How to keep your business systems above water

Around 37% of all businesses do not have a disaster recovery (DR) plan, according to research among SMEs by telecoms provider Cable & Wireless. It's a remarkable percentage: if fire or flood hits a business it'll lose money every hour its systems are down – and the long term effect can be fatal. Think of this: according to Government figures, nine out of 10 businesses that lose data in a major incident don't survive another two years. The research should be a wake up call, says Mark Hanvey, Cable & Wireless' chief security officer. "With business continuity, it pays to be pessimistic: whilst large enterprises are more aware of the risks, SMEs need to wake up and make preparations fast," he warns. Manufacturers make things that customers expect to be delivered according to schedule, and if you lose your ability to manufacture, two things will happen, says Mike Osbourne, operations director at DR services provider, ICM. "Customers will call to find out what's happening with their orders, and competitors will phone your customers to try and step in." So what are you going to do? From an IT perspective you could bring in a mobile data centre – a mirror of your key computing hardware and software in a trailer from a DR provider. Above all though, you need a DR plan, and the most basic element of that is to have some means of replicating data off site. Returning to that Cable & Wireless research – which shows an astonishing 38% of companies don't even back up their data or only keep data at their main office – this is fundamental. This simplest form of DR provision saved Birmingham pressings company AE Harris in 1990 when a fire destroyed part of its factory and half of its offices. The firm – which employs 80 people and runs Exel Efacs ERP software on Unix machines – was able to get staff working almost straight away, says finance director John Patterson. "The most important thing was keeping the customer happy, so orders due out were the priority. We have printouts done two or three times a week so we always know what needs to be done that day, plus we back up all our data to tapes which are taken off site every night," he says. What lessons did Patterson learn? "Back your files up and do it to a religiously strict discipline. For example, if you put the tape in the machine, make sure you do actually load the data from it," he says. Another approach is off-site data mirroring. South Wales door and window manufacturer Therma Tru has 60 seats of remotely-run Syteline (formerly Frontstep, then Mapics, now Infor Global Solutions) ERP running stock records and financials on IBM hardware. In the process of rationalising a once-chaotic IT system it outsourced the lot to Wasp IT and got DR provision thrown in – including remote mirroring. "We had the traditional SME IT problem of software licences all over the place, a crazy variety of hardware and our DR provision amounted to a server under the desk," explains finance director Huw Edwards. "We knew we needed to do something, and outsourcing seemed a no-brainer. Wasp has two mirrored data centres so if the building went down we'd just need to get more PCs and draw down data from there. This gives us far greater protection than having our own data room." But while backing-up data is a key element of the DR plan, it is only part of the process you need to go through to get working again. There are five stages to ensure you can get up and running if disaster should strike: developing a plan, rating the importance of your assets, generating milestones towards recovery, testing the plan, and updating the plan. Just do it Developing a plan may seem self evident, but as we've seen, plenty of businesses don't have one. What puts people off is thinking that it needs to be a massive document. It doesn't, says ICM's Osbourne. "Better to have a basic DR plan of two or three pages and improve that, than the best plan ever and never finish it." The point is that developing a DR plan can't be put off: you never know when disaster may hit, and it'll be too late too think about it once it happens. So don't wait until everyone has time to deal with it but try to get as many functional areas of the business represented as possible in drawing it up. Next, you need to rate the importance of your IT assets in the DR plan. Worth looking at electrical products manufacturer Electrium for this. It has three sites in the midlands and north west, and runs SSA's PRMS ERP software on an IBM iSeries, along with five NT4 servers for documents, email and file and print. If its systems go down it loses around £200,000 a day. Phil Robertshaw, IT manager, is clear. "If one of our PC servers went down it would not be as important as the iSeries going down," he says. "So, in our DR plan we cover the iSeries and three of the five PC servers, using a mobile data centre from ICM. We don't need all the back-up straight away. Document management and analytics applications are not as important as email, which is the way our customers send orders to us." Testing is the next DR plank. Try to arrange the test so it reproduces likely conditions as far as possible. Make sure those people who would be responsible for elements of the plan take part and record the results so you can see how to improve. Electrium has had to invoke its DR plan twice in recent years. On the first occasion the power supply to the iSeries server failed on a Sunday evening and the UPS kicked in for around half an hour while the server shut itself down safely. Unfortunately, when booting back up a mechanical failure resulted in loss of data. A few months later the Windows email server became overloaded, shut itself down and failed to start again. On both occasions Robertshaw called ICM and put it on standby. His people were working to get their systems back up but the call made sure the DR provider was ready to roll, and in both cases the ICM mobile data centre was plugged into Electrium's systems and everything was back to normal within 24 hours. These incidents taught Robertshaw some key lessons: namely, make sure your DR plan is in place and always ready for action. Also, don't expect tests to entirely replicate real experience. "When you have to invoke the plan you're flying by the seat of your pants and under a lot of pressure," observes Robertshaw. Finally, make sure you maintain and update your DR plan. IT systems change and the plan needs to change to reflect that. Have one person take responsibility for updating the plan and ensure all changes are also tested. Disaster will never strike most businesses, but if it does a well-thought out and tested plan of action could save a lot of lost business.