[return to Table of Contents]
The primary goal of business continuity (BC) planning and its related disciplines of disaster recovery (DR) is to increase the likelihood of a working production unit (a business, government office or other entity dependent upon IT) surviving a disaster. Gartner Dataquest provides basis via statistics and market information to delineate the size of the market and outline an important shift in this market's future. The particular opportunity for a hybridized new type of service — which focuses on a combined value proposition between high-availability services and DR and BC offerings — is dawning.
Gartner Dataquest describes the market for DR and BC, exclusive of data storage products and services and software products and maintenance, and those high-availability services sold as product support agreements by vendors of IT. The global market is growing at a faster rate — a compound annual growth rate (CAGR) of 14 percent — than the North American region (11 percent CAGR), as IT buildup expands to more places globally, touching more IT consumers who need insulation from unreliable infrastructures among other local conditions.
During a survey of IT managers, which Gartner Dataquest undertook during the winter of 2000, it was revealed that over 60 percent of businesses surveyed did not have a basic plan to mediate the effects of a disaster, should one occur. Gartner Dataquest believes future demand drivers for enhanced IT value delivery in the BC and DR space will require a change, one that is already begun, in the methods used to provide assurance against failure of IT infrastructure or, in lieu of that, minimization of the consequences of such a failure. Gartner Dataquest believes the IT services market is inexorably shifting from private, centralized managed data centers toward systems that provide value and economy through syndication of resources, in essence a utility, or "access" model. By providing access to utility rather than ownership, there are demands for highly available IT systems that will not drive the demand for traditional BC and DR. Many of the future offerings of the four companies highlighted by Gartner Dataquest reflect a connected, access-based approach to availability, in sharp contrast to earlier approaches, which were privately owned, perhaps outsource-managed, centrally located and with single points of failure.
BC and DR practices are outlined in the Gartner document "E-Business Continuity: You've Come a Long Way Baby!" (COM-13-6392) and "The Changing Face of Business Continuity Services in the E-Economy" (HWSV-EU-DP-0001).
Vendor offerings are beginning to reflect a trend to create more value around the specific needs of IP-connected commerce (e-commerce). The offerings emblematic of this new trend are the high-availability offerings of Hewlett-Packard, the e-sourcing offerings of SunGard and the Comdisco Web Availability Solutions. The growing market segments for IT availability-enhancing goods and services drive demand for services that diverge from previous practices this market provided. As an indicator, growth for software and hardware support services appears higher in these nontraditional BC/DR markets than in the market for traditional back-office systems. To respond to the higher growth in nontraditional markets, most BC and DR vendors are investing in capability to provide services and disaster recovery assets capable of dealing with the unique exposures of businesses operating real time because they are on the Web.
[return to Table of Contents]
In addition to the market size and other vendor data, Gartner Dataquest also surveyed four of the largest BC/DR service providers from the United States: IBM, HP, SunGard and Comdisco, and we outline their service portfolios.
Gartner Dataquest describes the market for DR and BC, exclusive of data storage products and services and software products and maintenance, and those high-availability services sold as product support agreements by vendors of IT.
The selection of these companies as focus vendors was indicated by customer surveys, long-standing participation in the marketplace, and the reach, breadth and depth of their offerings to the marketplace. These vendors have extensive reach and market penetration, and three of the four were involved in a key government contract for business continuity and recovery services in 1998. On 20 April of that year, the U.S. General Services Administration (GSA) awarded contracts to Comdisco Continuity Services, SunGard Recovery Services and IBM Business Recovery Services for governmentwide, disaster-recovery services. Essentially, the contracts specify the three vendors that will provide "hot site" services in the event of an emergency. The contracts were awarded as part of the GSA Federal Computer Acquisition Center's (FEDCAC) Computing and Communications Recovery Services program. The contract eventually instigated service contracts with more than 100 federal organizations.
In addition to the three corporations named in the federal government's program, Hewlett-Packard is reviewed by Gartner Dataquest because of its expertise in the realm of high-availability processes and systems, its estimated revenue from services deriving from business continuity, and customer feedback from Gartner Dataquest surveys indicating the company is a top resource for many IT executives seeking assistance with business continuity and disaster recovery solutions. HP was also a bidder for parts of the Comdisco continuity and recovery business after that firm filed for Chapter 11 in July 2001.
[return to Table of Contents]
The needs of customers facing prospects of business impact because of calamity are modeled by organizations, whose professional services offerings are detailed in following sections. (Note that all of these offerings provide services that are similar, although they may construct these offerings with different target audiences in mind.)
[return to Table of Contents]
All of the vendors' offerings seek to evaluate and communicate the potential business risks of an unplanned interruption of work, and to control their impacts. The four BC and DR service vendors whose offerings are summarized manage projects that develop strategies for mitigating the consequences of business outages and work to obtain client senior management support for them. They first provide quantification of risk, through professional services that evaluate and analyze business exposure. Customers who agree with the findings of this objective analysis may purchase further outsourced services, managed operational (that is, system design, creation of system fail-over and load balancing) and access-based (syndicated remote data storage) IT-based offerings that fit the full spectrum of needs. The prospect or customer always has a choice of spending internally for these operations, but even in that case, the vendor of BC service may still play a role in organizing and documenting internal investments through consultation. Overlaying all procedures and equipment needs are strong prescribed organizational guidelines that form internal and external communications protocols (both human-to-human communications and data communications) in the face of a business cessation. The customer enterprise may need assistance managing the aftermath of a disaster, in building access to logistical and command center facilities, or they may need dress rehearsals to be conducted with full review of the consulting service provider. Whatever the customer chooses to build internally, or have a service provider bestow, the documented plans for recovery and management are constantly maintained and reviewed in light of organizational change, and vendors assist with these quality initiatives as well.
