Posts Tagged :

disaster recovery

Continuity Planning: What the office really means to businesses

960 640 Guest Blog

Dr Sandra Bell, Head of Resilience Consulting, Sungard Availability Services

In spite of best intentions, protective measures, vigilance and forward planning, organisations will always be at risk of losing their workplace due to reasons such as fire, flood, extreme weather, or structural collapse. Likewise, even if the fabric of the buildings themselves are serviceable, access may be denied due to contamination, lack of power or water or being within a police cordon following a terrorist incident.

Regardless of what caused the issue, the result is the same – the loss of a normal place of work. It may be for just a few hours in the case of a utility outage or it may be for many months, or even indefinitely, for more severe incidents. However, what does “losing your workplace” actually mean for an organisation, and what is the best thing to do about it? 

The cost of workplace office loss to an organisation

The true cost of losing a workplace office is always greater than the actual physical loss. The loss not only means that you can’t meet the physiological and security needs of your workers to enable them to do the work that you pay them for which causes immediate operational disruption.  Butut you can also no longer coordinate and manage their activity or meet their higher-level needs such as to belong, contribute and grow, leading to lower morale and engagement.

Modern technology has, in most cases, allowed information to be disconnected from place and time, which means, with a little forward planning and investment, it is fairly straightforward to get the office occupants up and running at alternative locations such as home, hotel, rented office or a purpose built disaster recovery facility. 

However, research shows that if we fragment the workplace without paying attention to the management and coordination activity or the social and recognition needs of our workers following an office disaster, the costs can be very high indeed.

When we look at the cost of business disruption, the 2018 Allianz Global Claims Review reports that the average insurance claim for business interruption is more than $3m, almost 40 percent higher than the average cost claimed for property damage. The same research also shows that the losses are now being driven by indirect impacts such as loss of confidence in the organisation, loss of customers, fines, penalties and lawsuits – impacts that can only be mitigated by people in the disrupted organisation pulling together as a team. 

In short, the threats that have the ability to prevent a workplace operating as it should can be physical, virtual or reputational and all impacts are financial. Indeed, the largest losses are now being driven by the indirect impacts rather than the direct property damage and operational disruption requiring businesses to re-think how they accommodate the workforce in the event that they can’t access their office. 

How to reduce the impact of a workplace office loss 

The most effective way to reduce the impact of a workplace office loss is to instantaneously pick up the whole thing, people, information, management, personal knick-knacks, support structure etc. and transplant it somewhere else that is equally easy to get to and has the same feel and culture as the original. However – we are operating in the real world and things are not quite that easy.

Good physical security and building resilience such as ensuring you are not in a flood plain, have more than one power and communications links to the building etc, are a good starting point. Likewise, the Business Continuity Institute’s Good Practice Guidelines offer four basic recommendations to the loss of building and work environment, to help mitigate the immediate operational disruption, which it’s worth every business considering: 

  • Diversification: having a separate location where the activity occurs in parallel so if one location is lost the work can carry on at another location – albeit with the negative consequences of an increased workload for the undamaged building occupants and loss of activity for those who normally work from the damaged building.
  • Replication: having a separate premises that has all facilities required to undertake an activity, but it is not currently being used. 
  • Standby: a separate premises that has some of the facilities required to undertake an activity, but additional facilities will be required before the activity can be undertaken. For example, a physical premises but where an operational copy of the IT system to support the activities of the people is held in together with a backup of its data that needs to be loaded and tested with manual switching to be made live.
  • Post-incident acquisition: where suitable premises can be acquired which may or may not already have the facilities required to undertake an activity.

But, beware, there are a number of pitfalls that need to be negotiated to get the most out of these strategies.For example, many organisations have a plan that includes relying on people being able to carry out their normal activities remotely from their home. However, unless the organisation is in the fortunate position to be able to issue users with a second laptop that lives at home, you can never be sure they will be available at time of incident. Many people are not at their desks when a crisis happens, and the vast majority of people do not take their laptops home each night. Equally, does the user have sufficient and suitable space for working from home?  Likewise, is it safe? The employer still has a responsibility to ensure a safe working environment for staff even when working from home.

Alternative workplaces can also be troublesome. Do they have the right connectivity? Is it secure? Who else are you sharing the space with? Is it somewhere that you would be happy holding client meetings? 

Addressing more than just the immediate losses 

As we’ve seen above workplace offices are not simply warehouses that provide shelter and warmth to individuals who carry out their tasks autonomously. They provide a rich environment for interaction and innovation and enable efficiency by specialisation. They are designed so that the output of the whole is greater than the sum of the parts, and the mitigation of losses requires more than just alternative accommodation to be provided.

The risk environment that organisations operate in is now characterised by uncertainty, complexity and risks with adversaries and the magnitude and frequency of the losses is driven primarily by how an organisation as a whole responds rather than how they mitigate the immediate operational disruption of losing their premises in the first place.

We are finding that organisations that adopt a holistic stance and incorporate point business continuity solutions such as workplace and IT disaster recovery into a larger resilience strategy suffer fewer losses because they are able to address all aspects of the corporate culture and the loss of a workplace becomes a minor operational blip as opposed to a full blown disaster. 

Image by Michael Gaida from Pixabay

Gaps found in UK disaster recovery preparedness

960 640 Stuart O'Brien

41% of UK businesses have either failed to test their disaster recovery (DR) systems in the last six months or don’t know when any sort of testing last took place.

A study by Proband revealed that surveyed UK businesses at director-level to understand their current perception of disaster recovery – and to evaluate how prepared companies are when it comes to backup restoration.

While the majority (92%) had some sort of DR solution in place, less encouraging was how few knew how effective those systems are and whether they are robust enough – with only two thirds (59%) carrying out regular tests.

Many companies’ approach to backup also offered a source for concern. Just 62% were sure they had any off-site backup capabilities. While only 39% said they would be able to restore on-site backups in under 24 hours, even if they could get new servers ready to accept that data. However, only 29% said they could get hardware to replace servers in that time frame. Meanwhile, just 29% said they could recover to the cloud, with 54% admitting they definitely couldn’t, and 17% saying they didn’t know.

Mark Lomas, technical architect at Probrand, said: ‘‘What’s clear from our research is that, for many companies, disaster recovery is shelfware, set up once and then rarely if ever tested or thought of again.

‘‘DR is a neglected, non-revenue generating component of many IT strategies, but the growing threats to enterprise data mean that this mindset needs to change.’’

One survey respondent even went as far as to say they ‘‘did not know how long the backup would take,’’ as they had never had to do it. This laisse-faire attitude is worrying when you consider that it costs businesses on average $5,600 per minute of downtime.

Lomas continues: ‘‘You wouldn’t install a fire alarm and then never test it – why should DR be any different? If businesses aren’t carrying out regular tests every 2-3 months then they have no way of knowing if their system is up to scratch and whether it’s going to leave the business – and its customers – experiencing downtime for a day, a week or even longer.’’

Full findings of the report can be viewed here  How to avoid Disaster Recovery becoming a disaster.