Majority of organizations are not prepared for a business outage lasting longer than seven days

Business continuity management and disaster recovery programs are getting better, however, work still needs to be done to increase the quality and maturity of such programs. According to a Gartner survey of 359 information security and risk management professionals from the US, UK and Canada, nearly 60 percent of organizations only plan for their longest outage to be seven days.

“The fact that most organizations plan for an outage that lasts up to seven days indicates a huge hole in those organizations’ ability to sustain business operations if a regional disaster strikes,” said Roberta Witty, research vice president at Gartner. “The impact of a disaster that lasts more than one week can have enormous negative impact on revenue, reputation and brand. Regional incidents, terrorism, service provider outages and pandemics can easily last longer than seven days. Therefore, enterprises must be prepared. More mature business continuity management and disaster recovery programs plan for outages of at least 30 days.

When planning for specific types of disaster scenarios, 77 percent of companies have a plan for a power outage or fire, and 72 percent have a plan for a natural disaster, such as a flood or hurricane. At least half the companies surveyed also have plans for IT outages, computer-virus attacks, terrorism and key service providers’ failure. “With the growing use of third-party service providers to conduct mission critical business functions, organizations that don’t plan for this type of business outage can find themselves in a tough position in the event that this scenario becomes a reality,” said Ms. Witty.

Most business continuity and disaster recovery plans are for a single facility outage, and planning for regional disasters has dropped in priority during the past couple of years. Organizations are, however, taking pandemic planning warnings more seriously than in the past (29 percent in 2007 vs. 8 percent in 2005).

With the growing awareness that continuing business operations after a disaster requires a lot of planning, organizations are also realizing that the approach to best manage an incident is to have a dedicated group of people on a crisis management team. A total of 37 percent of organizations use a physical crisis command center to coordinate emergencies, such as a local hotel room or conference room. However, understanding that many disasters happen when employees are not in one place, 31 percent of companies have established a virtual command center so that traveling or off-site personnel can be included in the management of an incident.

A total of 28 percent of organizations reported that their last disaster recovery exercise went well and met all their service targets. However, 61 percent of survey participants reported that they had problems with the exercise.

More information on the survey will be presented at the inaugural Gartner Business Continuity Management Summit taking place March 5-7, 2008 at the Sheraton Chicago Hotel & Towers in Chicago. www.gartner.com/us/bizcon

Reader comment

Non-BC professional readers need to be aware that this article uses the term ‘business continuity’ to cover both business operation (processes) recovery planning AND IT service continuity (aka DR). However, the survey was of IT and risk management professionals who do not distinguish between these very different elements of a comprehensive risk management program. Business continuity management (BCM) is a risk management business discipline, while disaster recovery is an IT technical discipline within an overall BCM program. Although disaster recovery spawned BCM by extrapolating contingency planning principles, BCM requires a decidedly broader range of business operations knowledge than the average IT professional has. The challenge CEOs and RM executives face is finding people with both ranges of talent: BCM and disaster recovery, though these will seldom be found in a single individual. And if personal experience is any indicator, IT service providers don't hire anyone with true BCM (versus DR) talent.

Gregg Jacobsen, CBCP

•Date: 10th January 2008• Region: UK/N.America •Type: Article •Topic: BC stats
Rate this article or make a comment - click here
UPDATED 17TH JANUARY