"Because of the number of moving parts, it's more complex to blueprint. You have to know the connection points, what would happen in a disaster," Popolano said. "We all lived through Katrina and Sandy—and we're very concerned about something like that happening again."

Ten Minutes of Downtime: A New Disaster Recovery Standard

While technology can increase the complexity of disaster recovery, it has also long been a key tool for preparedness, particularly for protecting data and information systems that are the backbone of every company's operations. For example, in years past, an insurance company might maintain offsite locations for its production systems and run DR tests at least annually using data backup tapes—providing the means for a relatively timely recovery in the case of an actual disaster. 

"If you could be up and running in, say, 48 hours, that was pretty good," Furtado said. But no longer. 

"There still are a fair number of insurers working under the paradigm that getting back up and running in 48 hours would be acceptable, but nowadays there is little tolerance for being out of business for five minutes," she added. This means going beyond data backup. 

Data center co-location, a redundant location of the production environment, is now a widespread practice in insurance and in other industries that manage large amounts of critical, sensitive data. A "co-lo" is essential if you cannot afford days or even hours of systems downtime. 

"A lot of insurers are saying, 'If I have co-location, especially if I have a shared production environment over two completely different infrastructures, I don't have to experience downtime.' At most, if their information systems are set up as a co-location, we're talking about 10 minutes," according to Furtado. "This is completely different from your father's disaster recovery plans." 

Many companies are now able to leverage scaled-down co-location in conjunction with the cloud to create a more cost-effective disaster recovery solution. "Cloud has opened up a new world, and the ability to talk about scalability," Furtado said. "Disaster recovery through the cloud means I don't have to worry as much about physical environment. The cloud offers a different time frame and different delivery model for disaster recovery—and it has brought down the price point of DR. It's more consumable, and can be much more easily brought to many locations."

For instance, Patriot National Insurance in Fort Lauderdale, Fla., adopted a disaster recovery platform provided by CenturyLink Technology Solutions (formerly Savvis) that allows for a much more limited investment in data center co-location.   

"We signed an agreement to utilize their Santa Clara site in California, because we're East Coast-based," said Judith Haddad, Patriot's executive vice president, CIO and CTO. "We have a hybrid agreement with a small physical co-lo area, and have the ability to spin up whatever we need on their cloud site in a disaster scenario." 

Haddad described this setup as "my perfect world" for several reasons. Disaster recovery testing is streamlined. "It gives my team the experience to work within the cloud with core applications." Most importantly, she is able to have full system redundancy at a lower cost. 

"What I wanted to do ultimately is balance the cost of disaster recovery—there's a cost to have a full data center that sits there, just in case," she said. "We have the alternative to go cloud-based. If I regularly plan and schedule the spin-up of all applications, and we're 100% virtualized, that's our DR exercise, and it costs less than having a second data center as a DR site. I've saved money and also utilized technology that I don't have to keep current, because that's the cloud service provider's responsibility."

DR Due Diligence: Reevaluating Disaster Preparedness

There is no time like the present for risk managers and insurance companies, agents and brokers to revisit their disaster recovery plans (and those of their customers and suppliers). Annual events, insurance renewals or disaster recovery tests, for instance, and times of transition, new leaders, locations, information systems, acquisitions, or offerings, can be good times to make sure the company is prepared for the worst of times. 

"If you are undertaking a core system change, that should be a trigger point for evaluating your DR plan," Furtado said. "If you're not going through change, but have not revisited DR plans for two to three years, then I definitely would be revisiting them." 

If Business Is Interrupted, Are You Covered?

With supply chain risks and other exposures on the rise, insureds seek enhanced coverage for business interruption and contingent business interruption

According to AON research from 2007, 2009, and 2011, companies consistently rank business interruption as one of their top five risks. Unlike competitive threats, government regulation, and other highly ranked risks in business, interruption is one for which companies can be prepared and insured. 

Thanks to the growing frequency of catastrophes and other disruptions to operations, virtually every large company—and a rapidly growing number of small and midsize companies—obtains property insurance that includes business interruption (BI) and contingent business interruption (CBI) coverage. BI covers the insured when damage or destruction of the company's property results in interruption of business operations. CBI covers the company when its suppliers or customers suffer a loss that in turn interrupts the company's operations and impacts its profits. 

Both products are widely used by large companies, and recently BI and CBI have become relevant and affordable for many small and midsize businesses. CBI coverage is of particular value to any organization that is vulnerable to a disruption in its supply or demand chain. However, with CBI, it can be a challenge to ensure comprehensive coverage of all the risks faced in today's global supply marketplace.

"If you have a long supply chain, disaster can hit any of these points, and it becomes very difficult to underwrite all those suppliers and to put a price point on it," said Monique Hesseling, partner in insurance consulting at Strategy Meets Action. "So you end up focusing on a handful of key suppliers, rather than blanket risks. Focus on the five most critical suppliers and try to calculate impact of disaster on those." 

Hesseling cited recent research by Swiss Re and Airmic, the European insurance association, indicating that "there is a big need for supply chain coverage, especially due to increased cats, but risk managers believe that the current offerings are not doing what they would like the policies to do." 

It's not that insurers aren't paying attention—"there are some very innovative new products," Hesseling said, noting for instance that "Swiss Re is looking at mitigating weather impacts." Still, she added, insurers remain challenged to offer financially viable, actuarially sound products for supply chain and other business interruption risks "that will do what customers need and can be priced appropriately."