Earthquakes, floods, and hurricanes. Mother Nature has cruelly reminded us again this year that the Nearshore region runs the risk of natural disaster. Obviously anyone doing business in a meteorological danger zone has to think strenuously about their provider’s ability to recover from a disaster and maintain business continuity. Or maybe it’s not obvious.
Andrew Fazio, director of commercial sales at Flow, a telco/cable/Internet provider and data center operator based in Jamaica, told us that clients aren’t always aware of all the issues or ramifications connected to disaster recovery.
“Business continuity is a hot topic for us, and it’s in the forefront of our thoughts during hurricane season. But when we speak to clients about it, we find that they don’t always realize what’s involved,” Fazio said. “It takes up more discussion time than any of our other services because it hasn’t received enough attention, and people don’t always appreciate the effects of lost data.”
Such as: “Forty percent of all companies that experience a major disaster will go out of business if they cannot gain access to their data within 24 hours,” Gartner says.
Ask this during the pursuit phase: “Show us specifically how you will keep things running during a disaster.” And the particulars need to be detailed in the contract.
Here are some crucial elements that should be part of your discussion with an outsourcing provider and should be part of their recovery and continuity practices:
Risk analysis. What are the threats, and what are their potential costs? Knowing there’s a hurricane season is one thing, but getting details for the season approaching is what matters. At Flow, staffers meet with members of the Office of Disaster Preparedness and Emergency Management, as well as experts from the Meteorological Service, to get the lowdown on what might lie ahead.
The perfect partner would have a fully functional replica of your system ready to go, so that operations can be restored instantly.
A DR planning team. This should consist of the savviest IT people, at least one ultra-techie who knows how everything works, an operations person who knows how everything runs, and someone from the business side who understands business functions — and the company pessimist. At Flow, one person is dedicated to safety and disaster preparations, Fazio told us. This team should shape policies and procedures.
A DR action team. Does the provider have people who know data replication? Do they have certified DR engineers? Application and database specialists? Have any been tested by real disasters?
The IT plan. A well-designed configuration can go a long way toward averting disaster. Your provider should have a map that details every nook and cranny of their IT universe. Explore it. Ask them to explain how they achieve redundancy for every single essential item. How do they maintain high availability? Ask what happens if that power supply blows out or that backup server goes down. What’s the backup schedule? If their idea of backup is simply storing tape in another location, look for a different partner.
Ask about automation. “Data center automation is the point of doing things on a computer,” says Dana French, president of Mt Xia, a tech consulting company specializing in data recovery, business continuity, and design of very large data centers. “There’s a tendency with offshore resources to build systems that are managed on an interactive basis, whereas the goal in a business continuity environment is to build functions and systems to manage themselves.”
The battle plan. Of course they have a plan. But make sure it spells out who does what when, and spells that out for every possible scenario. Backed up with contingency plans, like who does what if X is out sick. You know that scene in the movies where one guy says “We better go to Plan B” and the other guy says “We don’t have a Plan B”? That’s seldom funny in real life.
Practice drills. The plan and all related procedures need to be tested. Ask your provider if they’ve simulated a severe power outage or server crash. Have they pretended to have an earthquake? Ask them what happened and what they learned.
Defined recovery points. The SLA needs to specify recovery point objectives (age of files that must be recovered to resume normal operations) and recovery time objectives. Specifics relating to redundancy and availability also need to be negotiated and included in the contract.
Hotsite. The perfect partner would have a fully functional replica of your system ready to go, so that operations can be restored instantly.
Ideally, a provider is able to keep your assets out of harm’s way. What Flow does is offer clients the option of colocation services in Curacao, “out of the hurricane zone and earthquake belt,” Fazio said. The company has its own fibre connection to its facilities on the Dutch island in the southern Caribbean.
Ultimately, French says, you and your provider need to look at things from the standpoint of business functions rather than system functions. “The big question should be how do I ensure that my business functions are running rather than my computers running,” he says.
“What I have found,” says French, who has outsourced projects to Mexico and Poland, “is that providers are more intent on tasks associated with the system rather than with business functions. They will perform that task as quickly as they can, and turn it over as quickly as they can, but they will not necessarily consider how that task ties into the business continuity environment. They end up retrofitting business continuity rather than building it in from scratch.”
Finally, when considering a provider, “concentrate on their understanding of business continuity principles and practices,” French says. “Have them explain their understanding of BC. Ask them to define it and what it means in terms of the services they provide. Ten people will give you 15 different definitions of business continuity. Pick the one that matches what you think.”