But what about the rest of us?

In reaction to recent events, it would be very easy for the average manager going about his or her day-to-day activities to become swept up in a frenzy of disaster recovery planning.  But before their knowledge of the organization is put to work, it is worth remembering that for many of us there are always a number of questions that are left hanging as we set about the task of creating and implementing a complete and successful Business Continuity Plan.

Too many companies think of disaster recovery as primarily if not solely as a technical issue.  It is that of course - but it is also very much more, if it is to be entirely successful the next time a crisis occurs.  Murphy's Law applies here, in that if your plan is perfectly designed to deal with everything except a flood, you can almost be assured that it will be a flood that hits you first.  Take a few moments, even add a little humor to the discussion, and try to name every conceivable disaster that might occur, from frozen toilet waste hitting your car park as everyone is leaving work, to lightning hitting your CEO on the golf course - and make sure you have considered what you would do.  As indicated above, the only disaster that will ever put you out of business completely is the one you never considered and planned reactive steps should it occur.

The real and only goal is to continue the business, with as little disruption as possible, whatever happens. This involves people as much as technology; and even the technical decisions require careful planning so that even the preparedness exercise and preparations do not disrupt everyday operations.

The first step is to know what really keeps your business running. What data is critical and needs to be restored immediately, such as an online transaction database, and what can be stored off-site, such as an email archives? Who are the key people who need to be notified and brought in at a moment’s notice? Who are their backups?

Consider every step your business takes from sourcing raw materials right through the process to collecting payment.

One expert points out that a business can be equally interrupted by an all-out disaster such as an earthquake, a malicious incident like a computer virus or hacker attack … or simply by a human error that corrupts a crucial database.  Come to that, a breakdown in delivery that you do not even control can do as much damage to the smooth operation of your business as a disgruntled employee taking a pick axe and attacking equipment - if you consider the whole process.  

Remember also that the vast majority of events that bring down information systems fall in the category of human mistakes, often unintentional, and having a rapid recovery system in place can keep the business going.

After you know what data is critical and get management buy-in to protecting that asset, you want to determine how to back up and restore the information as quick as possible. Technologies include real-time data mirroring (making a copy on a separate set of local hard drives, such as in a RAID array), doing a continuous backup to a remote server or taking a system snapshot at regular intervals.  So your data is only as good as the latest backup if anything unexpected corrupts it.

At a minimum, you’ll want to make daily backups and store them on a removable medium such as tape, which can be taken offsite for protection.  Determine in advance how soon you would need that data back in the event of an emergency and plan accordingly.

The various technologies can also be combined to provide a comprehensive recovery strategy. Different approaches work best for different applications. For example, data mirroring is important for applications that keep files open all the time, such as a database or a Web server, while tape backup can archive business documents.

However, disaster recovery shouldn’t become so obsessive a goal that it is ever allowed to actually disrupt business. It is all a matter of balance.  Doing backups increases network traffic and thus degrades performance. Therefore, every organization needs to inventory its existing information infrastructure - storage devices, network bandwidth, servers and applications - then tailor the backup system to match. If the system can’t handle the increased load, perhaps it’s time to upgrade the network.

Another key area to consider is the ability to quickly recover stored data. Can the tapes be read after the backup? More basically, can you get to the tapes in a timely manner … even in the middle of a snowstorm or if the local authorities will not allow you to enter unsafe offices?

Published comparison charts usually rate backup applications on their ability to back up files, but rarely test the ease of restoring a particular set of files. That’s why some companies regularly perform “bare metal” restorations on test servers, just to be sure that it can be done successfully with the latest backup tapes.

Ultimately though, the decision always comes down to how many people you can dedicate to a disaster recovery program and how much money you are willing to spend on it. In a small company, it probably makes sense to outsource the program, either completely to a service firm or partially by having a consultant set up the recovery system and train your people to keep it going. Prices vary, and so does the ability to do the job effectively.

Whatever your chosen solution, the most important thing is to actually do it. Very few businesses survive a data disaster unless they have a functioning backup and restore plan.