| You are thinking about implementing the business | | | | would be enough to store the backup tapes at |
| continuity management/BS 25999-2 standard? | | | | the alternative location, allowing you two weeks |
| But then you hear it will cost you a lot? It | | | | to obtain the necessary equipment. All this means |
| probably will cost you, but not necessarily as | | | | that your RTO must not be too long, but not too |
| much as you thought - this you can solve with | | | | short either. |
| good business continuity strategy. | | | | Once the RTO is set, you will still need to make |
| Business continuity strategy, as defined in BS | | | | some investment; however, with a good business |
| 25999-2 standard, is an "approach by an | | | | continuity strategy you will be able to decrease |
| organization that will ensure its recovery and | | | | that investment, while still being able to recover |
| continuity in the face of a disaster or other major | | | | your critical activities within the recovery time |
| incident or business disruption". Therefore, the | | | | objective. Here are some examples: |
| point is to prepare yourself in the best possible | | | | - You might not need your own data centre at an |
| manner to counteract a disaster if such would | | | | alternative location - in most countries you can |
| occur. This preparation can include organizational | | | | rent such a location from a specialized company, |
| measures (drawing up plans, making contracts | | | | which means you don't need to invest in |
| with suppliers/partners, exercising, reviewing, | | | | infrastructure, maybe not even in equipment or |
| awareness raising, etc.), and measures including | | | | software, |
| investment in equipment, infrastructure etc. | | | | - You might not need offices at an alternative |
| Time is a very important factor in recovery - if | | | | location - employees who do not have to meet |
| you do not recover your business in time, you will | | | | customers face-to-face can work from their |
| probably lose your customers and consequently | | | | homes, |
| lose your business as well. So the business | | | | - You might not need an alternative location at all |
| continuity strategy must set the recovery time | | | | if you have other business units at different |
| objective (RTO) for each of your critical activities, | | | | locations which could take over the critical |
| whereas RTO can be different for each of those. | | | | activities affected by the disaster, |
| One important consideration: the shorter the RTO, | | | | - You might not need to purchase equipment in |
| the bigger the investment you will need - for | | | | advance if you can find the supplier that could |
| instance, if you want to recover your data centre | | | | guarantee the delivery of equipment within your |
| in less than one hour, you will have to invest in an | | | | RTO. |
| alternative location almost the same equipment as | | | | In all these examples you will need to increase |
| in the primary location; on the other hand, if you | | | | your organizational capabilities, but if you want to |
| want to recover your data centre in two weeks, | | | | save some money, it sure is something worth |
| the investment will be much lower because it | | | | thinking about. |