Overall, there is a great diversity in specific needs of companies, but great similarity between the general types of services customers buy. For example, among businesses involved in finance, Gartner Dataquest estimates the market for remote data storage of various flavors in the United States is fully penetrated. About 90 percent of customers who would need such a service in the financial services vertical have already made arrangements for data protection because of regulatory pressure and internal assessments of the requirements germane to their business.
[return to Table of Contents]
Other than long-time customers represented in a few vertical markets (finance, manufacturing, government and communications) the BC and DR professional services industry has not been successful at exploiting new markets. Gartner Dataquest believes that about 60 percent of businesses in the United States with a reliance on IT infrastructure have not expended an adequate amount of resources for BC and DR. Total IT expenditure on BC and DR has consistently been a fraction of what the demand should be, considering the technological buildup that has been ongoing during the last 10 years. Various estimates bring the total expenditure that IT shops should budget for adequate planning per year to be between 2 percent and 8 percent of an enterprise's total IT budget; however, this estimate is very broad and does not factor in the wide scale and variation of IT deployments that require continuity consulting. Because of the barriers to entry, the professional consulting market surrounding business continuity planning and assessment has extraordinary fragmentation at the low end, with only two service providers offering a globally available, complete spectrum of service offerings (HP to a lesser extent because of its lack of platform agnosticism and IBM to a larger extent because of its presence in 77 countries and its broader acceptance of non-IBM systems). These providers, and a few dedicated North American players based in the United States (Comdisco and SunGard) stand out as models for the North American marketplace.
[return to Table of Contents]
HP provides total solutions based on a construct of availability that rests the goal of continuous availability on three pillars — partnerships, processes and infrastructure. HP's focus is weighted toward Unix and Windows technologies, and hardware of their design. This is different from Comdisco, SunGard and to a lesser extent IBM. This nonvendor neutral flavor threads its way through most HP offerings. HP maintains approximately 140,000 square feet of recovery floor space globally, which is a combined figure of HP's owned and partnering organization facilities. They command approximately 1,500 customer accounts with 1,600 contracts worldwide, providing services in 33 countries. There are 11 work area recovery facilities and 30 high-availability service sites globally. They have mediated 300 live disasters in their 15 years of operation, with a maximum of recovery for three simultaneous declarations of disaster from customers at one time. HP believes two criteria invite a discussion of mission-critical services with clients: any potential infrastructure that equates to a financial loss of approximately US$10,000 per hour of lost uptime, and organizations that operate solutions that have significant loss potential because of key business applications' failure.
HP's version of availability services offerings is design-centered around customers maintaining competitive advantage through maximum uptime and minimum business disruption through outages. As of July 2001, HP made an offer to purchase the Availability Services segment of Comdisco for US$610 million, a transaction, which at the time of publication, is awaiting review by regulatory entities.
[return to Table of Contents]
HP consulting services provides a series of consultative modules that develop a business continuity plan based on assessment of needs, design of systems to meet those needs, planning a methodology to cement the plan in place, and ongoing review and rehearsal. Within these offerings, infrastructure is designed to be as reliable and fault-tolerant as possible, IT processes are controlled and subject to quality review, and support partnerships develop extension of reach and depth of expertise for a majority of the customer base.
In the first phase, HP consulting services performs a business continuity audit and a Business Impact Analysis (BIA). The second phase introduces recovery time objectives and defines recovery strategies that will best meet customer requirements in most potential disasters. These feed into the solution-design phase and can be implemented directly by HP. The tertiary phase consists of further development of the business continuity plan, including knowledge transfer to the employees responsible to ensure that the plan is completely rehearsed and viable, according to customer needs. Finally, the customer and HP rehearse the plan periodically, under observed and controlled conditions, and provide feedback to the customer in a post-mortem debrief.
[return to Table of Contents]
The offering includes several types of services, all within a core sweet spot of HP, high-availability computing and support services. HP's critical e-commerce support (CECS), is a solution enhancement offered with HP critical systems support (CSS) and HP business continuity services (BCS). These services are related but distinct. They are three different types of offerings based on customer needs. The service involves the entire life cycle of offerings of HP and is targeted toward e-commerce infrastructure installations operating on the HP 3000 and 9000 operating systems and software and specified partner software applications.
The main value proposition is that continuity of business process is first and foremost an e-commerce availability problem. The services are customized for each account and include the following elements in the support center:
- Assigned account support engineer (ASE) — An account contact that leads proactive account management and coordinates efforts between the customer and HP. The ASE is responsible for development of a high-availability account support plan, which is a blueprint of operation and maintenance of all aspects of the customer infrastructure.
