WIXLIB

Midmarket FirmsAdvance Their DR PlansA full-time director and dual data centersare among the measures employed. BY MICHAEL YBARRAFOhioHealth, aColumbus-based medicalcare nonprofit, reconfiguredits network, which cut off theemergency room at one ofthe organization’s 17 hospitals fromthe data center for 45 minutes. IT hadbecome so central to the hospital’sfunctions that management wasabout to start redirecting patients toother emergency rooms when serviceresumed.“That surprised a number of people,” says Bob Patterson, director ofbusiness continuity and informationdisaster recovery at OhioHealth. Hewas hired shortly after the event torevamp the organization’s disasterrecovery (DR) and business continuity (BC) strategy. “The attitude ofmany people initially was that wetook care of patients before computers and we can still take care ofthem [without computers]. That'schanged.”At the time, OhioHealth was outsourcing a hot site to provide failoverDR coverage. But management realized that the organization needed toinvest in a state-of-the-art BC program, so Patterson was hired to putOUR YEARS AGO,EDITOR’SLETTERPART 1:BUSINESS,INTERRUPTEDPART2:YOUR UNIFIEDCOMMUNICATIONSSTRATEGY8 CIO DECISIONS EZINE DECEMBER 2008/JANUARY 2009together a five-year plan to improveOhioHealth’s preparedness.“It was a massive undertaking,” CIOMichael Krouse says. “We got Bob forthe sole purpose to develop a highavailability business continuity plan.After three years of effort, we’re in thewind-down phase.”OhioHealth found itself in the sameplace as many upper-midmarket com-In a TechTarget surveyof 386 midmarket ITexecutives, nearly60% reported DRimplementation plansfor 2009.panies: with disaster recovery andbusiness continuity plans that weregood but not great. And it was time tomake the leap to an enterprise-classsystem.Indeed, beefing up DR capabilitywas the No. 2 priority for the morethan 200 IT executives who responded to Computer Economics Inc.’s IT

EDITOR’SLETTERPART 1:BUSINESS,INTERRUPTEDPART2:YOUR UNIFIEDCOMMUNICATIONSSTRATEGYSpending, Staffing and TechnologyTrends poll, conducted in the firstquarter of 2008. And in a TechTargetsurvey of 386 midmarket IT executives in September, nearly 60%reported DR implementation plansfor 2009—more than any other typeof technology project.That’s certainly true of Jim Honerkamp, CIO at The Hillman GroupInc., a Cincinnati-based midmarketdistributor of fasteners and otherhardware items. The company, whichhas grown through acquisitions tobecome a half-a-billion-dollar business, hired Honerkamp four years agoto reinvent the way it used information technology. High on his list ofpriorities has been creating a robustDR/BC strategy.“We didn’t have the budget for DRbefore,” he says. “We used to outsource the data center—nothing wasredundant. Now we’re moving to atwo-data center scenario, both active.I can’t afford to have a data center sitting around, waiting for a disaster tohappen.”The increasing importance of business continuity is underlined by aGartner Inc. survey that found thatthe majority of executives tasked withthe subject report directly to the CEO(22%), followed by those reporting tothe CIO (16%).INVOLVE THE BUSINESS SIDERoberta Witty, an analyst at Stamford,Conn.-based Gartner, says that whilemany midmarket firms have adequatebackup systems in place, not all com-9 CIO DECISIONS EZINE DECEMBER 2008/JANUARY 2009panies involve the business as completely as necessary to ensure a trulyeffective strategy for continuity. Shetells CIOs that they need to performgap analysis to determine whereplans need to be improved as well asexpand the scenarios and outage timeframes that might accompany region-“Now we’re movingto a two-data centerscenario, both active.I can’t afford to havea data center sittingaround, waiting fora disaster.”—JIM HONERKAMPCIO, THE HILLMAN GROUP INC.al disasters or even a pandemicbreakout such as the SARS virus inChina.“Getting the business to buy in isstill a fairly sizeable task for many ITexecs,” Witty says. “In many cases,organizations have good DR plans inplace. But they’re not getting the support from the business for recovery.It’s a lot more than technology. It’shaving the right staff, a key group ofpeople. Some organizations think aslong as they have data backup that’sgood enough. That may be goodenough for data center disruptions,but do they have work-area recoveryplans in the event of a regional disaster or plans on how to get in touchwith people?”

