W3 Discussion Comments

INSURANCE: Many of you were surprised that companies were not better prepared for disasters. The preparation can be very costly. Also, the preparation can be next to useless if recovery procedures are not tested periodically. This testing can also be expensive. Sometimes business look at this expense and make a bad calculation on risk vs. reward. Your comments that Disaster Recovery investments are like insurance policies are well taken. Sometimes people may not purchase Health Care or Long Term Disability insurance because they are betting that they can do this later before disaster strikes.

WAR STORY: I once worked for a small company where the owner's attitude was "I'm going to sell the company before a disaster can occur". (We bought tapes, backed up critical data and rotated the tapes to our homes. None of us wanted to redo our work in the event of a disaster.)

Amanda Hauser mentioned that selling the CFO can be difficult. This has been my experience as well. I like to as the question "How will your department run if you cannot access the company's computers for three to six weeks". When he/she says "That's unacceptable', you can say "Let's talk about how to keep that from happening". You have to time this carefully and know the personality of the CFO/Owner.

TRADE-OFFS: Brian Fredericks suggested that DR is a process not a project and that there should be an estimated time to recovery on each resource. I agree and estimating the time to recovery helps management understand the trade-off between cost and recovery time. Having servers off-site ready to go allows for a quicker recovery. This is expensive in terms of initial investment and requires that data and programs be frequently replicated to the "hot backup" site. It is a business decision to determine how to balance costs vs. the business needed for a quick recovery. For example, Could Dominican survive a one-week outage? (I would say yes). Could the Chicago Mercantile Exchange survive a one-week outage? (I would say they would never recover their reputation and lost business).

LOGISTICS: I agree with the comment that the DR plan should be distributed to the appropriate people in both paper and electronic form. The electronic version might become accessible during the disaster. Many of you also identified the critical need to backup data and store it off-site. Some of you thought about backing up software as well. What about passwords and procedures? What if the only person that knows the administrative password is lost injured in the fire?

DOMINICAN: Several of you suggested converting staff and professors from desktops to laptops. Although I would be happy if Dominican bought me a laptop, it might be better just to convince professors to backup files to the faculty drive on the network. This is backed up by IT and would meet the Disaster Recovery requirement. Laptops are more easily lost or stolen. Using laptops outside Dominican and then brining them back could introduce viruses to the Dominican Network.

An outside consultant can provide technical and project management help but you cannot delegate the Disaster Recovery planning to the outside consultant. A very important part of the planning is making the decisions that trade off cost vs. time to recover and the consultant should not be the person doing this.

Several of your suggested asking the professors to perform backups. Having worked at a college data center I can say that it is difficult to get professors to follow instructions. A good marketing campaign would be required.

Some of you assumed that no backups were currently being made. (The Discussion Questions probably encouraged you to make this assumption) I would want to consider the approach proposed by Merritt Poole. That is, find out what had already been done, figure out what needs immediate protection. He identified this as a Business Impact Analysis. This analysis might show that a workable plan is already in place. Note: If you had to develop a Disaster Recovery Plan to deal with a major fire in Lewis, you would have to consider records stored in various offices as well as recovering the phone system.

CONSULTING: Based on your responses, I should increase my scope of my consulting practice to include Disaster Recovery. Those of you who want someone to sue if something goes wrong would not hire me because I do not have enough assets to make a lawsuit worthwhile. (Seriously, I would not do this because doing database design and building applications to use the data is more fun ) Evaluate all web sites carefully. Some are just sites designed to "scare" you into hiring a particular consultant. In fact, it appears that a number of different consultants are using the same "scare" stories.

WAR STORY : I had a client in Houston that had the following line in their Disaster Recovery Procedures: "Carry the tapes from the tape library to the second floor starting with the lowest shelf first." The "starting with the lowest shelf first" made me think that they had dealt with water problems previously.