- Named response center engineer (NRCE) — Each customer receives the benefit of a specific contact within the center that can respond more advantageously through prefamiliarization with each account and its unique IT environs. The NRCE is a 24x7 resource.
- Assigned customer engineer (CE) — The CE works with the ASE to substantiate hardware maintenance program parameters. The CE maintains records within HP to ensure the customer environment is fully understood within HP prior to emergencies impacting operations.
- Customer satisfaction manager — This manager is responsible for critical situation handling and managerial assistance during problem remediation.
- Assigned executive — This high-level HP services executive serves as senior advisor and resource for customer advocacy and satisfaction.
These resources draw together to produce several discrete services that interoperate to provide continuous computing environments:
- Account support plan — A document codifying the various roles, responsibilities and key documentation of the customer environment under the plan.
- Readiness assessment service — These services set conditions up for secure, operationally sound ongoing performance of the customer infrastructure.
HP provides two types of operational assessments, which are discrete offerings:
- Operational assessment for server environments — It is designed to gather extensive information regarding the critical server, identifying gaps and weaknesses that put application availability and end-user service level requirements at risk.
- Operational assessment for servers and networks — It is designed to augment the above server environment assessment and delves deeply into the network layers to improve their management and therefore their reliability, according to best practice work by HP.
- Continuous improvement assessment — This optional review occurs in the second year and beyond, to expose whatever areas of concern the customer may have in ensuring all systems remain operational.
- HP support advisory board — Customers of this service suite are encouraged to participate in this select group of HP customers, who twice a year convene for a conference with HP and other enterprises that utilize HP services to operate their mission-critical environments.
- Support reviews — HP BCS support reviews communications with the HP support resources and determines future directions. The reviews occur monthly and look at any aspect of interaction, including system availability, escalations by severity level, patch levels and system maintenance. These monthly meetings are documented as progress reports and become part of the overall relationship.
- Delivery process reviews — These reviews are executed two per year and represent waypoints for the exchange of business objectives and priorities, with a focus on the role of support in achieving these goals.
- Technical services — These are available four per year to subscribers of HP BCS services.
- Operating system update installation
- Configuration review
- New system startup assistance
- Network configuration review
- Performance resource utilization
- Performance analysis
- Security review
- Internet security
- Network management review
[return to Table of Contents]
- Educational credits — Customers are granted credit for educational modules attended during the year. A curriculum is arranged with the HP account.
- Software release planning — Updates and upgrades are planned and controlled by means of the coordinated effort of the account team and the customer.
- Change management — The ASE provides customer advice regarding change management during support reviews.
- Configuration checkups — Once a year the NRCE and the CE audit the configuration of servers and identify those that need adjustment to provide maximum reliability and performance.
- Patch and firmware — The NRCE monitors the release of new patches and provides customized rollups bimonthly to be installed by the customer.
- Critical patch screening — HP screens for late-breaking patch news Monday through Friday, and the customer is contacted immediately if news regarding a proposed patch or a preinstalled patch has problems or needs a refresh.
- Firmware updates — HP installs any firmware modifications required. Additionally, the customer may use the following resources:
- The latest revisions of software and associated reference manuals are made available usually in the medium of choice.
- Add-on hardware — HP installs any add-on hardware at scheduled times, which may occur on a 24x7 basis.
- Hardware preventive maintenance — HP engineers visit the site to provide ongoing maintenance for IT components.
- Site environmental survey — HP identifies environmental conditions that may compromise sensitive IT equipment, such as temperature, power, and undue vibration or other factors.
HP offers a number of reactive services designed to assist customers after a calamity has struck and left them with compromised systems. HP maintains critical support phone numbers, which connect the customer to a specialist in HP business recovery who provides support. The business recovery specialist first recovers the system, if possible, and then determines its cause. These specialists have access to all documentation regarding the site, its systems and its support requirements. After an hour of troubleshooting, the recovery specialist is required to garner the assistance of other specialists, all the while being monitored by customer satisfaction managers.
A hardware issue results in a certified CE being dispatched to the site. HP makes commitments by means of timelines-to-restore, which vary based on the distance from the local office of HP designated to provide the dispatch service. For example, under HP BCS, when a customer's premises is within 100 miles of the local office, the dispatch is contractually obligated to be immediate, and the total time to restore is under six hours, with some variation based on the specific environment. However, these times are inclusive of hardware and operating systems and do not include the return to use of applications or middleware.
[return to Table of Contents]
HP operates 44 recovery centers in the Americas, Europe, Asia/Pacific, Africa and the Middle East. Additionally, HP partners with other providers to operate a network of non-HP-proprietary centers. There are five tiers of service offerings to accommodate the specific needs of the global population of users. These business recovery services are named according to their intent: continuous, immediate, critical, core and base. All offer a contractual uplift to avoid costly service declaration fees. Such fees are broadly invoked by vendors of BC services to cover the operational costs associated with responding to a customer's proclamation that a disaster has occurred and that their recovery plan is to be activated. They are outlined as follows:
- Business recovery service (BRS) basic — This is a no-frills service designed to protect systems that may be left inoperable for a few days because of calamity. The service includes non-HP platforms (Solaris and NT). In the event of a disaster, HP ships a loaner system to the customer, who may enjoy its use for 84 days for no additional fee. No rehearsals are included. The data concurrency is commensurate with the last backup. There is no access to a recovery center within this offering.
