I recently delivered a presentation at the SHARE conference in Anaheim, California, titled “What If Your CEO Knew the Truth about Your Business Continuity Plan?” The purpose of that presentation was to provide an effective method to deliver that truth to the CEO with just a few simple slides and obtain their buy-in on putting a complete plan in place. Why do this? I work daily with users in z/OS shops around the world that do not have complete business continuity plans in place. To understand why, let’s go back in time.
In June 1968, a mere 46 years ago, I was involved in my first disaster recovery (DR) test. At that time, DR was a very straightforward concept. Each day, backups of critical data were moved to an offsite location such that the user’s computer operations could be brought back up at some location. It was a lot of effort but it worked.
Fast forward to today and we see a much more complex operational picture. We still do much batch processing and we still do backups, but all too often, we do not practice good DR procedures.
The mainframe world has changed and it is often impossible for a company to actually perform business operations if their systems are down. The result is a heightened focus on business continuity over DR. In many cases, the two terms are used interchangeably even though they are two completely different things. Business continuity is about minimizing the outage incurred should the primary operating environment be compromised. DR is unchanged since it was introduced back in the 1950s. It is still about having a secured set of data that will allow a computer operation to be restored at some other location when all else fails. The terms business recovery or business resumption are also used frequently, but should only be used to describe a strategy that includes both business continuity and DR as two separate requirements.
Back to my Presentation
I presented a slide that showed a block representing a production environment with no business continuity or DR elements. A basic “if your systems are down, the company has stopped operations” scenario. I know of no CEO that would find that acceptable.
Then I presented a slide that showed that same production environment and a mirrored environment that represents the business continuity site. This is the common approach being used for continued operations. If either site is lost, the other can continue within a short time. However, if one looks truthfully at this configuration, the problem with this business continuity only scheme is that if a site is lost, the company is left in the same scenario as the first slide … a scenario that most will agree is not acceptable.
The next slide showed the addition of a true DR scenario along with the business continuity scenario. Now if a site is lost, the other continues as before, but now has the DR implementation to provide an alternative should the second site go down. It also protects in the event of a human mistake that corrupts data and requires a data recovery from that offsite data. The latter scenario is the most common event users will encounter, as sites are very rarely lost.
The content of these three slides can be presented verbally as an elevator speech. In fact I did encounter a CEO in the elevator of a large hotel who immediately asked if we could discuss the topic further. A short discussion in the hotel café and some simple drawings of the three slides and this CEO was setting a meeting with his CIO for the following Monday. If the CIO did not have what was shown in that third slide in place, that was probably not a fun meeting, but probably included something about when can it be in place and what will it cost.
Business continuity is absolutely needed, but it must be built upon the base of a solid DR implementation. DR is not new and shiny like business continuity, though it is still as viable today as it was back when I was conducting my first DR test. If you do not have a basic DR plan in place, I hope the answer as to the why is simply that the dollars went to other priorities, for that is the simplest scenario to fix. Talk to your CEO!
Jamie Giovanetto is president and principal consultant with J. Giovanetto Incorporated. He may be reached at firstname.lastname@example.org.