The HexiSTOR Business Guide for Disaster Recovery and Continuity Planning

Part 1

Why Businesses Need to Plan.

The most important asset for any business today is it’s data. If a business looses it’s data and it can not be completely and quickly recovered, it may be forced to shutdown. Over 50% of businesses never recover from this type of disaster. Most data losses will happen from business event risks or catastrophic events.

With the proper plans implemented your business will run smoothly, with a minimum of downtime during any disaster. Your insurance company may offer discounts when you have disaster and continuity plans implemented.

Two Types of Plans

Disaster Recovery Plans (DRP), plans created to handle catastrophic events. What is a catastrophic event? It is one or more natural or man made disaster that would cause a business to close and evacuate, flooding, hurricanes, earthquakes, fires, etc.

Business Continuity Plans (BCP), plans designed to handle event risks. What are event risks? Any type of internal business failure(s) that could cause a business to shutdown, even for a brief time. Event risks are not always hardware related, software updates and virus attacks can cause problems, but the number one overlooked risk is, human error. Note: Catastrophic events often create event risks.

Having DRP and BCP implemented at your business will help to keep your business safe and protected during any event with a minimized loss of downtime.

Common sense: How can a business prepare for catastrophic and even risks? They must analyze and create disaster recovery and continuity plans. The first thing is to identify the risks which takes us to part 2.

Part 2

Identify the Risks that can Shutdown Your Business.

First, catastrophic events: nature happens,

What natural disasters have happen in or close to your area? Earthquakes, hurricanes, tornadoes, flooding, snow (ice) storms, etc.

Followed by man made disasters, which are harder to predict, but can include power outages, network outages, fires, gas leaks, train derailing, etc. You can learn from history, whatever has happened will happen again.

Second, inside event risks: Sooner or later every business will experience these events,

Computer related problems:

Hardware:

Designed to last 5 years at best, yet you get a 1 year warranty. How fast can your vendor supply you with new hardware?

Software:

Virus attack, driver issues, a bug in the software, mixing different versions, etc, can cause the system to slow or shutdown.

Network:

Loss of commutation between computers and or the Internet.

Other business equipment failures:

Phone system:

What will happen when telecommunications is lost for x amount of time?

Peripherals:

Copiers, FAX, printers, monitors, etc, how long can you maintain business if any of these devices fail?

Security:

Could this result in a greater risk of exposure to theft, sabotage, even a terrorist attack?

Human error:

From accidentally deleting a file to formatting a hard drive with critical data.

Accidents happen! Murphy's law. When they happen in the work place you must be prepared.

What happens if the person in charge of handling an event risk is not at the location?

The simplest way to start evaluating your risks, is to make a chart (fig 1 & 2). List all possible events that could happen to your business and assign a risk number. Start with natural disasters, man made, then computer and equipment failures, and finally human error.

By assigning a risk number to each event you can start to prioritize the possible events. You must consider your location, age of equipment, and experience of your employees when assigning a risk number. Using a simple number system, zero through nine, where 9 is most likely to happen and 0 is next to impossible. Numbers in between represent a possible risk, the higher the number the more likely this event could happen.

Equipment (computers and other hardware) failures should also be assigned an impact number. What to do when this failure happens, using a simple number system with 1 meaning can do without, wait for repairs, to 5 highly critical to business, requires immediate recovery / replacement. There must always be a second in charge for high impact number events.

Keep your risk factors within a time frame, as a rule, they should be re-evaluated every 6 months.

Example:

What is the risk of a major snow (ice) storm in the next 6 months?

If you live is Key West Florida, assign a 0, if you live in Fargo South Dakota, it would be a 9 (in the Fall-Winter Seasons) and a 4 (Spring-Summer time).

Figure 1, set up a simple spread sheet to describe natural and man made catastrophic events that can, or have, happened at your location.

What is the risk of computer hardware failure in the next 6 months?

If the hardware is new (less than two years), maybe a 3, older (2-5 years), a higher number like 6, and over 5 years old would be a 7 or higher.

The impact number would be a

5- if it must be repaired / replaced immediately.

4- if it must be repaired / replaced current business day.

