Evaluating Business Continuity & Disaster Recovery Consultants

By Tim Pierce, Business Development Manager at FORTRUST

Fortrust works with a number of companies and consulting firms that provide BC/DR services, planning, and testing. In order to best meet our customers’ needs, we maintain a policy of vendor neutrality when it comes to BC/DR planning and consulting services providers. This Application Note is offered as a service to Fortrust customers, partners and the technology community, to provide some ideas and ‘food for thought’ to IT executives who are thinking about engaging a BC/DR provider.

It’s no secret that business continuity is, and has been, an important topic in the IT industry. And as hurricanes batter the Gulf and the eastern seaboard, and earthquakes in California make headlines, the importance of a reliable BC/DR approach is even more apparent. Business continuity services account for 3 to 4 billion dollars of revenue every year, according to a recent study by Gartner Research. Further, according to a survey conducted by KPMG, 28 percent of companies that have BC/DR plans outsource the management of them to external providers.

It would seem that, given the costs involved in planning, testing and implementing a rational business continuance strategy, a great deal of importance would be placed on the people chosen to lead that effort, and provide expert guidance to the initiative. However, we’ve found that, when it comes to BC/DR services, not all consultants are created equally.

With the above in mind, we’ve created this Application Note, with the objective of providing a few questions you should pose to any prospective BC/DR consultant.

Will the consultant help you to figure out what’s really worth protecting?

The key to a cohesive BC/DR plan is to first understand what’s important to your company. To achieve that understanding, you first need to have a solid grasp of your company’s strategic objectives and business processes. Once you know the business objectives and strategies of the enterprise, you’ll be able to understand what assets are truly important, and should receive priority for recovery. Without understanding the impact of different events and outages, you can’t create an effective BC/DR plan.

A qualified BC/DR consultant will work with you to create a business impact analysis that identifies your critical assets, systems and processes as well as quantifies the cost of downtime or interruption to those things. In other words, a good analysis will not only identify critical components of your enterprise, but will likely shed light on how valuable those assets really are to your business.

Does the consultant try to force you down a single path?

BC/DR consultants should be primarily focused on just a few things – namely, the identification of critical assets and business processes, mapping dependencies, and the prioritization of planning and recovery based on the expected impact to the company if that asset or process is rendered partially or completely unavailable.

BC/DR consultants should not be focused on selling products and services to mitigate potential disasters. Coming up with the solution to ensure that critical assets and processes are protected, ideally, should be someone else’s job. That’s not to say that a BC/DR consultant should have no say in whatever measures you take to protect your business. But if your consultant has an ‘end in mind’ before he or she ever really examines your business, they’ll spend more time trying to sell something to you than really understanding how your business operates, and the real impacts of downtime to your business.

Will the prospective consultant help prioritize and understand the impacts to your business?

Just as there are different approaches to mitigating and reacting to disasters, it follows that there are different levels of preparedness, and a company’s expectations for business continuance may not always be based in reality. Most companies, when asked, will tell you that they would like to have all of their systems available 24/7, with no downtime whatsoever, at all times. When the price tag associated with such a goal comes back from the planners, they quickly realize that such a goal isn’t realistic. In most cases, instant restoration of services and assets in the event of disaster is too expensive to justify in the boardroom.

A good BC/DR consultant understands this, and makes it a priority to determine key assets and real requirements for restoration of service. Further, qualified BC/DR providers understand that not all assets are created equal. Some things need to be restored very quickly in order for the business to survive. Other processes or applications can go hours, days, or weeks without restoration, and some can wait even longer if needed.

The key point in all of this is that a realistic BC/DR plan makes this distinction, and a consultant who tries to tell you otherwise is either not qualified, or trying to sell you something.

Does the consultant focus on BC/DR planning, or do they sell other things?

Today, lots of companies offer BC/DR services of one kind or another. The key question is, are their services the primary focus of their company, or a ‘valued-added’ product they’ve put together in order to lead you into purchasing another product or service. In other words, do they offer BC/DR planning ‘services’ that actually have no real object but to push you into their other services/products?

It’s not to say that a company or consultant who provides more than just BC/DR is inherently untrustworthy. But it might be an indication that you should look more closely at the provider and the services they’re providing.

How long has the consultant been offering BC/DR planning, and what qualifications do they maintain?

As disaster recovery has gained exposure in the past few years, many companies and consultants have entered the BC/DR industry. As a result, it’s important to differentiate among qualified, dedicated providers and consultants with no real qualifications to provide service.

A couple of activities that might help you conduct an evaluation of providers to support your BC/DR services:

• Request and follow-up on references from the provider you’re evaluating. Suspect a provider that neglects or delays sending references. When a provider does give references, ensure that they are specifically for BC/DR services.
• Evaluate providers that hold certifications related to BC/DR disciplines.
• Certifications from organizations such as the Disaster Recovery Institute, the Business Continuity Institute and others indicate, if not a true proficiency, at least a commitment to the practice and discipline of business continuance and disaster recovery.

Summary

BC/DR planning, along with the associated steps that are often taken afterwards to mitigate risk, is a major undertaking and very difficult to complete without a dedicated resource. But it’s critically important, for most businesses, to understand the true risks and the actual costs associated with downtime and disasters as they occur. At the end of the day, it’s your money, your company, and potentially your job on the line.

Because of that, make sure that whomever you work with will maintain a sense of urgency, and provide your enterprise with the information and approach necessary to support your business in a wide range of scenarios. Don’t be shy about aggressively evaluating potential providers and asking them to produce verifiable information about their services, and their level of service, before you sign on any dotted lines.