- BRS core — This is a full DR service, including use of recovery centers and an option to receive loaner devices at the customer location. HP agrees to create necessary systems concurrent with a minimal recovery time objective (RTO) of 24 hours, which is shipped to the customer ready for loading of data and applications by customer personnel. Systems (the offering relies on shared system, shared storage and shared networking) will therefore be ready for operation minimally two days after a disaster. Customers also receive the following as options to this recover center-based service, (which also has similar offerings for mobile recovery and onsite ship):
- Up to six days of rehearsals per annum
- Access to the recovery center within four hours of declaration
- Ability to self-design parameters around disaster definition
- Private work areas, security on premises
- Use of recovery center for up to 84 days
- Data concurrency is commensurate with the last backup
- BRS critical — It extends the value provided in the BRS core to include tighter recovery time objective windows through use of HP certified professionals, expedited service and higher-level responsiveness (and preserves costs by not dedicating hot backups to the offering) to allow a RTO beginning eight hours post-declaration. HP guarantees systems to be loaded with operating system OS and configured within seven hours of declaration, and this means that full recovery could occur reasonably in 12 hours. The service comes with all the features of BRS core, but adds the utilization of remote configuration and monitoring tools to provide system information to be used within the recovery center. The offering provides shared system, shared storage and shared networking. The data currency is equivalent to the time of the last backup prior to disaster. The recovery center is open to the customer within two hours of declaration.
- BRS immediate — Upgrades the time frames for recovery found in BRS critical to enable end-user connectivity minimally between two and eight hours of declaration (an RTO of under eight hours). The service is a customized solution. The service revolves around switching to remote backup server environment(s), carried out by HP employees upon declaration. Data are fully mirrored to the remote storage facility, (thus, the data currency is equal to the time of last disaster) and is loaded onto the remote systems according to the specific needs of the client during the design phase. The offering provides use of HP shared systems, dedicated storage and shared networking. The same DR facility options exist as in the previous offerings, with the addition of expert rehearsal advice.
- BRS continuous — Allows full network switchover with an RTO of under an hour. The offering relies upon HP providing access to remote alternate dedicated system, dedicated storage and dedicated networking The solution is created jointly between HP and the customer and involves using HP's own data centers for the replication and switchover. Data currency between the replicated and main system is identical up to the time of disaster.
[return to Table of Contents]
IBM Business Continuity and Recovery Services is a division of IBM Global Services, the world's largest IT services provider. The former IBM Security Services Internet Emergency Response Service (IERS) was renamed IBM Business Continuity and Recovery Services as of 20 March 2001. The business unit commands approximately 13,000 customer accounts globally, Gartner Dataquest estimates, and employs 6,700 persons (not all dedicated to BC and DR services) in operations relating to BC and DR. Gartner Dataquest estimates the total global revenue for Business Continuity and Recovery Services to be US$767 million dollars in 2000 (a Gartner Dataquest estimate divides this revenue as one-third in the North American market to two-thirds outside).
Gartner Dataquest estimates, based on calculations of revenue per account and discussions with the vendor, that the approximate average value per account is slightly lower in the case of IBM than for SunGard or Comdisco, with a strong uptake in midrange systems. Its history has gained it experience with over 400 declared disasters since their formal IERS naming inception in 1990. This experience in the field is lengthier than this "named" (that is, IERS) period suggests, because of its pre-eminent position in the mainframe era extending back to the 1960s. Currently, IBM has over 100 recovery centers in 77 countries. The offerings purveyed by IBM are highly integrated and customized, meaning IBM does not break them out into discrete service programs, but custom-engineers each customer's specific needs into a specific proposal or Business Continuity and Recovery Services contract. During Hurricane Floyd, IBM handled its largest number of declarations at once, numbering 96 declarations among 46 accounts.
IBM will custom design Business Continuity and Recovery Services upon receipt of a request for bid, and will nominally provide a complete system analysis for total system recovery. This is indicative of the IBM approach to Business Continuity and Recovery Services, which is one of a holistic, total business solution. This kind of flexibility agrees with giant companies such as Gillette, Chase, Prudential and Tenneco, all with extensive IT build-out and relationships that extend far beyond the Business Continuity and Recovery Services domain with IBM Global Services. The main areas are highlighted in this section, but IBM has extensive outlying services in such areas as security and hosting, which complement these specific offerings.
The offerings (which are professional services practices linking to the various availability-related service divisions within IBM) are not tiered insomuch as they are modular and fit together in a variety of ways, according to customer objectives and technical considerations.
[return to Table of Contents]
IBM's Business Continuity and Recovery Consulting houses the IBM Technical Center of Competency and employs 25 technical consultants with an average of 15 years experience in disaster recovery planning. Its services are augmented and contributed to by hundreds of other specialists within IBM to advise customers with specific and unique needs they may have. They provide several packaged professional services engagement types: recoverability assessment; recovery strategy assessment; recovery pan development, and recovery process and procedure design.