That’s precisely the approach OhioHealth took. Patterson started by cataloguing the hundreds of apps usedby the organization, ranking them interms of recovery time objectives(RTOs) on a scale of zero to five: thefirst two being mission critical, thenext two less important and the lastnot important. (See related story,“Identifying Crucial Apps a Key Stepfor DR Plans.”)“Every time we intro a new app wehave to go through the process again,”Patterson says. “Everyone thinks theirapps needs to be high-availabilityuntil you go through the cost. We do apretty good job figuring out whichones really matter.”DECISION POINT:BUILD A NEW DATA CENTER?EDITOR’SLETTERPART 1:BUSINESS,INTERRUPTEDPART2:YOUR UNIFIEDCOMMUNICATIONSSTRATEGYOne key early decision for OhioHealthwas whether to upgrade the hot-sitecapability to high availability or builda second dedicated data centernearby.“For medical imaging the volumesof data were too high to handle over along-distance link,” Patterson says.So OhioHealth opted to build a newdata center 10 miles away, connectedwith a 10 GB fiber connection, whichallows the organization to fail over infive minutes for the most importantapplications. The center was situatedperpendicular to the normal tornadotrack that threatens the area.After three years the data center islive for mission-critical apps. Duringthe next 18 months, the organizationis working on setting up a quick ship10 CIO DECISIONS EZINE DECEMBER 2008/JANUARY 2009program for vendors to supply equipment for less important apps, whereRTOs are on the order of days or evenweeks.“The technical challenges were significant,” Patterson says. “We did“We do a pretty goodjob of figuring outwhich [applications]really matter.”—BOB PATTERSONDIRECTOR OF BC AND INFORMATION DR,OHIOHEALTH.stuff that was not commonplace. Wewere ahead of our vendors. They clustered databases but not the userinterfaces. That’s not high availabilityfor us. We had to lead the vendorsthrough a lot of this stuff.”Krouse adds: “We put a fair amountof pressure on our vendors. We have adefinition of high availability, whichmeans the entire system is duplicable.That definition has to be met by ourvendors. That’s a critical discussionitem with vendors before we sign acontract.”The result, Krouse says, is the hospitals will still be running as long asthey’re standing.“We plan for anything you coulddream up,” Krouse says. “Tornado,bombs. We’re not too worried abouttidal waves.” Michael Ybarra is a monthly columnist forSearchCIO-Midmarket.com. Write to him ateditor@searchcio-midmarket.com.

Identifying Crucial AppsA Key Step for DR PlansDoes email really drive your business?Experts weigh in on how to define what is essentialand plan for recovery. BY SARAH VARNEYWHEN DISASTER STRIKES,EDITOR’SLETTERPART 1:BUSINESS,INTERRUPTEDPART2:YOUR UNIFIEDCOMMUNICATIONSSTRATEGYwhich applications areset to come back upfirst? Your missioncritical apps are a nobrainer. But what about the applications responsible for feeding data tothose systems? What’s the recoverytime objective for those?Of all the tasks associated with disaster recovery (DR) planning, one ofthe most important is the classification of a company’s applications.Determining criticality is a key aspectof creating a business impact analysis(BIA)—the foundation of any DR plan.Questions such as “Which applications should be taken down first, considering underlying data dependencies?” and “How many DR dollarsshould we spend to keep this datasafe and/or easily accessible?” mustbe answered as part of the planningprocess.Midmarket companies often use aBIA questionnaire to get started.These are mainly “yes” and “no”checklists that specify the hardwareand software in operation and alsocapture information on who uses11 CIO DECISIONS EZINE DECEMBER 2008/JANUARY 2009which applications. They can be agood starting place, but they havelimitations, says Mike Summers, managing director of the disaster recoverypractice at Computer Sciences Corp.“Using BIA questionnaires is a balancing act between art and science.Everybody thinks their application isthe most important. We interviewthem and ask, ‘The application wentdown a few weeks ago and what happened?’ The answer is usually quiterevealing in that it may not have beenthat big a deal,” he notes.“Everybody thinkstheir application isthe most important.”—MIKE SUMMERSMANAGING DIRECTOR, DISASTER RECOVERYPRACTICE, COMPUTER SCIENCES CORP.Whichever applications are taggedas critical, planning is everything,Summers stresses. “You do your planning up front. You don’t want to haveto think about what applications tobring down in what order. You need a