Thanks for taking time to read this Application Note from FORTRUST

Virtualization to Increase Business Efficiency and Decrease Costs

By Michael Robnett, Service Delivery Manager at FORTRUST

FORTRUST Data Center in Denver is pleased to present another installment in its Application Notes series to outline the benefits of new technology to increase business efficiency and enhance the bottom line. In this installment, FORTRUST discusses virtualization by outlining the benefits of a virtual model (VM) and providing an analysis of implementation. Consistent with our consultative approach to conducting business, we offer this information to our FORTRUST customers, partners and the technology community to provide ideas to enhance business in an increasingly complex information technology-driven environment.

FORTRUST is a high-availability data center that provides colocation and data center services including virtualization services for any-size enterprise.

What is virtualization?

Virtualization is an application of technology that is fundamentally changing the way people compute by allowing one computer do the job of multiple computers. In a virtual environment, it is possible for one computer to run multiple operating systems and various applications at the same time increasing the usability and flexibility of that single computer. This frees people and their hardware from physical and geographical limitations and provides opportunity for greater efficiency and financial savings. As a result, CIO’s and CTO’s across the globe are making virtualization part of their IT infrastructure.

What types of virtualization are there?

Virtualization can take place over many platforms including application infrastructure, client/desktop applications, server virtualization and storage and network virtualization. This brief focuses on server virtualization only.

Why virtualization?

Today, many businesses are exploring a virtual model in an overall effort to go “green.” However, virtualization provides additional benefits including disaster recovery and business continuity solutions by reducing the infrastructure footprint and minimizing operational costs while striving to improve performance and reliability.

How does virtualization work?

Simply put, server virtualization allows you to take a single piece of hardware and transform it into multiple “virtual” machines. To create a virtual environment, there are many solutions available with the most popular being VMware, Microsoft and Xen. For example, VMware ESX will allow you to “virtualize” CPU, hard disk, RAM, and a network controller allowing you to run multiple OS instances on a single hardware device.

What are the advantages of a virtual environment?

• Higher Utilization – Virtualization can tap into underutilized resources. Today’s enterprise servers dedicated to a single application may use 10 to 20 percent of its capacity; a virtualization layer can increase utilization to 70 to 80 percent. For example, instead of 50 servers running at 30 percent of capacity, you can have 20 to 25 servers running at 70 to 80 percent utilization.
• Lower Capital Expenses - By leveraging the unused capacity, virtualization efforts can dramatically reduce capital purchases of new server hardware by as much as 50 percent.
• Reduction in Operating Expenses – With fewer servers to operate, you can achieve far lower costs for power consumption, cooling, real estate and maintenance.
• Faster Provisioning – One of the many challenges in IT application deployment is rolling out new servers. With virtualization, you can provision a server in hours or days, not weeks. This gives you greater managerial flexibility and options.
• Improved Service Levels – In a virtualization environment, IT can be more responsive to business needs by providing new services faster with a greater number of service options.

Are there any downsides to virtualization?

The drawbacks in a virtual environment occur when systems aren’t managed to the level that you might maintain your physical environment. The drawbacks may be easily addressed with standards that keep systems and applications protected and running at peak performance. Following are issues to keep in mind.

• Security “Zones” – What used to be separated at the physical layer is now only separated at the virtual layer. Know this distinction to keep your environment protected. Further, you must apply the same rigorous standards to your virtual internal and external applications as you would your physical environment.
• OS Security – It is important that you maintain the same level of security in your VM environment as you would your physical. Keep your VM current with critical patches and updates. Not doing so in a virtual environment can be catastrophic.
• Naming Conventions – It’s amazing how fast you will create VM’s vs. the time it takes to implement physical infrastructure. Be consistent with the naming conventions from the start; it can quickly get out of control.
• Mixed Environments – In your current physical production environment, it is unlikely that you have mixed your Q/A and test environments. Your virtual environment is no different. Take caution when creating your pre- and post-production environments so that you do not impact production.
• Maintenance – Don’t forget to clean up after yourself. It is easy while testing and creating new VM’s to neglect old VM’s and clutter your environment. It’s a good idea to audit your environment on a quarterly basis to keep things under control.
• Performance – Determine what you are trying to solve. Buying a huge blade center or a massively over-configured stand-alone CPU and applying a VM will not necessarily get you the results you are seeking. Keep in mind I/O requirements. The way you configure your storage will have a lot to do with your performance.

Summary

If a virtual model is implemented and maintained correctly, you and your enterprise will realize a host of benefits including enhanced efficiency, expanded access to a wide range of applications and bottom-line improvement. A solid three-year strategy that is in line with your company’s objectives can easily meet growth requirements, improve time to market, significantly reduce risk, and significantly reduce overall costs.

A Closer Look at Reliability and High-Availability Service Delivery

Below is an except from a recently released comprehensive white paper by FORTRUST. To access the complete white paper click here.

The search for the right data center services provider to support colocation or hosting requirements is not an easy one.

That’s why companies spend considerable time and energy selecting their data centers. They conduct research, tour data centers, submit requests for information, review proposals and check references. The key is to ask the correct questions.

In many cases, companies examine the facility’s critical systems infrastructure, location, building characteristics, business stability, data center environment, connectivity, and physical security. While all of these attributes are important when evaluating data centers, companies should also focus on factors that play an important role in ensuring high-availability service delivery, such as each provider’s operational processes, service assurance policies and maintenance and lifecycle strategies.

Read more