- Recoverability assessment — This professional services assessment is designed to fulfill a basic reconnaissance of the customer facility to allow IBM to identify gaps and weaknesses in the customer's IT strategy. The service includes the following:
- Defines recovery objectives for prioritized business operations
- Identifies current platform backup/recovery processes and current database subsystem backup/recovery processes
- Notes data and system dependencies
- Identifies data synchronization requirements and scheduling considerations
- Documents processes surrounding storage and retrieval of vital records
- Documents production change control procedures
- Lists and records vendor and service provider agreements
- Documents results of previous testing or recovery exercises
- IBM recovery strategy definition service enables customers to identify and make progress toward creating planning documents and achieving better reliability and availability through:
- Explaining benefits and limits of differing recovery strategies
- Making clear the tradeoffs between in-house and third-party solutions
- Identifying capacity and performance factors
- Making clear potential risks and constraints
- Devising plans to coordinate recovery programs across multiple data centers
- Creating an estimated timetable for IBM to implement the strategy
- The recovery plan practice creates a documented Business Continuity and Recovery Services plan customized for the specific needs of the customer organization. IBM Business Continuity and Recovery consultants engage to:
- Isolate and understand the triggers for declaration of disaster
- Identify roles associated with planning, testing, declaring and recovery
- Inventory the resources required to bring IT systems back to operation
- Identify assumptions on data currency and its retrieval
- Create a detailed timeline and checklist
- Predefine an operation center to coordinate status, issues and assignments
- Develop communication strategies for keeping employees and customers informed
- Organize the recovery plan into a flexible, easily maintained tool
- Validate recovery plans using test approaches including simulations based on real-life disaster declarations
- IBM's recovery process and procedures design services document and maintain procedures for the maintenance of data replicas and backups that are used in the event of disaster or system outage.
In addition, IBM Business Continuity and Recovery Services offer four specialized service modules, which inform and provide blueprints for action with respect to specific domains of expertise as follows:
- Business Continuity and Recovery Services continuity and security assessments — Defines threats from a security and an e-commerce vantage point to identify unique weaknesses stemming from connected e-commerce systems-specific vulnerabilities
- ERP Continuity — Four modular sections include workshops, plan development, procedures design and recovery process documentation, including both DB2 and Oracle data recovery plans
- Business Continuity and Recovery Services call center services — Designed to replace systems quickly in case of an outage, this service includes several key features:
- Alternate call-handling services, which serve to temporarily replace call center staff while the recovery is under way
- A workshop for customer employees regarding recovery strategy; included in this are courseware on disaster definition, limited business impact, risk assessment, dependencies, RTO requirements, and strategy elements and requirements
- Access to IBM's backup automated call distribution (ACD) in one of four locations in the United States and Canada (Texas, Colorado, Ontario and New York), each of which is automated and ready to distribute calls to agents regardless of their location
- Call-routing tables are preplanned and implemented quickly; an uplift to the service preloads agent systems with a "hot" alternate call table software package
- IBM also has air conditioned trailers loaded with mobile ACDs and call centers that may be shuttled to subscribing customers' prespecified recovery locations, onsite within 48 hours of declaration
- Application continuity business continuity and recovery services — A more general practice that assists in the analysis, design and implementation of business process continuity solutions. The focus is on critical processes and the applications that support them. Similar to the other offerings, there are four submodules:
- Application recovery assessment — A prequalifying service designed to identify the present status of systems involved with key business processes
- Recovery plan development for critical applications, including network
- Recovery procedures and documentation
[return to Table of Contents]
In addition to the previously described offerings, for a fee, IBM will operate and maintain (that is, outsource) the management of the overall business preparedness processes for customers on an ongoing basis. Companies with limited IT staff may wish to engage with IBM if their exposure to risk is high but they wish to keep their investment in the personnel and equipment to a minimum. IBM performs all the tasks necessary to execute an IT recovery program in a test or recovery scenario. This may include managing information media and restoring the operating environment, recovering applications, databases and networks, and providing status reports and post-event analyses to executive management. These managed services include the following IBM components:
- Vaulting, journaling and mirroring solutions for operating systems, databases and applications
- Determining (recovery point objective [RPO] for critical data and backup frequency)
- Securing data storage locations according to either on-site or electronic retrieval
- Hot recovery locations enable the customer's operating system to be ready to boot up at the time of a disruption and allows staff to immediately target recovery of data and key applications.
All of these capabilities are conjoined in each customized Business Continuity and Recovery Services plan, with oversight by a sponsoring IBM Business Continuity and Recovery Services executive who maintains the relationship through scheduled and ongoing meetings, workshops, and readiness reviews.
[return to Table of Contents]
IBM maintains 3,500 end-user alternate seats globally for use in disasters, in addition to mobile centers that may be linked together to create ACD-equipped centers of up to 150 seats. The modular units can be customized and outfitted to customer needs within 24 to 96 hours and come equipped with generators, heating, ventilating and air conditioning (HVAC), and LAN cabling. Restrooms and lounges are optional possibilities. During large emergencies, IBM invokes the services of its National Command Center in Sterling Forest, New York, which manages IBM disaster response around the world.
Also available from IBM Web Recovery Solutions are solutions that allow customers to replace specially configured units on a fast-ship basis. IBM will ship servers, workstations, hubs and routers (its own as well as products from multiple vendors) to customer locations within 24 hours notice of the declaration.
