Business issue or an IT issue

BC: A few people around the table have positioned continuity planning as a business issue rather than an IT issue. How much of a stumbling block is it that these considerations are viewed as less important by senior business executives than they are by IT managers?

SB: I don't think that can be disputed - otherwise we would all be retired in the Bahamas. Most business leaders in the mid-market haven't had an 'oh my God' experience: they haven't lost their email for a week, they haven't lost their core financial applications or whatever the case may be. When presented with a business case that suggests they spend a lot of money, it's understandable why they would resist. I don't know an IT decision-maker that wouldn't want to have full business continuity systems in place - they would love to because they would be heroes - but the challenge lies in convincing the people who write the cheques. We don't see the threat of disaster as the business driver today. In fact, it's unlikely to be a disaster that causes a customer to activate business continuity scenarios.

The problem is more likely to be something as simple as losing an application because somebody drills a hole in the wall of a datacentre. That happened to one of our clients in Adelaide recently and they lost their entire storage array. The concepts of business continuity and DR are used too liberally and take many forms. We have some clients that have installed infrastructure in another office where they may do testing and development but, guess what, it's also their DR site. They happen to have the bandwidth, they've bought some replication software, they've got virtualisation in place and it's all too easy. Another organisation might be using a third-party to host their production environment and house DR within their own sites. Business continuity can take many guises. Ten years ago it meant renting or buying another office, spending millions of dollars on infrastructure, paying Telstra a hell of a lot of money for bandwidth, turning off the lights and hoping you never had to use it. That's what DR looked like but today there are myriad options. When I talked earlier about the tipping point, it's about customers deciding which path they go down.

PD: I would argue that every prospect out there now has a DR or business continuity policy and is probably executing it fairly well. We as IT guys trying to sell the kit have to be careful not to think everything is always on, available and totally redundant because I know a number of organisations that would be quite happy to have something offline for a couple of days. The policy is often to find somebody to rebuild or restore it within that time and they will be fine; thank you very much. These are big organisations. I was at one of the big four services organisations in Australia recently and its real-time billing system, which you would think is the lifeblood of an organisation like that, was out for three or four days. It wasn't a problem - they didn't really care. I think DR has moved a long way from the realm of IT into the HR manager's domain because the biggest consideration for any organisation is resourcing. If you have a serious issue where you lose an office in a terrorist attack, or even something less sinister like an outbreak of Legionnaire's Disease, what do you do? That is a disaster.

CS: One of the challenges, but also an opportunity, is that every organisation has a completely different need. It is a business discussion and it's about applications because 90 per cent of the technology we deliver is to people sitting in an office doing a job. They might only use one application and we have one customer removing Windows desktops because everything bar one application is a distraction. DR is not about an explosion in a datacentre; it's about having events like the recent Asia-Pacific Economic Cooperation (APEC) forum in Sydney and people not being able to get into their office. The challenge for us is multiple requirements. We have a number of customers that only care about their financial systems once a month because it is not an ongoing business requirement like communications. If you can't speak to people and interact, that is a disaster. There will be no single DR solution you can take to market because it varies wildly according to the type of business.

CM: It's really about removing that perception that business continuity is an IT solution when it should be considered as a business issue, about risk management. Only when that perception changes will we really be able to get appropriate money allocated. As a vendor, we need to work more closely with our partners to help communicate that shift. For HP, business continuity was typically focused on the enterprise but we are now seeing the mid-market mature and those customers are starting to think about it. Their scales will be different and, for some of them, business continuity might only mean an extra server sitting in the corner that they can switch on and off as required. At the other end of the scale there is total shutdown and moving across to another facility that is ready to go. We definitely have a duty to use our brand in creating a message that tells users what business continuity is. DR is a part of it but business continuity is so much more and that gives us an opportunity for a much richer engagement around policies and procedures. That opens up a whole new can of worms.