As I write this article, Hurricane Sandy has just hit land in New Jersey, whipping up winds of 90 MPH and dropping what could be close to a foot of rain in the mid-Atlantic region of the United States. With family and friends in the area, I obviously wish them well. However, I also wish well those organizations that will surely be impacted by what weathercasters are calling the Frankenstorm and hope that they can weather the impact.

Although this advice may hit a little too late to help those being impacted by Sandy, it seems like a good time to discuss four best practices when it comes to ensuring continuity of your business. This article goes well with another one that I wrote a while back, entitled Five points to consider when building disaster recovery plans.

Geography matters

Hurricane Sandy stretches out for hundreds of miles in every direction. It truly is a monster storm. As you’re considering disaster recovery and business continuity plans, carefully consider the kinds of disasters that could befall your business. The East Coast is certainly getting a lesson in geographical redundancy this week!

Where I live in Missouri, we have to worry about a couple of different kinds of natural disasters. Tornadoes, while truly terrible, don’t have the widespread impact of a hurricane, but they also have much less warning and can cause much greater localized destruction. We also have to be concerned about the New Madrid fault, which has erupted before and will erupt again, resulting in a major earthquake that could make what California receives look weak.

Whatever happens in your local area, ensure that your business continuity plans include enough geographical diversity that you don’t suffer an outage of both production and DR sites from the same event.

Focus on what’s important

Some DR plans fail simply because an organization believes that everything is critical. Not every system needs to be fully represented in these kinds of efforts. For example, if your primary site is completely destroyed, do you really need your physical plant work order system to be up and running in an expensive DR site?

As a part of your business continuity planning efforts, make sure you perform a business impact analysis for your various services. Only those services that are truly critical need to be represented in a DR site. Of course, this doesn’t mean that you don’t continue to back up systems that aren’t installed in the DR site. Those systems will still need to be restored once you’re back in operation.

One size may not fit all

In the same way that not all services need to be placed in DR, even those systems that are placed into DR may have different levels of capability. The closer you get to real-time, ongoing synchronization from production to DR, the greater the expense and complexity.

Perhaps not every single system needs to be real-time. Your sales processing system, for example, may be one that you simply must have operational 100% of the time. However, perhaps it’s sufficient for your email system to synchronize only every half hour.

Again, your business impact analysis will make it evident which systems absolutely must be in DR and which must be close to real-time. For others, the BIA will tell you that the system needs to be in DR but doesn’t need to be real-time.

Make sure everyone knows his roles

I’ve been a part of a number of tabletop exercises in which organizations simulate a disaster. Of course, during those simulations, everyone has printed copies of the DR guides and the key players are always in the room.

How often does that happen in real life? With a hurricane, there may be some notice, but for other disasters, the outcomes may be immediate and not allow an organization time to test and plan. As such, keep doing those tabletops, but make sure to include some surprises, such as:

• Not sticking to the “plan” for what happens during a particular kind of disaster.
• ”Forget” to invite a key person to the meeting.
• Put dead batteries in some of the communications devices.

Of course, these items are for more full-blown disaster planning needs, not just failing over to a DR site, but it’s important that people and adjust and adapt when the real thing hits.

Action Item: In summary, CIOs need to focus on what’s truly to the business when it comes to continuity. Not everything needs to be protected at the same level. Further, ensure that your plan includes enough geographic redundancy that your business isn’t impacted by a Sandy-like event.

Footnotes: