june 6

Disaster recovery testing is sorely missing
For a plan to be relevant, it needs to be maintained and updated
Computerworld Opinion by GlassHouse CTO, Jim Damoulakis

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName
=data_center&articleId=9023739&taxonomyId=52&intsrc=kc_feat

Still not testing DR? Lot's of luck.

There is no question that over the past few years business continuity and disaster recovery have gained greater visibility within organizations. This is reflected in a recently released study of business continuity practices in U.S. cities conducted by AT&T, which surveyed 1,000 IT executives at companies in 10 metropolitan areas across the country. Much of the news coverage on this has focused on how well the various cities fared in the overall rankings (see  "First to worst: IT survey ranks 10 U.S. cities for disaster preparedness"). In short, New York came out on top and poor Cleveland placed last.

However, a little-noticed area of the study that sparked my interest was the part that addressed planning and testing, traditionally among the most difficult aspects of business continuity and disaster recovery. When asked "Does your organization have a business continuity plan?" 72% of those polled responded affirmatively (actually a hair less than last year's 73%).

While it is encouraging that a solid majority of the companies studied have in place, the real challenge is maintaining the plan and ensuring that the organization is prepared to execute it. In this regard, the results are not so positive. Only 57% said they have updated their plans in the past 12 months. At first glance this might appear to be a high number, but it's hard to imagine any sizable organization that has not made changes to its IT infrastructure in the past 12 months. For a plan to be relevant, it needs to be maintained and updated on a regular basis. Ideally this should be a continual process with DR considerations baked into infrastructure change management process. At the business continuity level, an annual review would be a minimum threshold.

More disturbing, in response to the question "When was the plan last tested?" only 41% of those polled said they had done so within the past year. DR testing uncovers a myriad of unforeseen problems and, practically speaking, is the most important part of the preparedness process.
 
An oft-repeated saying amongst strategists and planners (as well as life insurance salespeople) is "if you fail to plan, you plan to fail." When it comes to BC/DR activities, where people are expected to perform out-of-band, nonstandard activities under potentially the worst possible circumstances, it can be amended to say "if you fail to test, the odds are you will fail."

Jim Damoulakis is chief technology officer of GlassHouse Technologies Inc. , a leading provider of independent storage services. He can be reached at jimd@glasshouse.com.