Disaster Recovery Planning Gets No Respect

Helena, Mont., may seem like a safe haven. It's located far from Tornado Alley and the coastlines that are vulnerable to hurricanes. Floods are not a problem, nor are earthquakes. Still, the state's Information Services Division (ISD) isn't taking any chances.

It has a contract for a hot site at a recovery center located in another state. And plans are under way to move ISD's cold site, now located in Helena, to another location about 50 miles away -- just in case. "We call it our hope chest," said Leslie Cummings, ISD's disaster recovery coordinator, referring to resources kept at the cold site. "It contains all of the detailed items of what we need to recover our data center."

But Cummings admits that the state's overall recovery plan is far from complete. "At this point in time, the only thing we can recover 100 percent is the data center's mainframe," she said. Still vulnerable are a number of mid-range systems as well as numerous agency systems on both distributed and centralized platforms.

Montana, like many other state and local governments, has found that its disaster recovery plans and budget have not kept pace with the rapid growth in computing. Once, government computers -- typically mainframes -- handled a few core applications such as payroll, accounting, drivers' licenses, retirement and Workers' Compensation, for example.

Today, however, automation has permeated every agency and department, from the governor's or mayor's office to procurement offices, teacher's certification bureaus and everything in between. Many of the new systems run in a distributed computing environment, such as client/server. Because these systems are outside the control of data centers, the amount of disaster planning is suspect.

"Most of the applications that have gone to client/server leave the scope of our data center," pointed out Michael McVicker, assistant director for the state of Washington's Department of Information Services (DIS). Recovery plans at DIS are comprehensive and up-to-date, but outside its doors, recovery planning is another matter. "I'm not involved in disaster recovery at that level," said McVicker, referring to the systems and data implemented and used by the state's 155 agencies.

SILENT KILLER
A study conducted by the University of Texas in 1987 revealed that even a decade ago, the impact of a computer outage was profound:

Eighty-five percent of organizations were heavily or totally dependent upon computer systems.
On average, by the sixth day of an outage, companies experienced a 25 percent loss in daily revenue. By the 25th day, daily revenue loss was 40 percent.
Within two weeks of the loss of computer support, 75 percent of organizations reached critical or total loss of their functions.
Forty-three percent of companies that experienced a disaster -- but had no tested business recovery plan in place -- never reopened.
Organizations estimated that their revenue losses would be two-and-a-half times as severe if their contingency plans were not activated.
While government agencies don't go out of business when a disaster strikes, prolonged outages can hurt the taxpayers. "There are too many citizens who require services from the state for us to say we're going to take a chance and not have a recovery plan for unemployment compensation or AFDC (Aid for Families with Dependent Children)," said McVicker.

Few governments can afford the cost of a computer disaster. For example, six years ago, the state of Washington conducted a study that determined a 30-day outage for the state's data center would cost Washington taxpayers hundreds of millions of dollars.

The potential repercussions from a computer disaster in government are significant, and yet agencies drag their feet when it comes to developing and maintaining adequate recovery plans. At the same time, a lack of resources to support recovery plans is making a difficult job even harder.