It should be noted that disaster recovery, which is often confused with business continuity, is just a small part of a business continuity system. While disaster recovery will ensure that your data can be restored in the event of a disaster, business continuity refers to all your business critical functions, from premises to project management, and from system backups to your company help desk.
Further, some aspects of your business continuity strategy - such as virtualised servers that back up your data in an off-site data centre - are not just implemented at the time of a disaster; they are ongoing and support data consistency and recoverability throughout your company. Business continuity, in other words, is not just for Christmas.
Business continuity involves working out how your company would reinstate business critical systems such as telephony and IT in the event of disruption. This applies to denial-of-service attacks just as much as to power outages and flooding.
A 2006 study by Coleman Parkes Research on behalf of Citrix into the business continuity practices of European companies found that 52 percent of Irish companies "provide systems that would allow staff to keep working in the event of a business interruption". This compared favourably against 21 percent of French, 25 percent of Italian and 33 percent of German companies.
But do Irish SMEs take business continuity seriously enough?
"The short answer is no," says Gerard Joyce, enterprise risk management director at Shannon-based business continuity specialist LinkResQ. "If you're talking about the IT community they certainly take it seriously enough and a high percentage of IT managers have disaster recovery plans. But business continuity is thought of as a low-probability, high-impact risk that you don't want to have to think about."
The end result, says Joyce, is a mentality of denial, where people think 'It won't happen to us.' So, what should Irish SMEs bear in mind as they try to develop business continuity plans?
Maximum tolerable outage
Ask yourself 'How long can my company afford be away from my customers?' Your answer to this question - whether it be five minutes, three days, or two weeks - is what Joyce calls your 'maximum tolerable outage' (MTO).
"Your answer to that question will determine a lot in terms of your strategies for recovery. If you can afford to be away from your customers for three or four days, you could have a much more relaxed approach to recovery than in the case of company that has to be back up in two hours," explains Joyce.
Minimum essential service
Do you know what your minimum essential service is? Knowing the answer to this question will further aid business continuity planning, as you will be able to identify the key services that your business needs in order to function correctly - for example, telephone systems and PCs with an internet connection.
Prioritise and schedule
SMEs are advised to create a hierarchy of services and schedule business continuity planning around them. It's a matter of deciding between critical functions, which you will need to get up and running in the short term, and less-essential functions that can be postponed a little longer.
For example, you may need to get telephones working again on a same-day basis, but your business could probably withstand a three-day delay in getting bills out to customers. In this sense, developing a business continuity plan will help you focus on what really matters to your business.
Virtualisation
The advent of virtualisation technology has provided SMEs with an opportunity to achieve a level of business continuity and disaster recovery that was previously the preserve of large organisations.
For a fraction of the cost of restoring traditional equipment, virtualisation allows companies to restore their data and servers very quickly in the event of disaster.
But implementing a virtualisation solution can leave you spending a lot more than you had originally intended. "You may end up having to buy new storage architecture, for example, that will work with your new virtualisation solution. You could end up needing a new backup solution as a decision to buy one thing can trigger a much larger investment," says Joyce. "If you look at the total cost of ownership, there will be a total saving, but I suspect that the capital outlay will always be greater than you originally imagined."
However, if you are set to replace those five-year-old servers soon, then now is a good time to consider the move to a virtualised environment.
Get MD buy-in
Getting buy-in for business continuity from the managing director is crucial. "If the MD doesn't support it, doesn't see the importance of keeping the business going in the event of a disaster, whether it's a fire or a flood or a gas leak in the street, the plans won't succeed," says Joyce.
IT staff tend to have a sound understanding of business continuity issues, but they should not be driving business continuity. The impetus should come from operations managers instead.
Remote working
Investigate ways for your staff to work remotely, by providing them with at-home access to files and email. That way, you can minimise the impact of your facility being shut down through a swine flu outbreak, for example.
Keep key files and CDs safe
Store your software discs (along with the relevant licence numbers and passwords) and important documents (such as insurance certificates) in a secure place. If possible, maintain a duplicate set of records off-premises to act as a backup. It's a good idea to keep a list of your staff emails, passwords, and telephone numbers here too. That way, if you are shutting down or relocating your office, you can notify them quickly.