Danger, Will Robinson, Danger

Disaster recovery is a key process in running a successful business. Failure to have an adequate disaster recovery plan in place can do impact a business in many ways. Disasters can cost you money, information, customers and in the worst cases it can cost you your business. How you prepare your DR plan depends on several things and every company implements differing levels of disaster recovery planning. Hopefully your DR plan takes into consideration several different disaster scenarios and each has different tasks associated with getting things back up and running in a timely manner.

One thing that we need to take into consideration is that disasters don't always come in "disastrous" ways. Disasters can strike in ways that you don't expect. Some of the ways that a disaster can sneak up on you are things such as not paying attention to when contracts expire is one thing that can bite you if your not careful. If you have a service contract and it expires the consequences can be disastrous. Also lack of planning can be a disaster for you. If for example you are planning on moving your web server hosting in house and you don't adequately plan you may have a disaster on your hands. You may find yourself down to the last hour and not be able to make the transition in a timely and secure manner.

We tend to think of disasters being events beyond our control but sometimes events within our control can have the same effect as a real disaster. Having plans in place for ALL scenarios is a good idea.

In praise of documentation

One of the most important things that a company can do is to document their environment. This holds true for all areas of business. You need to know what you have, how it works, what it's worth (not just in dollars but to the operations of the business), how do you operate without it, what dependencies does it have and what depends on it. When you get into talking about technology you have a few more things to take into consideration. What does it take to keep it up and running, how is it configured and secured, what are the specs required to run it, and on and on.

This documentation gives you the needed information to continue operations, or get back up and running quickly if problems, disasters or failures occur. When done properly it can be the difference between continued operations and closing the door and hanging a "Gone Fishing" sign. It can be the difference between having a system back up and running in a matter of hours or days. Good documentation can cut troubleshooting time down to little or nothing.

Documentation also plays other roles. Auditors ask for lots of documentation of what you are doing and how you can prove it. They want proof of what you say and often good documentation is the proof that keeps them happy.

The problem is that documentation is no fun. Not many people enjoy documenting a server configuration or how the network is connected. Most of us in IT would rather build, fix and configure than document how we did it. This presents a problem when it comes time to rebuild a system and you can't remember how an application was configured or how you had an ACL constructed to help protect the financial department from engineering.

It can also become a nightmare when you get notice that an audit is coming up in the next few weeks or months. It's important to not only have your documentation in order but to know what it is that is expected and what you told them last year you would do this year. Spending a few weeks trying to figure out if you have met the requirements from last years audit and trying to gather all the information needed for this years in not much fun. Not to mention it takes valuable time away from other things that needs to be done.

Managing your documentation is an important part of any program. It is as important as any other piece and often more important. It's kind of like an insurance policy that sits in a file cabinet and you wonder why you spent money on it until you need it. Then you realize that it's worth every dime it cost you. Having someone who is good at documenting and can help you manage it will be a valuable asset to an organization. It will save time and money. It will help keep your stress level low and may well be the difference between a minor blip in operations and a complete shut down in operations.

DR vs BC

Yesterday I went to a TechTarget breakfast seminar on Business Continuity. They had an analyst from The Burton Group talk about BC and then a short case study by Stratus on how they had solved a BC problem for a client with their solutions.

It was a good morning and started me to thinking about the difference between DR and BC. It seems to me that lots of companies think that DR = BC and that they will be in for a very rude awakening if/when they ever have to put the plan into play. BC involves much more that DR but as technology professionals it's easy to get caught up in the technology of it all and forget the processes that make the business run. I'm not suggesting that IT is responsible for ensuring that Finance or HR or any other department within the company has their BC plans in place but we do need to ensure that our DR plans match up with the companies overall BC plans. That is where we can step in and raise the proper questions. I'm a firm believer that in order for technology to do it's job properly that we must understand the business. By understanding the business and knowing the technology (and how the DR plan works) we are in a great position to bring up other BC related issues.

This got me to thinking that this may be a good time to start doing polls again. So here is my first Poll question for this year. Does your company have a full Business Continuity plan in place or only a Disaster Recovery plan? DR Only or BC and DR

It's quick and easy and a good way to start the polls again.

Small Business IT

InformationWeek has an article about a survey that reveals that a lot of small businesses leave data vulnerable. A lot of the survey respondents have no real data recovery plan in place for data stored on desktops and laptops. Many of those who do have a plan are still storing the data in ways that leave it vulnerable to loss and possible misuse.

What really caught my eye about this is this quote by Kiyoshi Maeda, Verio president and CEO "Given the affordability and easy deployment of some of today's PC data backup and recovery solutions, it's surprising that such a large number of small businesses leave their data exposed and at risk,". Obviously he has never owned or worked for a small company. There are many, many, many companies out there who can barely afford what little technology they have. They have no IT staff or their IT person is whoever could spell PC when they first got computers in the office.

When I did my stint as a consultant I spend lots and lots of time talking with small businesses who needed the services provided my my company but could only afford an hour or two a month. And our rates were VERY cheap compared to major metro areas of the country. When we did get into many of these companies to help them out we ran into all sorts of issues related to old equipment, expired support contracts and subscription services for AV and such. Getting these companies up to a decent level of usability was often a very slow process as they could not afford to spend money to buy what was needed. When they did it was often in small chunks here and there.

A couple of weeks ago Martin McKeay posted (sorry about not linking I can't find it on his site) about the NAC debate being almost not worth his time keeping up on because his company couldn't afford a NAC solution. He said that they were lucky to keep what they had up to date with support contracts and such. This is what much of small business America faces. It doesn't matter how cheap or easy technology is to use if you can barely afford to pay normal bills. I know it may be cheaper than the loss incurred due to a virus, data loss, network failure, etc... but that is just the reality of how many business have to live.