Disaster Recovery Experts Speak Out (continued) 3

Re: What about ROI?
by Jason Buffington (08-Nov-01 4:05 AM GMT)

I think the real question comes back as "what is your data worth?" The best metrics are RTO and RPO. RTO (Recovery Time Objective) is how long until you are up again. RPO (Recovery Point Objective) is where is the data, once you are up. D/R budgets should really be based on how much money can you afford to lose, based on those metrics. For example, if D/R is strictly restoring from tape and the outage is at 4PM - what is the $$$ of lost productivity for 7 business hours (hint - Gartner estimated $39/hour/person).

So ... if you have 100 employees and worst case between backups is one day. An outage after half of one business day (half = so that sometimes it might be at the beginning and sometimes at the close of business) would be 4 hours times 100 employees times $39 (estimated) = $15,600.

So, any solution that can be amortized over a year (the average amount of time that some level of significantly impacting outage might occur) but costs less than $15,600 is probably worth it. For example, you wouldn't pay $500 per month for a $5000 insurance policy. You might pay $100 per month, depending on the risk. You would definitely pay $15 per month. One outage every 34 months would pay for itself. So, understand your exposure - and work backwards for ROI.

Interesting side note: Someone once measured businesses impacted by the first World Trade Center bombing and a California Earth Quake. "Small to Medium" businesses (under 500 users on site) experienced a 50% rate of going out of business if they could not get to their data. LESSON: D/R is actually more important for small/medium businesses - since they are more volatile to any changes in their operating model.

Re: One vendor? or several?
by Melissa Stockman (05-Nov-01 1:06 PM GMT)

One or two vendors is definitely the way to go. In house skills can be honed on specific OSs rather than scattered across the board in a 'jack-of-all trades' ball of confusion.

Re: One vendor? or several?
by Dee (07-Nov-01 7:17 PM GMT)

Best to go with a couple of vendors. Maybe one for a hot site, then another for drop-shipping other equipment like PCs and servers to a pre-determined facility or another alternate site (should have two of these too!). I do not know of anyone who has two hot site vendors, though. But having a combination recovery strategy of using a hot site, alternate site (place for business units), and using some drop ship for PCs and servers at that alternate site is a good start. This really all depends on your company's recovery requirements. How much is really critical? Usually the best way to start is with the BIA, then look at recovery strategies options based on the outcome of the BIA. Pick an option and go from there...

Re: One vendor? or several?
by Jason Buffington (08-Nov-01 4:02 AM GMT)

I love "one stop shopping" like Super Walmart's and SAM's - because they are convenient as heck! BUT ... You have to go back to the idea that D/R is more than just PC's or data. It's the people - which no outside vendor can manage for.

SO ... You will inevitably have a hardware vendor for the PC's (quick ship), the hardware vendor that you already use for the servers (if you use a real-time solution), the software vendor of the replication solution, perhaps vendors for the tape hardware and software.

And you will still need a consultant or other area of expertise on the people and processes. I think the key to remember that no company has as much as stake during your disaster as you do. So, take ownership of your future - and pick the best that you can. All the while insisting that the various vendors communicate between themselves to ensure compatibility for you and your needs.

P.S. I still build my own PC's out of "best of breed" components. Yes, there are occasional incompatibilities and hiccups - but I also know that every piece of my "solution" meets my specific needs the best.