IBM also fast-reroutes WAN traffic to one of its dedicated recovery centers to establish a permanent point of presence for customer network nodes at an IBM center. LAN equipment may be prewired to an IBM LAN switch, allowing for virtual services. Also available are extended LAN services providing connectivity to technologies located at other IBM recovery facilities.
[return to Table of Contents]
SunGard Business Continuity and Internet Services offer enterprise outsourcing services, primarily in North America. SunGard's BC business has been in operation for 23 years. SunGard maintains 1 million square feet of hardened facilities for recovery, hosting and testing. The company employs more than 1,000 persons involved directly in delivery of business continuity services. Three high-availability Web solution centers and 25 high-availability recovery services sites round out the infrastructure available for customer accounts to use.
SunGard has had a maximum of 26 declared disasters at one time, and has fielded a total of 600 live declarations of disaster. The company had US$410.6 million in revenue worldwide from its continuity services, with North America revenue totaling US$409.6 million. Its CAGR from 1998 through 2000 was 11 percent.
SunGard serves 5,000-plus customer accounts through the three operating units listed in the following section. They also serve as categories that outline SunGard's BC/DR businesses.
- SunGard recovery services provides business continuity services, including high-availability infrastructure/electronic vaulting services, hot and cold sites, recovery network services, and workgroup recovery.
- SunGard eSourcing specializes in Web colocation and hosting services, high-availability Internet access and high-bandwidth networking, and technology and systems management services for application and data center outsourcing. The eSourcing practice is designed to offload operational details of maintaining a critical IP-enabled computing resource from customers, freeing investment and resources for them to pursue core business objectives. Within eSourcing, SunGard provides the following service components:
- Enclosures at facilities that isolate and secure the servers associated with business-critical Web-based infrastructure (called SecureCabinets). Also, private Internet centers that host Web server infrastructure (SecureSuites) and MegaSuites that enclose and secure larger areas, up to 2,500 square feet.
- Transport infrastructure services, which assure appropriate communication and server infrastructure for SunGard clients (application service providers [ASPs], competitive local exchange carriers[(CLECs] and independent software vendors [ISVs], inclusive of variable-bandwidth or fixed capacity Internet access and point-to-point access).
- Managed client care, including full-time monitoring, maintenance of software and technical support
SunGard Planning Solutions focuses on business continuity consulting and technical consulting services, and markets client/server and Web-enabled business continuity planning software.
[return to Table of Contents]
SunGard also maintains a suite of offerings for specific recovery needs of customers, operating on practically any platform (with 22 choices of vendor and platform type). These recovery solutions include traditional continuity assurance services ranging from 24 to 72 hours or high-availability services with almost continuous data access.
These services include:
- Systems recovery — Full support for the customer's choice of recovery center, mobile or delivered systems. All facilities include diesel generators, uninterruptible power supply (UPS) and climate control, fire detection, and access to the SunGard WAN, the SunGard National Network. This WAN offers SunGard customers a proprietary national infrastructure, which is independent of public networks and therefore avoids their potential for congestion. Used for disaster recovery, it links customer sites with recovery facilities for testing purposes as well as for standard operation of high-availability computing and monitoring.
- Mobile Data Centers — SunGard provides space for up to 10 workers in trailers available at customer locations within 48 hours after a declaration of disaster. Another feature, MetroCenters, provides workspace for up to 50 users.
- Work Group Recovery — Includes interactive voice response (IVR) recovery, recording and support functions
[return to Table of Contents]
In SunGard risk management services, SunGard's consultants identify client company's exposures to loss, and identify how to minimize those exposures. There are three practice components to this segment:
- Risk analysis — Documents the strengths and weaknesses of existing systems and provides recommendations for improving the avoidance and prevention of disasters
- Plan audit — An objective evaluation of the client's current recovery program in terms of its ability to meet both business and regulatory requirements and obligations to management as well as shareholders. It verifies personnel requirements to respond during disaster situations and establishes the need for any improvements.
- Information protection analysis — An analysis of:
- Backup procedures for both programs and data
- Data security
- Storage of documents, files, records and other sensitive information
[return to Table of Contents]
These services produce an objective analysis and documentation of corporate processes and business methodologies of the customer and investigate and examine reasons for customer business processes to change or remain as they are.
- Business impact analysis (BIA) — These services justify the expense, validate the recovery strategies in place, heighten management's awareness of the criticality of the systems in place and the need to gauge the backup capabilities required to recover within the allotted time frame.
- Application impact analysis (AIA) — AIA is designed to identify and quantify the potential impact, over time, if essential computer applications cannot be processed. This is done by providing the following: an interdependency matrix of each application and its relationship to other applications, computer services, telecommunications and external services, strategy analysis to identify alternate processing options, minimum acceptable recovery configuration for equipment needs over time until full production capabilities are restored, analysis of how to handle the challenge of backlogged transactions, and recommendations on how to recover to initial point of failure.
[return to Table of Contents]
SunGard's alternative processing analysis is designed to answer questions regarding parameters of a timely and effective relocation process; service level requirements that have to be met, including network connectivity; whether availability needs require electronic vaulting; remote transaction journaling, mirroring and shadowing; system replication; reducing loss exposure and recovery time; simplifying recovery logistics; synchronization of operations; storage management analysis; and strategies concerning external suppliers, including cost/impact analysis.
