© 2015 by Nick B. Nicholaou, all rights reserved President, Ministry Business Services, Inc. Reprinted from MinistryTech Magazine
Most in IT recognize the importance of data backups, but there’s more to a good disaster recovery and business continuity strategy than having backups. What are those additional elements, and how do you set an appropriate budget to accomplish them?
Disaster Recovery vs Business Continuity
According to Wikipedia:
- Disaster Recovery Plan (DRP). A disaster recovery plan is a documented process or set of procedures to recover and protect a business IT infrastructure in the event of a disaster. Such a plan… specifies procedures an organization is to follow in the event of a disaster.
- Business Continuity Plan (BCP). A business continuity plan is a plan to continue operations if a place of business is affected by different levels of disaster which can be localized short term disasters, to days long building wide problems, to a permanent loss of a building.
When a fire takes out your server room, that’s a disaster! Having good backups is an essential element of recovering. In fact, many say that one of IT’s most important responsibilities is ensuring good backups.
When a natural disaster like a hurricane or earthquake eliminates the ability to do business as usual for an extended period of time, that’s when the business continuity plan kicks in. In the wake of 9/11 and Katrina were many organizations that went out of business because they couldn’t continue their operations for a longer period of time than was survivable.
What’s Needed for Disaster Recovery?
A good DRP starts with a good backup strategy, and that relies on the ability to reach all of an organization’s data. One of the benefits of local area networks is their ability to centralize data, making comprehensive backups possible. With the advent of BYOD (Bring Your Own Device) this is becoming more challenging if staff doesn’t do their part to make certain that all organizational data is on one of the organization’s servers that is getting backed up.
There are many backup strategies in play today; everything from full hourly to daily incremental backups on backup storage media from tape to removable hard drives to the Internet. I prefer full daily data backups, and agree with most of corporate America that tape is an optimally reliable backup target. Tapes can handle very large backups, and are easily transportable so one can be taken off site regularly (I recommend at least weekly).
What about backing up to the Internet? Though it has advantages, it also has disadvantages; primarily when entire servers need to be restored due to a larger catastrophe. When a large restoration is required, you are dependent on the speed of your internet connection or having the vendor send you the backup. It is worth noting that I’ve never seen that methodology meet expectations when a large catastrophe hits.
The key to having a good backup, however, is regular testing. This is something most IT teams rarely prioritize. An untested backup is a risk, and there’s nothing worse than being in the middle of a catastrophe and running what amounts to your first backup strategy test and finding out that it wasn’t working. Our firm recommends doing test restorations on a monthly basis to make certain backups are good.
What’s Needed for Business Continuity?
Business continuity requires a larger set of strategies than disaster recovery. In addition to having a DRP component, it needs to include what an acceptable data outage is for different categories of data (email, databases, documents, etc). And it needs to include details on how to respond to different types of disasters including key staff contacts, key vendor contacts, etc.
This is one of the most overlooked needs to good church and ministry administration. In major disasters, churches and ministries want to be resources those in their community can turn to. A BCP helps ensure that your organization will be available to be the hands and feet of Jesus when people need you most.
The Internet can be a good component of a BCP. If you move some or all of your servers and services to datacenters, the likelihood they will not be available is dramatically diminished if the datacenter is certified at least as a Tier III datacenter by www.ColocationAmerica.com.
Setting an Appropriate Budget
The first step is to categorize your data and services (email, VoIP, databases, documents, spreadsheets, audio/ video files, etc). Then ask leadership to set acceptable outages for each category in a disaster. For those categories with very little tolerance for outages (email and databases, perhaps), they need to be backed up in full often and tested regularly. For those located in areas more prone to natural disasters, a good option is to host those mission critical servers and services in an appropriate datacenter. If you choose that option, require the hosting datacenter to provide certification of having a Tier III or higher rating by www.ColocationAmerica.com.
If leadership requires that everything be up and running 24·7, design a plan and budget to accomplish that. If it’s too expensive, help them think through the data categories and establish realistic outage timeframes to reduce the cost. But this is a decision that leadership must make; it cannot be delegated to IT. And it requires that they agree to the final strategy.