footprint to work from,” he says. Atmost companies, business and ITmanagers draw up a list of criticalapplications together, sometimesusing a questionnaire as a startingpoint.Ideally, IT and business managershave similar views on which applications are truly critical, and many do,according to a 2007 Gartner Inc.study of nearly 600 IT managersand business managers, conductedfor SunGard Availability Services LP.In the study, both groups listedemail, customer service, back-office,telecommunications, websites, orderentry and submission, and customerrelationship management (CRM)among the top applications affectingrevenue during unplanned interruptions.In the case of email, 52% of ITdepartment managers considered itamong the top five and 48% of business managers pretty much agreedwith that assessment. Forty-nine percent of business managers named“In general, criticalapps are those thathave the most effecton a company’sbottom line.”—ODED HANERCIO, MONSTER CABLE PRODUCTS INC.customer service to the top five, while44% of their IT peers perceived itsimportance similarly. The only realdigression occurred with CRM applications: 29% of IT managers put it intheir top five, while 40% of the busi-The Most Critical AppsBusiness and IT professionals largely concurred on the importanceof the following applications, except for CRM.% CITING AS A TOP-FIVE APPLICATIONIN REGARD TO IMPACT ON REVENUEAPPLICATIONEDITOR’SLETTERPART 1:BUSINESS,INTERRUPTEDPART2:YOUR UNIFIEDCOMMUNICATIONSSTRATEGYEmailCustomer serviceBack-office (ERP, DBMS)TelecomWeb %36%29%N 350 I.T. DEPARTMENT MANAGERS AND 176 BUSINESS DEPARTMENT MANAGERS.SOURCE: 2007 GARTNER INC. SURVEY SPONSORED BY SUNGARD AVAILABILITY SERVICES LP.12 CIO DECISIONS EZINE DECEMBER 2008/JANUARY 2009

ness group surveyed listed it as a topfive concern.The alignment within the study wasquite surprising, says John Morency,research director for the disasterrecovery practice at Gartner, an ITconsultancy based in Stamford, Conn.“Within those critical applicationslisted by the IT and business groups,it turns out that for 80% to 85% ofthose apps, the consensus is that theymust be restored within 24 hours orless,” Morency says.tion times for both the BI app and thedatabase that processes the data.Oded Haner, CIO at Monster CableProducts Inc. in Brisbane, Calif., disagrees. At most midmarket IT shops,“It’s nearly impossiblefor small companiesto get disasterrecovery right.”—GIL HECHTCEO, CONTINUITY SOFTWARE INC.MIDMARKET DR: EASIER OR HARDER?EDITOR’SLETTERPART 1:BUSINESS,INTERRUPTEDPART2:YOUR UNIFIEDCOMMUNICATIONSSTRATEGYAgreement between IT and businessmanagers about which applicationsare truly critical is great, but there arestill the underlying technical issues toconsider. In general, disaster recoveryplanning can be particularly difficultat midmarket companies, says GilHecht, CEO at New York-based Continuity Software Inc., which makes DRsoftware for enterprise-sized companies.“It’s nearly impossible for smallcompanies to get disaster recoveryright,” Hecht says. They may not beequipped to discover the underlyingdata dependencies that can affectoperations between two critical applications. For example, data coming into a database from a business intelligence (BI) application may increaseby a magnitude that necessitates configuration changes to hardware orstorage. These changes might not bereflected right away in a DR plan. Evenin a testing scenario, these configuration changes may lengthen restora-13 CIO DECISIONS EZINE DECEMBER 2008/JANUARY 2009changes to critical production applications are generally communicatedbetween IT personnel, he says—or atleast, that’s how it is at Monster,which has a revenue in the range of 500 million yearly. “It’s not that biga deal,” he says. “When you makemajor changes you talk about them,and you always consider disasterrecovery.”People do sometimes have misguided ideas about which applications aretruly critical, says Haner, echoingComputer Science's Summers. “Emailis a good example. Many people gothrough daily problems with email,but it has no direct impact on a company’s bottom line,” Haner notes. “Ingeneral, critical apps are those thathave the most effect on a company’sbottom line.”At Monster, Haner and the company’s business managers carefullyweighed the costs of having applications out of commission and thedirect revenue effects of an outage.

