5 Keys to Virtualizing Disaster Recovery

On the weekend of Oct. 26, 2012 -- just before Hurricane Sandy was predicted to make landfall in the Northeast -- SunGard Availability Services received 342 notices from customer companies across all industries that anticipated disaster situations.

"It was about the same magnitude as 9/11," says Michael de la Torre, VP of product management, recovery services at SunGard, of the number of pre-disaster notifications.

What has changed since 9/11 is the expanded access to hosted availability services, widespread IT virtualization, and cloud-based storage, all of which are giving insurers more flexibility to plan for a disaster, protect critical data, and respond to business interruption.

Of the 342 pre-Sandy alerts SunGard received, 117 became actual disaster declarations. Despite office blackouts and flooding, these businesses continued to run because each had developed a disaster recovery plan with SunGard, which provides software and processing solutions, managed IT services, information-availability consulting services, and business continuity managed software. Their data and systems were readily available so their employees could work through the hurricane at home, in a SunGard facility, or in mobile recovery units, which SunGard offers to accommodate workers displaced by catastrophes.

Although cloud-based disaster recovery appeals to many smaller financial services companies for the obvious economic and speed factors, there also are ongoing concerns among companies of all sizes about control and security. But by harnessing the benefits of modern IT capabilities around cloud, virtualization and remote servers, and hosted facilities, insurers can improve business continuity and minimize disruption. Here are five tips for how companies can leverage modern capabilities to prepare for the worst:

1. Get An Early Start

Insurers should start by storing data in an off-site location where it can be accessed in an emergency.

SunGard client Princeton Insurance, a healthcare professional liability insurer in Princeton, N.J. (approximately $200 million in annual premium, according to a 2012 company statement), was ready to declare disaster after Sandy struck.

"This was the first [emergency] that we really had to deal with," says Nicole Gadbois, director of network operations at Princeton Insurance. Fortunately, the company's disaster recovery plan was in place before Sandy struck. Princeton backed up its data on a regular basis to disk and tape, and it determined who would take charge of certain responsibilities in an emergency.

[New Zealand insurer revamps core after quakes]

Gadbois also recommends organizing the disaster recovery plan in a booklet or document to share with employees so they're aware of their responsibilities.

2. Know Your Business Objectives

Companies need to consider their specific business needs to determine an effective emergency plan, according to SunGard's de la Torre. How long can you afford for business to be down? Can all employees work remotely?

Some companies, such as Amazon and most financial firms, must run 24/7. For them, de la Torre recommends having all data automatically uploaded to a remote server. They should also determine an immediate action plan so that when disaster strikes, the off-site data can be quickly accessed and business can continue. Other companies may go down for a day, such as what occurred with Princeton Insurance post-Sandy, and give employees more time to activate a disaster recovery plan and access their data.

Employees with laptops often can work remotely, but this isn't always possible. Insurers should plan an alternate office location where displaced workers can access desktop PCs and phone lines. Princeton Insurance's Gadbois recommends keeping office supplies handy -- something her team never needed in rehearsals but required during the superstorm.

3. Practice, Practice, Practice

Princeton Insurance was able to continue its business throughout the superstorm because the company had rehearsed its recovery plan. Twice a year, Gadbois and her team tested and restored their data and systems through SunGard to ensure that they were ready.

This example can be used as a model for any emergency strategy, according to de la Torre. If data is stored off-site, regularly test the system to ensure that information will be accessible when it's needed.

4. Share Critical Knowledge

Critical staff members may not be available in disaster situations because of personal issues or family emergencies, so at least one other person should hold important business information to help the company keep operating, de la Torre urges.

5. Consider The Cloud

After Sandy, Princeton Insurance implemented cloud-based email services. "During the hurricane, email was down and employee communication was tough," notes Gadbois. "The cloud is more reliable."

Storing data in the cloud can also help with more efficient disaster recovery, de la Torre notes, as it provides easier data access than do physical tapes. However, cloud storage preparation can take months. "If you're leveraging cloud-based services for disaster recovery, you need to do it well in advance," he says.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio