I’ve recently had another example of an organisation that seems to be a bit confused about the scale of incident that it should plan for when implementing Business Continuity. This one has just outsourced its ICT, and as part of the agreement has made sure that the outsource company has disaster recovery arrangements in place. So far, so good, but the only problem is that the main and backup data centres are in the same city, less than 10 miles apart.
Now, this particular organisation is in the public sector, and provides services to the whole of the country in which it operates, and reports to an arm of that country’s government. Its computer systems are absolutely essential to its operations, and if its outsource supplier loses both its main and backup data centres at the same time, this organisation will be unable to operate, and will never recover.
Being an ever helpful consultant, I pointed this issue out, and was told that the chances of both data centres being lost at the same time were too small to worry about. And anyway, if it did happen, the incident would be so large that most of the staff would be lost or unwilling to work.
So, their maximum survivable incident is the loss of only part of the city in which they operate, which clearly does not meet the requirements of the country in which it operates, or the customers that it provides services to. Are they bothered? Watch this space.
The Business Continuity Consultant 