This document discusses right-sizing disaster recovery capabilities for organizations. It recommends determining an organization's current disaster recovery capabilities, getting business buy-in to establish appropriate priorities, and separating wants from needs. The document outlines a three-phase process for disaster recovery scoping: 1) assess current IT capabilities, 2) establish and validate business wants, and 3) align IT capabilities with business needs. It provides tips for getting business buy-in and measuring the costs and impacts of downtime to help organizations determine appropriate recovery objectives.

1. Right-Size Enterprise Disaster Recovery Capabilities1Info-Tech Research Group

2. Info-Tech Research Group2Executive Summary All organizations, needs some form of DR capabilities, or procedures and systems in place to lead them back to operations after a disaster.

3. Your organization must establish the DR it has, the DR it wants, and the DR it needs. Info-Tech has looked at what other companies have done and will provide you with the do’s and don’ts when tackling DR:

4. Measure your organization’s current DR capabilities

5. Get business buy-in to establish appropriate DR priorities

6. Separate DR wants from DR needs

7. Set relevant and realistic objectives for your organization’s DR capabilities

8. Plan for the cost of realizing your chosen DR objectives

9. All DR scoping projects are comprised of three phases, move through these phases in a timely manner to reduce the time spent on planning your DR capability:Determine the current DR capability which IT can provideKnow what DR capabilities the business wantsAlign the business’ and IT’s DR priorities

10. IntroductionAll companies have some form of Disaster Recovery (DR) capability in place whether they realize it or not. Depending on the size and needs of the company, DR capabilities can range from having an employee backing up the company’s files once a month to having a fully documented and tested plan in place.

11. If the IT and the business side of an organization are in alignment with their DR desires, needs, and priorities, then the current plan may be well-suited to the organization. However, organizations rarely have proper DR capabilities in place.

12. Many organizations make the mistake of having inappropriate DR capabilities. Having too much DR capability means the organization is overspending and having too little means the organization is still vulnerable in the event of a disaster. Make sure that DR capability is a good fit with the organization’s actual needs.

13. It is often hard to settle on what amount of DR capability your organization needs. This solution set will walk you through the right-sizing phase of your DR project quickly and will address all the relevant areas:

14. The Basics

15. Current DR Capabilities

16. DR Wants and Needs

17. Aligning IT and Business

18. Case Studies

19. Once the organization’s appropriate DR objectives are agreed upon, IT can begin planning their development.Info-Tech Research Group3

20. Info-Tech Research Group4

21. Info-Tech Research Group5Without some level of DR capability, the odds are overwhelming that your business won’t survive a disasterDR concerns the safety and restoration of an organization’s technology infrastructure in the event of a disaster. There should be some level of disaster recovery in place at every organization. DR will return the business to normal operations after anything from a natural disaster to a serious security breach.Research shows: 6% of companies which suffer a catastrophic data loss recover and survive,

22. 43% never reopen,

23. 51% close within two years of reopening. Source: University of TexasDR focuses on the recovery of IT services, systems, data facilities and staff.

24. Info-Tech Research Group6Disaster Recovery focuses on IT, Business Continuity concerns the entire company. Don’t confuse the two.Disaster RecoveryA subset of BC that addresses the IT elements of continuity such as data, application, and infrastructure recovery

25. Reactionary set of procedures that take place once a disaster has struck

26. The IT side of an organization is responsible for its DRBusiness ContinuityA set of procedures that organizations can adopt in an effort to minimize the impact that an outage has on all aspects of a business

27. Incorporates organizational and human resources issues such as communications plans and crisis management

28. The business side of an organization is responsible for its Business ContinuityBusiness ContinuityDisaster RecoveryDR and BC initiatives should complement each other; a good DR plan relies on a good BC plan and vice versa. Ensure that the DR and BC teams work closely together to ensure success.For more information on the differences between DR and BC, please refer to the note, “Draw the Line Between Disaster Recovery and Business Continuity.”

29. Info-Tech Research Group7Organizations attribute their failure to develop disaster recovery capabilities to multiple factorsOrganizations listed business buy-in, time, and money as the main reasons why they had yet to develop their disaster recovery capabilities. “Cost and always something else to do…”-VP in Public Administration“The organization didn't have an IS executive in place and it wasn't considered a company priority until recently. “- VP in Wireless Telecom Carriers“3 blind monkeys - haven't seen a disaster, won't hear of a disaster, refuse to talk of a disaster. Strong plans have existed and been undermined over time due to lack of executive support. Some departments have maintained robust procedures, yet others are becoming weak links.“-Manager in Publishing Industry

30. Info-Tech Research Group8No matter how lucky you are, disasters occur. Everyone is vulnerable and can benefit from some preparation.DR only becomes useful when all else has gone horribly wrong.“In business, the disaster isn't the act of God or fire that destroys property, but the loss of data and the inability to continue operations - THAT is the business disaster.“-Manager in the Publishing IndustryIt would be best for an organization if the value of its DR capabilities is never truly realized. However, having DR ensures that an organization can (and knows how to) survive a disaster. If an organization invests a little now, it won’t lose nearly as much later.Unless you live in an impenetrable bubble, you will benefit from DR.Every organization that operates on the planet is at risk from one type of disaster or another. An organization will find DR valuable whenever the cost of losing its IT operations is greater than the cost of creating and maintaining its DR capabilities. “It’s a relatively cheap insurance policy.”- Director in Consulting

31. Info-Tech Research Group9Downtime costs money. If you know how much, then you know how urgently the organization must avoid it.There are several ways in which downtime may cost your organization money:Loss of RevenueIf the organization is unable to sell product or fulfill orders, then it is losing revenue. This could be the result of an interruption in the shipping process or of the channel through which sales are made (building, website, etc.) being inaccessible to customers. Loss of ProductivityThe system is down, causing a production shift to stand around or "make work" to keep busy rather than doing their normal jobs. Since staff still have to be paid, this time is considered a loss.Increased Labor CostsAny additional work is going to require additional labor. This could be in the form of overtime shifts or extra workers during regular shifts. Whatever the case, expenses are going to increase and the organization is going to have to pay for these incremental costs.Increased Operations CostsIf additional work has to be done in order to make up for lost time, then operating costs, such as utility costs, are likely to increase. These expenses are separate from labor and have more to do with keeping the company open longer or working at a higher capacity. What costs are relevant, and to what degree they impact the organization, is dependent upon the specific system that is down and its function within the business.

32. Info-Tech Research GroupThere are three stages in DR Scoping; each is driven by a different group of stakeholdersStep 1: Assess Current IT CapabilitiesPrior to creating DR capabilities, know what degree of DR capability IT currently has.

33. Know when IT can bring systems back online and to what point IT can recover data.

34. Understand the infrastructure that is currently used to support recovery abilities.

35. Once you know what resources IT currently has, it’s easier to identify potential areas that should be developed or cut in later steps.Step 2: Establish and Validate the Business’ WantsThe business side needs to be able to define when it wants systems back online and to what point it wants data recovered.

36. The validity of these wants can be established by asking these questions:

37. What systems are most important to the business?

38. Are there manual processes which can temporarily replace these systems?

39. How much does downtime cost the business? Step 3: Aligning IT’s Capabilities and the Business NeedsEnsure that what IT provides and what the business side wants are aligned.