Top ten tips for 2005 hurricane season planning

SunGard Availability Services has published its top ten tips for keeping systems, business processes and people in operation as organisations prepare for the 2005 North Atlantic hurricane season, which commenced on 1 st June.

In 2004, 221 Florida-based customers put SunGard Availability Services on alert prior to Hurricane Frances making landfall in September.  Ultimately, 29 of these companies moved into SunGard’s facilities in order to access their business data with SunGard’s IT resources, enabling their organisations to remain operational.  In addition, SunGard AS successfully provided business continuity services for hundreds of customers affected by Hurricanes Bonnie, Charley, Ivan and Jeanne.

Based on this extensive experience, SunGard AS advocates the following proactive steps to help ensure readiness for the 2005 hurricane season: (Published verbatim).

1) Look beyond business continuity to Information Availability:  Information Availability represents the marriage of business continuity and operational resilience.  It entails uninterrupted access to mission-critical data and systems, and keeps people and information connected. 

Business continuity, on the other hand, prepares organizations to deal with worst-case scenarios.  While this approach is valuable, it is more suited to catastrophes than to the more prevalent hurricane-induced effects such as hardware failures, power outages and network outages. 

2) Understand system interdependencies:  Planning for Information Availability requires an organization to understand how all infrastructure components work together and depend on each other.  Not only does an organization need to know IT systems, but also which businesses rely on which applications and platforms, and which locations depend on each other.

3) Impact analysis:  For many organizations, business impact analysis has traditionally been a one-time exercise that is completed and then left untouched for a long time.  Today, organizations recognize that their business environments are changing rapidly, and the time to update impact analysis is now, before the first hurricane warning appears.

4) Situation/crisis management:  Situation/crisis management capabilities should be fully integrated into an organization’s Information Availability program.  The primary objectives for these capabilities include tracking, communicating and assisting in the oversight, facilitation and management of any event.  A logical extension of planning and testing efforts, crisis management is easier to establish once relationships and impacts have been identified.

5) Notification:  Critical during any potential interruption, notification should be an integral part of crisis management capabilities.  An organization should be able to get in touch with key personnel, as well as to prioritize methods of communication and track which employees have received messages.

6) Planning:  Plans have always been at the heart of traditional business continuity.  In the past, efforts have been focused on creating hardcopy output to satisfy audit requirements, and to provide reference documents and recovery procedures at time of disaster.  But at the end of the day, many plans have ended up in storage, offering little value when an incident occurs.

With an Information Availability program, plans remain important, but rather than generating volumes of static paper documents, the focus is on creating and maintaining a usable set of information.  Plans should be response-based and checklist-oriented, providing clear, straightforward instructions that can literally fit into a pocket.

7) Testing:  Simply creating plans is not enough.  Organizations must test plans in order to identify and correct problems before an actual business interruption occurs.  Tests must be conducted regularly and under realistic conditions.

8) Data encryption:  Recent glitches in the transportation of highly sensitive electronic data have shone a spotlight on the critical need to safeguard and secure data throughout the transportation process.  In the hectic hours surrounding a hurricane warning, the potential for tape loss may increase.

Encryption has emerged as a reliable method to maintain the privacy of data in the event of a tape loss.  However, there is work and time involved with encryption, and organizations should therefore begin encryption as soon as possible, starting with the most vital records – for instance, those that are regulated by state and/or federal laws, central to business processes, or subject to regulatory requirements.

9) Links to production systems:  In the move toward operational resilience, production and recovery become highly intertwined.  It is foolish to manage either environment in a vacuum.  Information from production systems can be key to managing recovery and vice versa.  There is limited value to a continuity plan that does not link to production systems.

10) Do not hesitate to go on alert:  If an organization believes it is in the path of a hurricane, do not hesitate to call and put your service provider on alert that you may be declaring a disaster.  With respect to actually declaring a disaster, experience shows that local authorities use sound judgment in determining if an evacuation order should be issued.  When an organization is within eight hours of a voluntary or mandatory evacuation order being issued for its area, it is a good time to actually declare a disaster.

www.availability.sungard.com

•Date: 8th June 2005 • Region: N.America • Type: Article •Topic: BC general
Rate this article or make a comment - click here