- What is Disaster Recovery Planning?
- Purpose of This book
- A Working Definition of Disaster
- The Time Factor in Disaster Recovery
- The Need for Disaster Recovery Planning
- The Auditor's View
- An Imperfect Legal Mandate
- Building Management Consensus for Disaster Recovery Planning
- Who Should Write the Plan?
- A Straightforward, Project-Oriented Approach
- A Note on Methodology
This chapter is from the book
This chapter is from the book
This chapter is from the book
The Time Factor in Disaster Recovery
However, despite contextual diversity, there are some constants about disasters. One is time.
Because of businesss' growing dependency on customized information systems and networks, alternatives to system-provided functions and information cannot be implemented readily. Yet, for a business to survive a disaster, the time factor for restoration of system functions is critical.
In the past, interruptions in normal processing could be withstood by most companies for a protracted period of time. A 1978 study by the University of Minnesota depicted the resilience of business to system interruptions, suggesting that most companies could survive interruptions of 2 to 6 days in length.1
Given the increased dependency of business today on information technology, it is hard to imagine a company withstanding an outage of more than 48 hours without incurring serious difficulties for its market position. Indeed, for companies ranging from brokerages and banks to e-commerce vendors and just-in-time manufacturers, the costs associated with even minimal system or network interruptions may be extremely high.
This is underscored by data from the Meta Group, describing the cost of downtime by industry segment. The Meta Group study looked at downtime costs from the perspective of employee idle time and suggested that the average cost to an organization an hour of downtime exceeded $1 million. (See Table 1–1.)
While industry- and application-specific averages for downtime cost are poor indicators of specific business vulnerabilities, they do point out the growing dependence of business processes on IT infrastructure. In view of business' dependence upon its information technology infrastructure and its vulnerability to an unplanned interruption of normal information processing activity, it makes sense for a company to plan and prepare for this possibility.
Recent events attest to the fact that those who plan for unplanned interruptions fare better than those who do not. A brief listing of some disaster recovery successes illustrates this point. In the last decade, publicized business process interruptions (excluding 9/11 attacks) included:
An anthrax scare in November 2001 temporarily closes Empire Blue Cross/Blue Shield's data center.
Tropical Storm Allison floods the Texas Medical Center Campus in June 2001, closing 54 medical institutions.
Rolling power outages in California leave hundreds of companies in the dark during the summer of 2001.
An earthquake measuring 6.9 on the Richter scale in the Seattle area hits numerous companies including Boeing Corporation in March 2001.
A computer glitch causes Delta Airlines subsidiary, Atlantic Southeast Airlines, to cancel or delay over 400 flights in February 2001.
In 1999, pipe break floods Charles Schwab and Company offices in San Francisco, California.
In 1998, roof collapses and floods at Landstar Systems in Jacksonville, Florida.
A tornado hits on Bank of America Corporation's Nashville, Tennessee, operations center in 1998.
Hurricane Georges causes the evacuation of Degussa Corporation in Theodore, Alabama, in 1998.
A 1996 data center fire occurs at Humana Inc. headquarters in Louisville, Kentucky.
Table 1–1 -The Cost of Downtime from the Perspective of Lost Revenues and Employee Idle Timea
|
Industry Sector |
Revenue/Hour |
Revenue/Employee Hour |
|
Energy |
$2,817,846 |
$569.20 |
|
Telecommunications |
2,066,245 |
186.98 |
|
Manufacturing |
1,610,654 |
134.24 |
|
Financial Institutions |
1,495,134 |
1,079.89 |
|
Information Technology |
1,344,461 |
184.03 |
|
Insurance |
1,202,444 |
370.92 |
|
Retail |
1,107,274 |
244.37 |
|
Pharmaceuticals |
1,082,252 |
167.53 |
|
Banking |
996,802 |
130.52 |
|
Food/Beverage Processing |
804,192 |
153.10 |
|
Consumer Products |
785,719 |
127.98 |
|
Chemicals |
704,101 |
194.53 |
|
Transportation |
668,586 |
107.78 |
|
Utilities |
643,250 |
142.58 |
|
Healthcare |
636,030 |
142.58 |
|
Metals/Natural Resources |
580,588 |
153.11 |
|
Professional Services |
532,510 |
99.59 |
|
Electronics |
477,366 |
74.48 |
|
Construction/Engineering |
389,601 |
216.18 |
|
Media |
340,432 |
119.74 |
|
Hospitality/Travel |
330,654 |
38.62 |
|
AVERAGE |
$1,010,536 |
$205.55 |
The above examples, and many others, provide empirical evidence of the efficacy of disaster recovery planning. In virtually every case, companies that experienced potentially devastating disasters implemented tested contingency plans and survived to continue operating in the marketplace.
By contrast, as mentioned above, nearly 150 companies without disaster recovery plans were dealt a death blow in February 1993, when a bomb wracked the World Trade Center in New York.2 These firms learned too late that when a company does not have a tested set of procedures for reacting to and recovering from a catastrophe, it places all of its other plans and objectives in jeopardy.
Business Continuity Planning Consultant Philip Jan Rothstein correctly observes that documented information about the outcomes of system or network interruption events, both in the presence and absence of recovery plans, remains very limited. He bristles at the use of gross estimates of downtime cost as a substitute for factual industry statistics.3 The point is well-taken, especially as it pertains to business failures following disaster. In many cases, the relationship between a disaster event and business failure is not discussed publicly at all. Moreover, failures of businesses that are rooted in a disaster event may not occur until several years after the event, making the relationship difficult to document.
Based on available evidence, the time required to recover critical business processes following an interruption is a universal determinant of successful recovery. Unplanned interruption can cost a business dearly in revenues, reputation, customers, and investors. The objective of DR planning is to recover mission-critical processes as quickly as possible following the interruption event to mitigate its duration and costs.
However, evidence also suggests that interruption costs do not remain constant following a disaster event. They may rise exponentially, then decline over time. Assuming that a company can sustain itself through the initial high-cost interruption period, even those without tested DR plans may be able to recover their operations and live to fight another day.
While this may seem to contradict the recovery time factor argument cited above, in fact it confirms it. Companies can elect to expend time, effort, and resources in advance of a disaster to reduce the risk of business failure, or they can do nothing, accept the risk, and hope that their IT infrastructure can be repaired "on the fly" following an unplanned interruption.
Even in the absence of a statistical DR planning nirvana—the availability of exacting data on outage costs and business failure rates that would provide an airtight case for planning—numerous case studies can and do make a persuasive argument. Proactive planning can avoid certain risks and mitigate the impact of others.