Recovery Strategy Selection Criteria

When selecting an appropriate business recovery or continuity strategy several criteria should be met – they include:

• The recovery strategy selected must satisfy the key recovery requirements

• The recovery strategy must be cost effective and justified, and must be deemed as an appropriate cost of conducting business

• The recovery strategy must be currently viable and must have the ability to be upgraded to suitable levels, should technology and/or business changes or enhancements be made to the business

A Business Continuity Plan (BCP) or Disaster Recovery Plan (DRP) will need to be developed, documented and maintained to ensure that the chosen disaster recovery strategy can be readily actioned.

The BCP/DRP should enable the resumption of critical business processes at an alternate location within a time period approved by  senior management.

Recovery Time Objective

To select an appropriate disaster recovery strategy you will need to confirm an appropriate Recovery Time Objective (RTO) - See Impact Analysis.

The challenge associated with selecting an RTO is balancing the potential impacts and costs of a disaster versus the costs of the recovery strategy. In general, as the RTO decreases the associated recovery costs increase – As complexity increases, so does cost.

In-House Recovery Centre

When your company relies on computing and phone systems for business critical operations, keeping the system up and running is essential.

Just about nothing is more catastrophic to a business than an unexpected system outage.

As managers create business recovery strategies to protect their businesses from such events, they may consider setting up an in-house recovery centre, or ‘hot site’. The benefit of this approach is complete control over the recovery environment. But that option can be expensive and complex to manage.

Using a commercial hot site may provide more flexibility and is normally a more cost-effective solution.  Companies often find it takes more time and money to build this kind of centre than allowed for. In addition to the obvious costs, such as the purchase of redundant systems for use in recovery, operating a hot site entails many hidden hardware, software, staff and support costs.

Of all the recovery options, in-house recovery is generally considered the most expensive.

Example potential hidden costs:

• Hardware purchase.

• Hardware maintenance.

• Software costs, an important component of the business recovery budget, are often underestimated by companies setting up an internal hot site.

• Space. Raised-floor and general office space costs vary considerably.

• Environment. Generators are a necessity, and an UPS (un-interruptible power source) is highly recommended.

• Staff. Hot sites need people to do the work of recovering systems.

• Data communications. Recovering the computer systems themselves has no effect on recovering the business if users cannot access the data.

COMMERCIAL HOT SITE STRATEGY - DEDICATED

This strategy provides a high level of recovery capability with minimal downtime. This consists of having a dedicated disaster recovery equipment and site, which can be activated upon demand in the event of a disaster.

This strategy will enable the recovery of a critical function or system that has a Recovery Time Objective (RTO) less than 24-hours.

To provide justification for this type of solution it is recommended that a Business Impact Analysis (BIA) be conducted. A BIA provides the information on the possible impacts of interruptions of critical business functions, and will provide an accurate RTO for the systems and critical business processes in question

COMMERCIAL WARM SITE STRATEGY - SHARED

A shared warm site facility is generally considered the most cost effective way of providing a disaster recovery capability.

A shared recovery site is one that is utilized by several companies in diverse geographic locations, and thus the costs are distributed across the client base. Recovery timeframes are increased over the dedicated facility due to the need to reconfigure the shared infrastructure.

The establishment of this type of recovery strategy requires extensive planning to determine, first, what is the required RTO and second, what configuration will be required to accomplish that RTO.

COLD SITE STRATEGY

The cold site strategy entails providing a shell work space or a computer room facility without any computing equipment installed, in which the recovery of the technology systems can be accomplished.

The cold site will normally have the entire required infrastructure in place such as raised floor for IT equipment, environmental controls, power distribution and communications. It is generally accepted that it may take several weeks to activate a cold site facility depending upon the requirements. It will then take several more days to bring any restored systems to the desired state for use.

Next Process - Creating Your Business Continuity Plan