Business continuity and disaster recovery outsourcing tutorial

By Paul Kirvan

Outsourcing disaster recovery (DR) and business continuity (BC) services can save you money and increase productivity by transferring some IT functions to experienced third parties, but it also has its downsides.

In this tutorial, you'll learn who should outsource DR services, vendors in the DR/BC space, and how to choose a provider.

Table of contents

>> Getting ready for BC/DR outsourcing
>> Disaster recovery/business continuity service providers
>> Questions to ask potential DR/BC firms
>> A RFI checklist for DR/BC providers

 Getting ready for BC/DR outsourcing

Large companies may have their own BC/DR function, especially if they are regulated (e.g., banks, investment firms, utilities) and must have BC/DR in place. Small- to medium-sized (SMBs) businesses are less likely to have a BC/DR function and may therefore be candidates for outsourcing. But that is contingent on management's willingness to have a BC/DR function, which in the current economy may not be a high-priority activity.

Assuming a company -- regardless of size -- decides to initiate BC/DR, it has several options: 1) in-house development; 2) using a suitably qualified professional services firm (e.g., consultant or vendor) for a one-time BC/DR project; or 3) using the same kind of firm to create an ongoing BC/DR activity. Considerable due diligence and a sufficient budget are needed when considering outsourced solutions.

 Editor's Tip: For more information on DR/BC planning for financial organizations, read Paul Kirvan's article on business continuity in the finance and healthcare sectors.

 Disaster recovery/business continuity service providers

Depending on the BC/DR work required, dozens of firms are available to provide services ranging from program development and exercising to data backup/storage and emergency recovery sites. It all comes down to the need for BC/DR services, availability of management support and a budget.

Of the dozens of small to large BC/DR consulting firms, most can provide assessments, plan development, plan exercising and plan maintenance on a one-time or ongoing basis. For more significant requirements, such as data backup/storage and recovery, recovery sites and alternate work spaces, companies including Agility Recovery Solutions, AmeriVault Corp., Hewlett-Packard (HP) Co., IBM Corp. Disaster Recovery Services, Iron Mountain, SunGard Availability Services, and Xand Inc. offer many different options. Software vendors such as Kingsbridge Disaster Recovery and TAMP Systems also offer managed services. Major contracting firms such as EDS, CSC, Unisys and Perot Systems also offer BC/DR services.

Many options are available when outsourcing BC/DR. Most firms prefer a monthly fee arrangement for a set contract period. Some may require an initial up-front payment -- especially if the project is substantial -- followed by incremental monthly or quarterly payments. Cheapest monthly fees are probably in the neighborhood of $100 to $500 for quick reviews of existing plans or for alternate space that is available in case the client has to relocate employees temporarily. These can expand dramatically into thousands a month for hot site arrangements and large-scale project management fees.

Questions to ask potential DR/BC firms

Before searching for prospective BC/DR outsourcing firms, analyze your needs first. Ask the following questions:

1. What do you want to outsource?
2. What are your objectives in outsourcing?
3. What type of an outsourcing agreement are you seeking?
4. What offshore outsourcing locations interest you?
5. What services do you expect a vendor to provide?
6. How much do you plan to spend?
7. What are the risks associated with such an outsourcing agreement?
8. What qualified vendors are available to provide solutions?

In answer to question 1 above, from a BC/DR perspective you have several options, including:

• Assessments and audits of existing operations
• Risk assessments
• Business impact analyses
• Strategy development
• Plan development
• Policy development
• Plan exercising
• Awareness and training
• Plan maintenance
• Data backup and recovery
• Alternate office space
• Network / infrastructure resilience
• Software / application selection

A RFI/RFP checklist for DR/BC providers

You may want to release a Request for Information (RFI) about prospective suppliers or perhaps a Request for Proposal (RFP) if you know what you want. Items to address include:

• Availability of equipment and/or needed services
• One-time and recurring costs
• Comparison of similar offers from other vendors.
• Ability to support project goals, deliverables, performance and fulfillment requirements, and liquidity damages
• Experience stability, available services and reputation
• Staff details including project management, project teams and their technical experience and credentials
• Methodology that details project management, quality, regulatory compliance and security activities
• Documented success of vendor methodology
• Infrastructure stability and disaster recovery abilities
• Vendor profile, strategy, mission and reputation
• Vendor financial status, e.g., reviews of audited financial statements
• References, preferably from similar outsourced processes
• Quality initiatives and certifications
• Technology, infrastructure stability and applications
• Security and audit controls
• Legal and regulatory compliance, including complaints or litigation
• Policy regarding use of subcontractors
• Insurance coverage, e.g., liability, errors and omissions
• Vendor corporate policies for BC/DR and security

In these difficult times, BC/DR programs still focus on protecting staff, company assets and shareholder interests. Although business leaders are constantly challenged to look at things from different perspectives, BC/DR professionals must ensure that the business stays in business. Outsourcing BC/DR is yet another way to manage business survival while keeping pace with changing business dynamics.

 Editor's Tip: For more information on DR/BC vendors, read listing of  "A sampling of disaster recovery/business continuity providers."

About this author: Paul F. Kirvan, FBCI, CBCP, CISSP, has more than 20 years experience in business continuity management as a consultant, author and educator. He is also secretary of the Business Continuity Institute USA Chapter.