted issue if you can envision yourself at the finish. So, work backwards and assume the worst has already happened. Suddenly, you have limited staff. Or no systems. Or no connectivity outside the office. No cell phone or telephones. Or all of the above.  From that perspective, it may be easier to sort out what needs to happen first, then what happens second, and so on. Now you can begin discussing solutions within those constraints.

• Separate DR and BC issues – Many non-technical staff assume that if the data is safe at an off-site location (e.g., back-up tapes in a vault or servers in another data center), then systems will be available shortly after the disaster. Make it clear that there is a critical difference between protecting and recovering your data (DR) versus making systems available and data available to users & customers (BC). For example, assume a disaster hits but you have reliable data on back-up tapes safely stored off-site. That is excellent news, but still a long way from having your email or ERP systems available to the staff. Variables include server availability, workstation availability, Internet or telecommunication access, etc.

Ultimately, many ‘soft’ issues will define success in DR and BC planning – engaging your various business units in planning, setting RTO & RPO objectives, and just plain common sense & good planning.

Also, the following technologies and practices are often an important part of building DR and BC plans:

• Thin client technology – If you’re not familiar with thin client technology but are tasked with implementing a BC plan, learn all you can about this technology. Its key benefit in a BC context is the ability to deploy your business applications over the Internet from a remote location or data center. After a disaster, chances are with thin client technology that anywhere your staff can get to the Internet they can also get to their applications and data. Citrix Systems and Microsoft are two of the leading thin client vendors.

• Data protection – This is the practice of being able to back up your data in a manner that allows you to reliably and quickly recover it when needed. Most companies use tape back-ups, and while this is very common, this is also typically an area where many companies feel exposed. Ensure that your back-ups are reliable by doing periodic data restore tests, and also make sure that copies of your data are stored securely off-site. Consider solutions that feature ‘disk-to-disk’ back-ups since they provide faster and more reliable back-ups and restorations. Also, disk-to-disk provides a better platform for migrating data off-site to a remote data center or other remote storage platforms.

Steve Quigley is the Managed Service Practice Manager at Clear North Technologies.  Clear North provides technology services and support for businesses. They are experts in networking, storage, security, and outsourced managed services such as Network and Desktop Management. They are viewed by their clients as their trusted technology advisor.