In the post 9/11 world, more companies understand that recovering from a disaster—natural, technological, terror or otherwise—is important. They also know that information technology plays an essential role in continuing their business.

"Awareness, though, hasn't necessarily transferred itself into action," says Mark Fulford, a partner in the Risk Services Group at LBMC, a Leading Edge Alliance firm.

Todd Knapp, president of Envision Technology Advisors, an affiliate of Kahn, Litwin, Renza & Co., a Leading Edge Alliance firm, agrees.

"They're so busy running the business that they haven't fully considered what could happen in a disaster."

Company size doesn't matter in developing and implementing such plans. "Even larger organizations' recovery programs or business continuity plans are not nearly as robust as they should be," Fulford notes.

Jeff McCulloch, president of Yeo & Yeo Computer Consulting Services, a subsidiary of a Leading Edge Alliance firm, says the No. 1 thing for any business is to have a plan in place.

"If you do not have a disaster recovery plan, the biggest problem is the unknown of what needs to take place," he says.

Any plan should be developed in response to your answers to these three questions:

• How long can I be down?
• Can I afford to be down?
• How long can I afford to be down?

Fulford says companies frequently make the mistake of having their IT disaster recovery or business continuity plan created and implemented by the IT department. That can lead to trouble.

"There's no link between the IT backup plan with the business' needs. There's no analysis of the critical issues tied to business decisions," he says.

Without input from other executives and departments, the plan may not address the most important needs for data from a company perspective.

Ask the data owners what they cannot do without, Fulford says. Ask them what recover time would be allowable. "These questions usually are never asked," he says.

In developing a plan, conduct a risk analysis and also an impact analysis that examines what the results would be if the data were lost.

McCulloch also advises that a copy of the plan be kept not only on site but at other locations so it's available if you need to evacuate quickly. It should incorporate how to recover the data but also include all the software information, including licensing numbers, to make the process go more smoothly.

Knapp says he believes data recovery requires a holistic protection approach that starts with building good systems with a lot of layers between the end users and the tape backup. Knapp and Alan Litwin, managing partner of Leading Edge Alliance firm Kahn, Litwin, Renza & Co., pose these questions:

• Are your power systems adequate enough to support the computer network?
• Do you have adequate back-up protection in the event the office loses power? How long will your battery systems last? How long do they need to last? For Envision's customers, Knapp recommends upsizing battery backup even more than the backup supplier does. "When it comes to better business, we don't think it's overkill," he explains.
• How reliable is your outside power source? Could the system be affected by a brownout when power capacity is within acceptable standards but not as strong as it typically is? How could power surges affect the system?
• Do you have redundant servers? Do you maintain your servers at least annually?

Bit-level backup also can be extremely helpful, Knapp says. It allows real-time image of all data across the network. That means it backs up each version of a document so if you are working on an Excel spreadsheet, change some numbers then hit "save" only to realize you needed those old numbers, the bit-level backup will be your savior.

"It's beautiful if you can afford it," Knapp says. "And with 40 to 50 users you can't afford not to."

Backup tapes are important but precautions should be taken as well as other recovery methods considered. "Relying on (backup) tape alone is a serious mistake," Knapp says, explaining that the magnetic material will degrade.

These experts offer these tips regarding backup tapes:

• The more tapes the better chance for being able to access good, quality data.
• Create an automated cycle to take the previous month's or week's tapes to an off-site storage place. Fulford says the best place would be a storage company that offers protection and 24/7 retrieval. A safety deposit box, for example, is not a good place. Although it offers protection, you can only access the data during regular banking hours.
• Rotate tapes over seven days to ensure full breadth continuity.
• Leave on-site tapes in a media fireproof safe. A fireproof safe is not good enough. It's only guaranteed to prevent paper from burning. A media fireproof safe ensures that magnetic media will not be damaged.

While technology's role in saving and protecting a company's data has existed for years, the need is even greater today to consider protection and recovery methods.

Knapp says one of the initial questions he frequently hears is, "How important is this really?"

He says some people think their networks haven't been hurt in the last 10 years so why should they spend the money now.

He says steps should be taken for several reasons:

• The number of viruses has escalated 800 percent in the last few years.
• The sizes and complexity of files are increasing and impacting systems even more.
• Pricing is more competitive to prevent problems or recover quickly from them.

"Every passing day your risk increases. When you lose data, you already have lost money," Knapp says.

In addition to making sure the backup tapes really are backing up the data, companies can take other low-cost avenues to test the systems. Create tabletop exercises or implement real-life drills to ensure that the data recovery plan works. Scan for firewall weaknesses and allow problems to come to light before your company's system is infiltrated.

"It's so cheap, it's silly not to do it," Knapp says.

The total expense will vary depending on the company, its size, the timeframe it needs to recover data for the business to survive and the levels of protection it desires.

Kahn, Litwin, Renza & Co. has put its money where its consulting mouth is, Litwin notes. The firm believes a strong system to prevent or eliminate the impact of a data disaster is essential for the financial services firm.

"It's preventive medicine," he says. "It makes good business sense."

If our data is compromised, we're out of business," Litwin says. e