3- if it can wait 24 hours for repair / replacement.

2- if it can wait 36-72 hours for repair / replacement.

1- if it can wait for normal service.

Figure 2, set up a simple spread sheet to identify the equipment that is important to the business’ operation.

Develop and Maintain a List of Inventory Items

Every business needs a complete inventory list of their equipment. Using the spread sheet above (Fig 2) and adding a few more columns Serial Number, Model Number, Purchase Date, Cost, and Vendor you will have an inventory list. To complete the list be sure to add software, and equipment other than IT. Check with your insurance company to be sure this list contains all the information they require. You should have an separate inventory list for each location.

Any risk with a number greater than zero, must be included in your disaster recovery plan, and your business continuity plan. Now that you know your risks and the impact to your business you can start to write a plan. This will be covered in part 3 of this document.

Caveat: This guide is very basic and is designed more for the IT department. We know that every business is different. Use this document as a starting point to help create your own plans for the types of disasters that could happen to your business.

We look forward to comments and suggestions.

Business Continuity Planning: Before and After the Hurricane

Business continuity planning (BCP) means that a business has a plan to follow when an event occurs that may stop it from operating. This could be anything from a minor interruption to a full blown disaster. The object of the plan is to keep the business safe and secure with a minimized loss of down time.

Most departments inside a business have a BC plan to follow when an event happens. These plans are called checklists, and they must be followed in order. This blog is for the IT department's BCP, to help create a checklist of what to do before and after the storm.

Once your location has become a hurricane watch or warning the threat to a suspension (shutdown) of your business is real. It's time to get out the checklist. Make sure everyone has a current copy and knows their assignments.

Caveat: This checklist is very basic. We know that every business is different. Use this information as a starting point to help create your own IT checklist for shutting down and restarting your business' computers. Once you have a checklist implemented you should run a full trial, making sure nothing has been forgotten and everyone knows what to do. Whenever you update or add any IT device, you should look at your checklist and update as necessary.

Before the Storm: Getting ready to secure your business' IT

1. Start with an orderly shutdown of the computers. Typically shutdown all workstations first, servers last.
2. Next, disconnect the computers and components from the wall. This is easily accomplished by turning off and unplugging the UPS (Uninterruptible Power Supply) that the computer and components are plugged into. (The less you disconnect the easer it will be to restart.)
3. Disconnect the Ethernet cables attached to the computers.
4. Turn off your Internet modem, router, and other Internet components, then turn off and unplug the UPS that protects these items (At this point nothing should be plugged into any electric outlet.)
5. Disconnect the Internet connection cable from your modem and disconnect the Ethernet cable from the modem to the router.

If your business is in a flood zone you should move your computers and any components that are on the ground off the ground (at least desk or table top height).

After the Storm: Getting ready to restart your business' IT

1. Reconnect the Internet connection cable to your modem and the Ethernet cable to the router.
2. Plug in the UPS that powers your Internet modem, router, and other Internet components , turn on the UPS then turn on the modem first, router, etc. Once your modem and router lights indicate you have an Internet connection, you are ready to continue.
3. Reconnect the Ethernet cables into the computers.
4. Starting with servers (last one shutdown is the first one on) plug in the UPS that powers the server. Turn on the UPS, then the monitor and other components. Usually the last thing is the computer.
5. Once all the servers are running, you can start powering up the workstations using the same method as the servers.

It's important to only power up one device at a time. Starting more than one at a time could cause a power surge followed by a blackout, especially if the building's power was off because of the storm.

Everyday Continuity: Planning for Data Recovery

How good are your backups? Your business' data is your most important asset. It should go without saying that your data must be backed up every business day, storm or no storm.
Are your backups stored in a safe location? Your backups must be stored off premises in a safe and secure location that offers easy access to recover your information should the occasion occur.

Experts recommend using an automated online backup service. HexiSTOR's online Backup / Restore products will automatically backup your business data using the Internet to a safe and secure location. Your data is available 24/7 to restore anything from a single file to a complete server. Try the HexiSTOR 30-day free backup trial and see the difference a business oriented backup service will make.