Five steps to evaluating business continuity services Page 1 of 3

Five steps to evaluating business continuity

January 07, 2008 (CSO) In the past, most enterprises defined a disaster as an act of nature -- a hurricane,
tornado, flood or fire that wipes out their ability to conduct business as usual. Today, with worldwide
networks, 24/7 customer call centers and Web applications, a common electrical failure could spell disaster
when communication is interrupted in the supply chain, online transactions are halted or networks are down.
Online resource [Link] has even added "business failure" to the list of calamitous events that
define a disaster.
With this in mind, companies are stepping up their use of hosted business continuity (BC) and availability
services--not just for those acts of nature, but also for everyday occurrences that might interfere with
stringent uptime requirements.
Business continuity and disaster recovery
are intertwined. While disaster recovery is
the set of steps and processes involved in
restoring a data center to normal operation
after it has been partially or totally taken
offline by some event, business continuity
involves managing emergency
coordination, notifying employees and
interacting with emergency officials.
The frequency of common business
interruptions has boosted the market for
external disaster recovery services--which
include data center services, backup and
mobile recovery services--to $3 billion to $4
billion a year, according to Gartner.
The market size for capital expenditures on
in-house servers, storage and internal staff
used for business continuity and disaster
recovery is harder to quantity. Very often,
that server and storage infrastructure can
be brought in to support other applications
and initiatives. Although it still needs to be
backed up and may have to be managed,
restored and brought back to life, it is not
always counted in the disaster recovery
budget.
Here are some points to consider when
evaluating business continuity and
availability services and software.
1. Weigh the benefits of specialized business continuity planning software.
Business continuity planning software can help large companies formalize the BC framework and continually
update the plan. "Of companies that actually have plans, 50 percent use software and 50 percent use
informal software" such as Excel spreadsheets, says Stephanie Balaouras, a senior analyst at Forrester
Research in Cambridge, Mass.
Software providers such as Strohl Systems Group and SunGard Data Systems, and emerging players such
as eBRP Solutions and U.K.-based Office-Shadow offer BC planning solutions. Regulated industries that

[Link] 3/19/2008
Five steps to evaluating business continuity services Page 2 of 3