[return to Table of Contents]
MetroStor analysis provides a customer with comparisons between current network and data storage and state-of-the-art designs, and produces a project plan to improve availability. SunGard provides an objective and independent assessment of the viability (in terms of recoverability) of a customer's current backup methodologies as well as to plan for reduction of data loss exposure. The goal is to provide executives within customer organizations with an understanding of technical solutions available to meet the recovery point objectives of their organizations within a context of price and performance and justifying such improvements in organization, process and infrastructure.
SunGard offers complete project planning, group orientation sessions, data-gathering activities, recovery procedural analysis/development, quality assurance reviews, progress status meetings, and post-project support and assistance.
The restoration process review (RPR) service is designed to assist newer subscribers with system restoration procedures of whatever subscribed recovery configurations are present, and to facilitate testing the restoration plan. The process involves a SunGard-trained resource who monitors a test event and provides feedback to improve future tests and improve real-world readiness.
AS/400 Certified Testing yearly tests small (one-to-five employee) IT installations. It is designed to support companies implementing SunGard testing processes.
The test assistance service focuses on customers who wish to manage and coordinating such tests instead of SunGard, and yet need a coordinator from SunGard to assist. The key differentiation between this service and that of test management is the role the subscriber is willing to assume. The test assistance service is for those clients who need SunGard personnel to test their recovery procedures. The service includes activation of system restoration procedures; however, restoration of applications data and databases remains the responsibility of the subscriber.
This service is designed to address the needs of customers who do not have the resources to plan, coordinate and manage a DR testing program. The service is intended to minimize the participation of the subscriber's staff, while effectively utilizing the technical expertise residing at the SunGard MegaCenter. An assigned professional services resource takes on the role of liaison, schedules the subscriber's test and assembles a team of customer personnel to carry out the test.
SunGard offers software for assistance with planning and strategy, as well as providing maintenance as a service for customer applications. Its revenue for SunGard in software support and maintenance for 2000 was US$63.5 million, according to Gartner Dataquest estimates. SunGard provides the following applications in support of its BC business line:
- SunGard Precovery — Business continuity software that automates the recovery planning process by presenting scenarios
- SunGard ePlanner 2000 — A Web-based integrated solution using the reach of a browser-based application to tie data, personnel and systems together to simplify the workflow aspects of creating a recovery plan
It should be noted that Gartner Dataquest does not include software revenue in the market size for business continuity or disaster recovery in this Focus Report.
[return to Table of Contents]
Comdisco recently reported that the parent company and 50 domestic U.S. subsidiaries filed voluntary petitions for relief under Chapter 11 of the U.S. Bankruptcy Code in the U.S. Bankruptcy Court for the Northern District of Illinois. The filing should allow the company to sell assets to address short-term liquidity issues, enabling the company to reorganize under the protection of the U.S. Bankruptcy Code. Company officials also said that Comdisco had filed a motion seeking approval of bidding procedures to sell one or more of its leasing business units. The company also announced its intention to reorganize its remaining businesses, including Comdisco Ventures group, on a fast-track basis and has targeted emergence from Chapter 11 during early 2002. HP was making advancements toward purchase of Comdisco's availability solutions group. This transfer, as well as any other sales, will require final approval of a U.S. bankruptcy judge. For more information, see the Gartner document "Garter's Advice as Comdisco's Financial Troubles Continue" (FT-13-6771). Gartner indicated in this document that the BC/DR practices of the company are basically sound. Other unrelated business interests, including investment in Prism, a DSL communications company, in 2000 are responsible for causing this disruption, and not the traditional lines of business with which Comdisco has been associated. The financial impacts of these failed strategies have been punishing to the whole enterprise. Possible outcomes include breakup of the company; however, Gartner Dataquest believes the business and its operations surrounding BC and DR will remain a unit regardless of what happens to the parent company structure.
Comdisco is a Fortune 500 provider of global technology services that assists its customers to maximize technology functionality, predictability and availability. Comdisco maintains a workforce of over 1,000 trained business continuity professionals. With 100 locations in North America and Europe, Comdisco serves 3,200 customers in North and South America, Europe and Asia/Pacific with approximately 8,000 BC and DR contracts in place. The company maintains 1.9 million square feet of recovery space globally. In 1998 the company surpassed its 300th recovery. And as of July 2001, it reported that it had participated in 432. The most declarations of disaster serviced at a single instance was 26 during Hurricane Floyd. More than 1,000 employees focus on BC professional services within the company. Comdisco maintains more than 10,000 workstation recovery positions globally, in 38 recovery facilities and three special trading floor facilities, each kept ready on a 24x7 basis. This number also includes the capability to take 1,000 trading floor positions at one time in the United States. Its global revenue for BC services totaled US$479.9 million, with US$395.9 million of that figure spent in the North American markets, representing a CAGR of 9 percent from 1998 through 2000.
The Rosemont, Illinois-based company offers a suite of IT services, including business continuity, managed Web hosting, storage, and IT control and predictability solutions. Comdisco operates eight high-availability computational facilities globally and three high-availability Web-hosting facilities. Comdisco also offers equipment-based solutions to key vertical industries, including semiconductor manufacturing and electronic assembly, healthcare, telecommunications, pharmaceutical, biotechnology and manufacturing. The company's total revenue for the 12 months ended 31 December 2000 was $3.9 billion.
