On the Friday before Hurricane Katrina made landfall three years ago, David Erwin, chief information officer at the law firm of Adams and Reese, left his downtown New Orleans office, expecting to ride out the storm. By Sunday morning, the hurricane had developed into a Category 5. Fortunately, he and his team had already taken precautions.
"After 9/11 we recognized the need to invest in disaster recovery," Erwin says.
Thanks to this planning, Erwin was able to switch the systems over to a third-party backup system once the building lost power. When the levies broke and the city experienced massive flooding, Erwin's team acted fast, acquiring real estate in Baton Rouge for a new office. All this was done without the aid of cell phones, which had been rendered useless by the storm. Instead, e-mail was available, thanks to Erwin's disaster recovery planning.
"We had Blackberry continuity because a third-party vendor set up our systems so in the event of a disaster all messages would be forwarded to and accessible on its systems," Erwin says.
Although the disaster Erwin faced is rare, unexpected interruptions to business are not. In-house counsel, along with a team of other department representatives, need to equip their companies with the technology to ensure business continuity and compliance in the face of disaster.
"When the doors are closed, your business is closed," says Todd Hauschildt, vice president of managed technology services at West, a unit of Thomson Reuters that hosts technology systems for its clients. "When a court date is set, it isn't always an automatic reschedule just because of hardship. Companies need to be ready to continue business no matter what."
According to Hauschildt, natural disasters cause only 8 percent of unplanned business interruptions. The more likely culprits are smaller in scale, such as power outages and loss of Internet connectivity. In the past, such incidents, which often result in outages of no more than a day or two, weren't very serious. But with the reliance on e-mail to conduct business, the pressure to maintain business continuity has increased.
This is why preparation is crucial, and it starts with the development of a disaster recovery team. This team needs to include representatives from all areas of the company, including IT, records management, compliance, security, business personnel and legal.
Legal's role is especially important. If a facility is destroyed, as in Erwin's case, in-house counsel need to quickly negotiate contracts to acquire temporary or permanent real estate. Legal must also ensure that all documents subject to retention, whether for regulatory or litigation purposes, are securely stored and accessible.
"If you have litigation, materials collected for e-discovery need to be protected," says Paul D'Arcy, vice president of marketing at Dell MessageOne, a provider of disaster recovery solutions. "There's no get-out-of-jail-free card because a disaster destroyed the data."
Save the Systems
One of the first things a disaster can affect is communications. Something as cataclysmic as Hurricane Katrina or Sept. 11 can effectively shut down all telephonic communications, including cell phones. In those situations, e-mail communications become crucial, both for ensuring that employees are safe and communicating with customers and solidifying offsite work facilities to ensure business continuity. "We have a service where, in a matter of minutes, you can put e-mail users in a backup system that is remotely hosted," D'Arcy says.
Besides ensuring the stability of communications, it is important to back up and secure the organization's existing information, from e-mails to databases. This is especially true for companies with specific regulatory requirements, such as those in the financial sector, as well as companies currently engaged in litigation and subject to litigation holds.
There are a variety of technological offerings to help companies do this. These solutions transmit company data to an offsite, secure location for storage. When a disaster strikes, the company can immediately switch over to the offsite backup and access crucial documents.
"Customers set specific requirements for the frequency of data backup," says Richard Heitman, vice president of product management for EVault, a provider of data backup solutions. "They can have it set at once a week, once a day or even once every 15 minutes."
It is important to understand how that data backup system works. Erwin found out the hard way that his backup systems were not as easy to recover information from as he had hoped.
"At the time we were backing up data onto tapes, which are no longer an effective tool for preparing for a disaster simply because of the time it takes to restore the tapes," he says.
Since Katrina, Erwin's firm captures an image of the data contained on its servers every hour and mirrors that over to an offsite, secondary data center. By doing this, he reduced recovery time from 24 hours to about four. As Erwin's post-Katrina assessment shows, companies should continually revisit their disaster recovery policies.
"It's easy to put together a disaster recovery plan that covers the major areas of a company," Hauschildt says. "What is much harder is the discipline to continually keep the plan updated."