“The first half a day, it costs hundredsof thousands of dollars to be completely without systems, but two dayslater, the effect is exponential and it’scosting millions,” Haner explains. Inlight of these costs, Monster’s disaster recovery plan calls for systemrestoration ideally within 12 hours.The most critical application atMonster is ERP. However, all of thecritical applications—ERP, the warehouse management system andemail—are set up with asynchronousdata dependencies. This strategynicely sidesteps any underlying datadependency problems. Hanerexplained the setup: The CRM systemdepends on customer records in theERP system. If the CRM system stopsworking, the data is still pushed to theERP system separately. When theCRM system comes up again, the ERPsystem updates it and the data is synchronized. “All of our systems are setup this way,” he notes.The order of restoration is ERP, thewarehouse management system andthen email and business intelligence.“BI is not part of my disaster recoveryplan. It’s really used for strategy andforward-thinking goals. It has noimmediate impact on revenue,” Hanersays. He noted that there’s too muchdata being fed through the app toback up anyway. “I’ve yet to find agood disaster recovery product forbusiness intelligence,” he says.Which applications are consideredcritical in a disaster recovery contextvaries greatly from company to company, Summers stresses, adding itcan even be seasonal. “We have awhole set of clients for whom it woulddepend on the time of year [for a disaster to occur]. For one giant schooltesting client, in September, out ofhundreds of applications, they mightrecover one application set in a certain order. In January, they might havea plan to recover a different set witha longer recovery time,” he says.Who knew that even disaster planning could depend on the schoolyear calendar? Sarah Varney is a contributing writer toSearchCIO-Midmarket.com. Write to herat editor@searchcio-midmarket.com.PODCAST: DR BUDGETING AND RTOEDITOR’SLETTERPART 1:BUSINESS,INTERRUPTEDPART2:YOUR UNIFIEDCOMMUNICATIONSSTRATEGYIf your website is down, what's the cost to your business? How fastwill the CEO come pounding on your door wanting to know when thephones, website and other basics will be up and how the downtime willaffect the business?Learn how to address these and other disaster recovery budgetingand recovery time objective issues in an expert podcast from SearchCIO.com.14 CIO DECISIONS EZINE DECEMBER 2008/JANUARY 2009

ALTERNATIVE THINKING ABOUT VIRTUAL STORAGE:VIRTUALIZE STORAGE NOW.HP STORAGEWORKS EVA4400Up to 96TB virtual storage capacity.A powerful business innovation in data storage is now within your Enterprise-class performance Over 30% better capacity utilization* Up to 75% less time needed toconfigure and manage* Easy application integrationreach. The new HP StorageWorks 4400 Enterprise Virtual Array is here.It virtualizes up to 96TB of storage—across numerous storage servers andplatforms—simplifying storage management and speeding access. Lesslimitations. More freedom. Technology for better business outcomes.Now’s the time for virtual storage.Visit hp.com/go/virtualstorage 2008 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. *Source: Edison Group.

DR Mission:Find the Best for LessWhen a hurricane rampage revealed the needfor a new plan fast, a Florida school turned to partnersto help craft a robust, affordable solution.BY MICHAEL YBARRAWHEN HURRICANE FRANCESEDITOR’SLETTERPART 1:BUSINESS,INTERRUPTEDPART2:YOUR UNIFIEDCOMMUNICATIONSSTRATEGYslammed into WestPalm Beach in 2004,MedVance Institutewent into its disasterrecovery (DR) mode: IT Director DanWeiss packed the school’s serversinto his car and drove to his house,where he set up a makeshift data center for several days.MedVance, which trains medicaltechnicians at campuses across fourSoutheastern states, was hard hit bythe hurricane. It took out threeschools, including blowing the roof offone, and it destroyed servers housingseveral weeks’ worth of user data thatwasn’t backed up.“We didn’t have a cohesive disasterrecovery plan in place,” Weiss says.“We took our core services for customer relationship management andemail and physically relocated them.The roof was blown off a couple ofcampuses; servers wound up underwater. That was a big wake-up call.”MedVance is typical of many companies that have just entered the midmarket space: Growth and depend-16 CIO DECISIONS EZINE DECEMBER 2008/JANUARY 2009ence on technology is exploding, butDR and business continuity (DR/BC)planning is lagging. The companystarted with a single campus sevenyears ago in Tennessee but has grownto 11 locations (with headquarters inWest Palm Beach). There are plans toopen two more schools this year andfour the next.Weiss has been at the compa

ALIGNING IT AND BUSINESS IN THE MIDMARKET ENTERPRISE CIO Business, Interrupted ezine Dec.2008/ Jan.2009 Volume4 plus: UC:AWAIT-AND-SEE PROPOSITIONP.24 UNIFIEDCOMMUNICATIONS FAQP.26 FMCANSWERSTHECALLP.30