face audits, such as life and health insurance companies or financial institutions that require uniformity in how
they build their plans, may benefit from one of these software packages.
Reviews are mixed, however, about how beneficial they are in an actual emergency.
"Business continuity plans that are generated by people within the department with known [software] like MS
Word and Excel have always proven to be more successful in a real disaster," says Jack Smith, first vice
president and manager of global IT business continuity at ABN Amro in Chicago. "Multimillion-dollar solutions
can help you get through your audit, but they're an albatross because they have to please so many masters.
By the time you fully implement them, your grandchildren are running [the company]," he adds.
Smith saw his business continuity plan in action in December 2004 when the LaSalle Bank Building in
Chicago, a subsidiary of ABN Amro, caught fire and became the largest skyscraper fire in the history of the
city. More than 6,000 workers were displaced--4,000 of them bank employees.
With Smith's simplified BC plan in place, the financial institution mobilized and kept business running. "We
filed $50 million in property damage and zero in business interruption," Smith says.
At Southern Farm Bureau Casualty Insurance, Larry Marler has also reviewed packaged BC planning
software and taken a pass. "I discovered I could write my own software to meet the company's needs without
all the overkill," says the disaster recovery coordinator at the Ridgeland, Miss., insurance company. When
the company was hit hard by hurricanes Katrina and Rita in 2005, Marler had a chance to see his business
continuity plans in action.
But Forrester's Balaouras sees problems with simple planning tools. "Without the software, how do you keep
plans updated, collaborate, invoke a plan and track that all the tasks are being executed?" she asks.
"Software makes it easier to turn BC planning from a one-time event into an actual program." Her rule of
thumb: Companies with more than 50 entities that must have a coordinated business continuity plan should
take a serious look at BC planning software. "Everyone uses the same templates; plans have all the key
components that are thorough and meet company standards for quality and consistency."
2. Consider the major business continuity/availability service providers and some niche players.
Hosted business continuity/availability providers typically provide cold sites (data center space to house your
own equipment and backup tapes), warm sites and hot sites (an operationally ready data center), as well as
data archival, restoration capabilities, managed services--you name it.
SunGard, IBM Business Continuity Resiliency Services (part of IBM Global Services) and Hewlett-Packard
own the worldwide market share in this segment with the broadest set of services.
"If you look at mainframe-based recovery, there are really only two players in the world that can do that--IBM
and SunGard," says John Morency, research director at Gartner. "HP tends to focus more on the
professional design, integration and consulting services around disaster recovery and continuity."
Smaller services players such as Rentsys Recovery Services are also making inroads into the market. The
Houston-based company, historically a business equipment rental company, has grown its offerings to
include mobile recovery data centers. The company can deploy large tractor-trailers equipped with electrical
power, satellite communications, PCs, faxes and other equipment anywhere in the country to recover
customer service operations or anything else. IBM and HP both subcontract their mobile recovery services to
Rentsys, while SunGard has its own trailer fleet of 30 mobile data centers.
3. Let recovery requirements dictate the level of dedicated BC services.
Subscribing to a data recovery service that you can trigger when a disaster strikes is fine if data can be
restored in two to four days. But increasingly, as businesses require 24/7/365 availability, more dedicated
data recovery services are required.
"If you have to recover within 24 hours, that requires some form of dedicated infrastructure in terms of remote
SAN [storage area network]. If you're using asynchronous replication or data mirroring, you've got to have
fixed assets that are using the data backup," Gartner's Morency says. "You have to have that space on a
dedicated basis because when disaster strikes, you need to get your staff out quickly and be able to get
everything up quickly."
That's at odds with the shared capacity model, especially in the case of a regional disaster like Hurricane
Katrina or a major earthquake, where multiple businesses declare disasters at the same time. After all, if
everybody needs the same rented facility at the same time, somebody is going to be out of luck. Companies
that can't afford to wait their turn are either evaluating building their own facilities or looking for service
providers that can meet their needs.
These faster recovery requirements are bringing new players into the market. Colocation vendors such as
NaviSite in Andover, Mass.; Equinix in Foster City, Calif.; and Houston-based VeriCenter are capitalizing on
increased demand for data center space.
Organizations that already use SunGard, IBM and HP "are engaging with colocation providers to rent floor
space where they can put two to three racks, their SAN equipment and server equipment in the cage in a
dedicated facility," Morency explains. "All they're doing is renting floor space and communications capacity.
In many cases, it can provide a more available service either at the same cost or at a lower cost [than full-
service business continuity providers]. It gives those businesses more predictability in responding to
disasters and supporting those [24 hour or less] recovery times."

[Link] 3/19/2008
Five steps to evaluating business continuity services Page 3 of 3

Major BC service providers also see a growing need for data center space to address customers' needs.
Case in point: In July, SunGard acquired VeriCenter, which brought seven data centers to the table.
4. Don't forget emergency notification systems.
During the LaSalle Bank building fire, Smith says the most valuable business continuity tool "by far" was the
automated call system. Key IT people, facilities managers, security directors and the key business managers
throughout the building were automatically notified of the emergency and where to report.
"We get them all in the room, and everyone has to execute their biz continuity plan. They used the automated
call system to call all their people and tell them to go to the secondary site to restore servers and other things
to process from another location the next morning," Smith says. "We worked throughout the night and called
every two to three hours to touch base. Between that, groups talked amongst themselves to work toward
recovery."
Emergency notification systems can use many different means of communication--phone calls, text
messages, e-mail--to contact employees, vendors or other critical personnel.
While the Big Three business continuity service providers don't offer their own emergency notification
systems, they do support outside systems with their service. SunGard, for instance, supports Paragon
software, which can be offered as a managed service.
Other players include Strohl Systems' LDRPS software, Seattle-based Varolii and Verizon business services,
which just announced a managed service offering for emergency notification.
Smith prefers the same simplicity with a notification system as he does with his BC planning tools. "Although
[emergency notification systems] may have slick bells and whistles, I have found that you don't need them,"
Smith says. "You need a system that will call a lot of people all at once and have them call into a central
conference call number."
He also suggests having an automatic phone forwarding system through your phone company. That way,
clients whose only contact is an office phone number can be rerouted to an employee's cell or home phone.
5. Use caution when outsourcing business continuity functions overseas.
Because of terrorism and natural disasters typically not seen in the United States, such as tsunamis and
monsoons, companies should take caution when outsourcing backup, recovery and business continuity
operations offshore. Some popular outsourcing countries may not have the recovery capabilities found in the
United States. "A Third World company doesn't have the recovery capabilities that we do [in the U.S.]," Smith
says. "As you outsource [abroad], you increase your risk of significant disruption."

[Link] 3/19/2008