Although the traditional definition of disaster might be a storm, fire, natural disaster, power failure, and these days, terrorist incident, these arent the onlyin fact, they arent the majorityof events that are going to require you to use whatever disaster plan you have in effect.

Whats the Worst that Could Happen?

The first thing people think of when they think disaster is a loss of equipment and (in the case of data-processing) the information on it. Water, fire, smoke, and such can wreak havoc on flimsy paper and sensitive circuits.

And even if your equipment is working, you have to think about not being able to get to it. A major snowstorm (or anthrax scare) can keep employees out. One Connecticut business was shut for a day because police shot a suspect who broke into its building. Do you think Office becomes a crime scene was on its list of disaster possibilities?

A disaster might simply be loss of data or access to it. Hard drives crash. Viruses are missed. Disgruntled employees erase files. Depending on the nature of the beast, the damage might worm its way (pun intended) into your network and even your backups.

Todays companies also rely on more and more outside services. Its not just power and waterphones, networks, TPAs, ASPs, and more have become key parts of many carriers businesses. Losing access to them has to be high on the list of Bad Things.

Finally, theres the people factor. Employees quit, are fired, get sick, get arrested, or die. They say no one is indispensable, but thats in the long run. In the short runin the middle of a major projectpeople are indispensable. Losing the wrong person at the wrong time can end up costing time and a lot of money.

Despite all this, many people and companies remain woefully unprepared for things going wrong. Its partly an American thing: We live in a technologically advanced, stable society. The country is rich enough to afford rescue teams, FEMA, and organizations that jump in when things go wrong.

We live in a time when people talk about planned obsolescencethey have to build in defects because so many things are so well made. We do not expect our hard drives to crash, or for the electricity to be out for more than a day. The water runs, the lights light, and the trains all run on time.

In short, we dont expect disaster to strike. We dont expect things to go wrong. And the people who do prepare for it, well, what did most people think of the folks buying canned food and generators in December 1999? People who plan for disasters, many people think, are kooks.

But they are only kooks if nothing happens.

As silly as it may seem when the sun is shining and the sky is clear, you need to plan for the sky to darken, the asteroid to hit, the dam to burst, and all sorts of other things its easier not to think about.

Be Prepared

Obviously, you need to have a plan. (Obviously, because many carriers now demand disaster plans from their insureds as a requirement for coverage. The pot cant be calling the kettle black.) It needs to be carefully written and distributed to everyone who needs it, so that if any of the things listed above happen, there are several people who have a good idea what needs to be done.

You need to strike a balance between four things: what you might lose, what it will cost to prevent it, what it will cost to recover it, and what it will cost not to recover it. There will be some cases when it might not be worth it to spend a lot of time, money, and energy to prepare for something that either wont happen, or that isnt expensive to recover from.

Your plan has to take into account the four corners of business: Data, systems (to work with the data), people (to use the systems), and communication (to share it all). Make sure that your plan has provisions to restore all four; miss one, and you might find your company cant do its business.

And remember to plan for the worst. You cant simply think If the head of IT cant get into work, her duties will be split among Smith, Jones, and Johnson. What if the entire IT department goes to a conference and gets snowed in? Dont just plan for losing power for a day; plan on losing it indefinitely. Dont just plan for losing some of your data; plan on a virus that destroys all of it.

Finally, you need to plan for a lack of warning. If something happened this very second, what would you lose? If youre typing in a file, how often do you save it? If the dam upriver burst at 4:45 p.m., would you lose the entire days work? Disasters dont always strike overnight.

Think about this, but dont actually do it: If you shut the power to your office for a moment, how many people would lose how much? How many save their work every few minutes, and how many go to lunch without hitting Ctrl-S? How often do you back up? Is it continuous, possibly to a RAID array or a SAN? (If you dont know what those terms are, you need to learn quickly.)

One potentially powerful tool for disaster planning is outlining the consequences of not taking action. Its one thing to say We dont back up often enough. Its quite another to give specific examples of what might happen: If we were to lose power for more than six hours, this would happen and it would cost this much. If we couldnt get into the building because of weather or disaster, this is how much money wed lose. If Jimmy in IT quit tomorrow, these systems would fail in two days.

No matter how much preparation you do, the fact is, you arent disaster plannersyoure insurance people. Things will slip through the cracks. You can automate lots of procedures, like backups and anti-virus updates, but you cant automate everything, and eventually human beings make mistakes.

Eventually something will go wrongmaybe a hard-drive failure, maybe the wrong person will quit the company, or maybe the dam upriver will burst.

When that happens, youve run out of options. You need to make your choices and your plans now. When the lights go out, it will have been up to you whether you sit in the dark, or know where the light bulbs are.

Disaster Prevention?

You can prevent disasters. Buy equipment that never fails. Build your business where there are no natural disasters and the weather is perfect. Have an on-site generator and uninterruptible power supply for all your systems. Be nice to your employees. Have anti-virus software and update it regularly. Hire only happy, hardworking people who never do stupid things.

The fact is, there is very little you can do to prevent a disaster. Yes, an on-site generator or updating your anti-virus software can certainly reduce your risk, but theres a reason people speak about disaster planning and disaster recovery and not as much about disaster prevention. (Although disaster prevention isnt out of the questionyou can prevent an annoyance from becoming a disaster.) AK