Why Develop a Strategy?

Obtain "Buy in" from Others

You do not want to be the only one pulling on the oars in this boat.
Assess and document risks and vulnerabilities, especially those that are external.
Analyze impact of IT outage on operating units; measure and state the cost to each unit; document it; gain agreement from each unit's manager; present to senior management for executive sponsorship of further action.

Document Goals & Objectives

Senior management will not fund the program unless it supports the mission of the organization.
IT Continuity Strategy must have goals & objectives that contribute to the organization's success.
IT continuity objectives can help to set expectations among "user" departments & senior management.
It is important to develop linkages with "user" department continuity plans.
This is a 2 way street; use documentation to gain agreement.

Gain Agreement on Justification for Investment

There is a price tag on achieving the goals and objectives.
Balance the price against the costs that the organization would incur due to an emergency or disaster.
The earlier "Buy in" from users and management should support the costs.
Senior management must commit funding based on this justification so that one of the strategy options can be selected and implemented.
Executive sponsorship is critical.

Maximize Value Received -- 1

Assumption: a strategy has been developed and adopted; it requires at least some vendor-provided service.

You must implement the strategy for IT.

Learn about the various service providers.
Understand the offerings and how they fit your needs.
Differentiate among the choices.
Negotiate an agreement.
Use the agreement as part of your strategy.
Maintain currency with the changing business needs.

Maximize Value Received -- 2

Two categories of service providers: "Full Service/General Purpose" and "Niche."

"Full Service/General Purpose:" IBM, SunGard & maybe HP.
"Niche:" everybody else.

Providing the ability and framework for periodic testing and recovery exercises is key.

The more relevant functions that a single provider (along with its subcontractors and partners) can deliver the better it is for the client.

Maximize Value Received -- 3

Differentiate among the choices.

Pin down meanings of key terminology.

Hot site/warm site/cold site/etc -- these can mean different things to different people.

Stated responsibilities are critical.

Commitments are vital.

What is provided at time of disaster? (It's not necessarily what you think it is).

How long does the agreement last? (The term might extend if you make changes to the covered configuration.)

Maximize Value Received -- 4

� How is the price determined?

Technical specifications for system configuration and network connectivity.
Amount of annual test time included in the subscription.
Length of the agreement (the longer the agreement, the lower the monthly charges).
Service commitments that are included, especially on what is delivered upon disaster declaration.
Resemblance to "standard" terms and conditions.
Shared use/shared cost.

Maximize Value Received -- 5

If it helps, do things in stages.

For a single IT platform, start with only the critical portions.
For multiple platforms, start with covering those that are most critical.
Bring more on over time.
Build on success of first stage.

Watch out for moving End Date due to additions or changes.

"Standard" Ts and Cs might cause this to happen.
But it doesn't have to be this way.

Maximize Value Received -- 6

How is the price determined?

Technical specifications for system configuration and network connectivity.
Amount of annual test time included in the subscription.
Length of the agreement (the longer the agreement, the lower the monthly charges).
Service commitments that are included, especially on what is delivered upon disaster declaration.
Resemblance to "standard" terms and conditions.
Shared use/shared cost.

Bundle in extra vendor support servicesHot site service provider has staff who can load recovery media and restore systems.

Use remote operations; be prepared to do it from various locations, with hot site provider's involvement.

Understand service provider's staffing and support structure so you know how much attention you can expect.

Let us Review . . .

Gain agreement and support from the affected parties.
Analyze impacts on the organization of emergency IT outages.
Measure and quantify the costs of lost business.
Develop strategy and plans to support the business.
Educate yourself on outside services available and get as much help as you can for whatever you pay.
Just because a service looks the same from multiple providers doesn't mean that it is the same.
Get it all on paper! (And read the FINE PRINT!)

Garry Herron is a Fellow of the Business Forum Institute, and is President and founder of Advanced Technology Solutions (ATS), a California small business specializing in disaster recovery and business continuity design, planning and preparations. He and his firm have provided requirements reviews, planning guidance and operational solutions to help numerous companies and governments in the development and implementation of disaster recovery and business continuity preparations. Prior to forming ATS, Garry was a career IBM professional with expertise in sales, management and consulting. A highlight of that career was leading the IBM Western Region Business Recovery Services team in its support of clients� recovery actions after the January 1994 Northridge earthquake in Los Angeles. Garry holds an MBA degree from the Anderson School of Management at UCLA, and a Bachelor�s degree in Mathematics and Computer Science.