Selection Recovery Site of Location in Business Continuity

While there are a number of important considerations to take into account when planning your business continuity efforts, the one we hear about time and again is how much distance is really necessary between the main work site and a disaster recovery site.

Serious business interruptions are now measured in minutes rather than hours.

Because electronic transactions and communications take place so quickly, the amount of work and business lost in an hour far exceeds the toll of previous decades. In the words of the Disaster Recovery, there is no rule of thumb when it comes to the appropriate distance between your data center and your recovery site.

Between 2007 and 2010, however, the average distance between a primary data center and its furthest backup data center seemed to shrink the majority of surveyed companies that had disaster recovery sites appeared comfortable with distances of less than 100 miles, and many were comfortable with distances of less than 25 miles.

Nonetheless, the components of integrated business continuity are the same: recovery options for facilities, technology, network infrastructure and human skills. However, the key to business continuity lies in understanding one’s business and determining which processes are critical to staying in that business and identifying all the elements crucial to those processes — specialized skills and knowledge, physical facilities, training and employee satisfaction as well as information technology.

If you are thinking about a secondary disaster recovery site for your business data, take the following questions into consideration:

Is there enough distance between your main site and your disaster recovery site to escape the same set of threats?

If your business is in the line of fire of hurricanes, for example, then you will want to look for a recovery site that is more than 100 miles away from your main site this should prevent a hurricane event from taking out both your main site and your recovery site. So, the decision is obviously left to the companies themselves — and such decisions cannot be made based on someone’s feeling, but on a study.

A Risk Assessment that involves identifying a potential risk event, assessing the likelihood of the event occurring, and defining the severity of the event’s consequences.

Risks could be anything from a power outage or hardware failure to a tornado or flood. Here are the factors that tend to push the location further away:

Earthquakes — if your location is in a seismic-sensitive area

Floods — you should position an alternative site out of the same flood plain

Tsunamis — you shouldn’t place both primary and secondary location on the coast of an ocean

Other natural disasters — e.g. forest fires, tornados/hurricanes,volcanos — if your primary site is close to such areas,

the disaster recovery site should be further away Large industrial facilities, nuclear power plants, or military installations — again,

at least one of your locations should be at a safe distance Dependence on the same source of electrical power.

you should look for locations on a different power grid pandemic diseases — in such cases, authorities will likely close the whole metropolitan area.

However, there are some factors that force you to position a disaster recovery location as close as possible:

Telecommunication links — the further the sites are away, the more difficult it becomes (i.e. more costly) to replicate the data between these sites.

If your employees are expected to travel to an alternative site in case of disaster — they have to be able to make it within the RTO (Recovery Time Objective); besides, the road between the sites shouldn’t be full of bridges and tunnels.

The goal for companies with no business tolerance for downtime is to achieve a state of business continuity, where critical systems and networks are available no matter what happens. This means thinking proactively; engineering availability, security and reliability into business processes from the outset — not retrofitting a disaster recovery plan to accommodate ongoing business requirements.

For all the sophisticated technologies available today, according to analyst reports,approximately 75 percent of the world’s data is still protected from copying it to magnetic tape and shipping it off to some secure off-site storage. At its most basic level, choosing the right disaster recovery technology is a business decision. As a result, before IT departments can decide on a disaster recovery technology, they have to establish the business priorities and objectives that the technology will be required to meet.

This step can be one of the most challenging for IT because it involves reaching across the aisle to the business side.“Immediately” and “none” are the two most common answers from department heads when asked how fast data needs to be recovered (RTO) and how much data they can afford to lose(RPO).

At its most basic level, choosing the right disaster recovery technology is a business decision.

Establishing appropriate, realistic and affordable RTO and RPO levels needs to be negotiated between the IT department and business leaders. It’s often a balancing act. Having an outside,unbiased business continuity planner present during these discussions helps them proceed to mutually acceptable conclusion.

When recovering data or systems across a significant distance, slower recovery times and bandwidth costs can negatively impact business continuity goals.

When answering the question of how far away a DR site should be from the primary site, then, it’s a matter of mitigating shared risks, not measuring miles.

By Chintan prajapati on September 26, 2015.

Canonical link