[return to Table of Contents]
The company has technology centers, which act as process hubs for its business recovery services via its SONET infrastructure in Kuala Lumpur, Malaysia, in 17 European centers and in 28 North American locations. For example, the 132,000-square-foot Technology Center in Smyrna, Georgia cost $18.5 million and was built to provide disaster backup and recovery space as well as hot recovery infrastructure to Comdisco's customers. The facility operates 24x7 and includes operational equipment to meet a variety of Comdisco customers' requirements for business process.
Comdisco continuity software provides a proven approach to building, maintaining and testing contingency plans. Its products ensure that important details are not overlooked. All products are designed to efficiently create and maintain plans and related documentation, including the following:
- Revolution — Web-based scenario planning system
- ComPAS — Comdisco's planning software that blends attachments from multiple file formats into printed plans
- REXSYS — Based on MS Word, the software integrates database information into a Word-based plan wherever needed.
- Collaborative planning tool (CPT) — Lotus Notes-based planning system
- Complete BIA — Expert system-based impact analysis system; collects and analyzes business impact data
- Continuity Resource — CD-ROM-based continuity education, awareness and knowledge base
[return to Table of Contents]
Comdisco offers specialized services for four primary market segments:
- Government — An original contract signed in 1993 provided prime mover power to Comdisco. In this agreement the federal government awarded Comdisco a $50 million GSA disaster recovery contract. This agreement has now been leveraged by 47 U.S. government agencies.
- Healthcare and Health Insurance Portability and Accountability Act (HIPAA) — Includes consultative expertise regarding records management and IT system upkeep for the healthcare industry, across practically all platforms. The specifics of HIPAA documents new standards for the privacy, fidelity, and maintenance and update of medical data stored on information systems.
- Item processing — Comdisco operates backup support systems for financial institutions that process millions of checks each day. Comdisco provides recovery capabilities in three Federal Reserve districts, including an Atlanta, Georgia facility that, according to Comdisco, is the largest item-processing recovery center in the industry, as well as facilities in Carlstadt, New Jersey and Phoenix, Arizona. Their capture/processing equipment configuration consists of reader/sorters, proof machines, online terminals and automated repair/re-entry machines.
- Trading — Comdisco offers remote facilities for operation of trading floors, with workstations and communications preconfigured to provide rapid resumption of service.
[return to Table of Contents]
Comdisco's range of continuity services provides manifold professional services based upon several different domains of expertise. The company uses a number of third-party software products while providing its own backup and automation infrastructure for the solutions. Because it is difficult to establish the return on investment (ROI) on many of the services Comdisco traditionally provided, Comdisco has rolled out a significant effort in the establishment of an ROI practice to help customers better deduce the risk-to-reward ratios in engaging in these services.
- Mobile — Mobile centers are available with complete satellite, CAT-5 network cabling, air conditioning and other amenities for up to 1,000 employees at a time. The centers are available for call center replacement, IT data center use, or may also provide services for other industries than IT. The mobile centers can come equipped with practically any mainstream platform customers use in their daily business operations.
- Comdisco InTouch — A communications-based recovery service provided to ensure that sensitive interactions can continue despite calamities and disasters. Comdisco provides CTI-enabled, interactive voice response (IVR), Web connectivity, and other resources onsite and at Comdisco recovery facilities. Comdisco technicians proactively program PBXs to meet customer requirements at the time of a disaster. The expertise provided also covers Web availability through offerings that include:
- Continuous Web availability provides immediate failover capabilities in the event of an outage. These services combine load balancing between the customer's primary site and Comdisco's alternate site, high-availability techniques for database synchronization — such as failover and mirroring — and high-speed networking.
- Web disaster recovery services provide Comdisco customers with high-speed access to the Internet and include firewall protection, but don't entitle the customer to dedicated Comdisco equipment in the event of an outage.
- Trading floor requirements are met, including the capability to bring trading floor workers into facilities and provide them with complete vendor-independent environments, including multibutton phones and the communications infrastructure to link them to the hot informational resources they need to continue trading.
- Ground Zero services, two complementary services to support business needs during major disasters,were introduced by Comdisco on 5 March 2001. The services represent a solution approach, combining consulting offerings, resource provisioning and management services. Comdisco offers disaster support professionals with highly specialized skills in disaster logistics, government liaison functions and human resources, as well as the technical expertise.
- Ground Zero services provide resources to customers to meet urgent needs after a disaster, and offer the onsite support of Comdisco professionals with a broad range of disaster response and management expertise. Ground Zero services provide access to a Web-based command center portal to track and manage resources. Services offered through the portal are also provided through an 800 number if Web access is unavailable. Ground Zero offers companies a single solution for aggregating and managing resources during a disaster. The service gives Comdisco customers around-the-clock access to a network of Comdisco vendors throughout North America that can provide all the services companies need during a disaster, including counseling and day-care services, temporary offices and equipment, and assistance in dealing with government and disaster relief agencies.
- Incident Command Services (ICS) are offered to customers who need a documented and rehearsed framework for organizing people, coordinating communications and managing resources. Comdisco introduces the ICS, a chain of command process and methodology used by governments and disaster-relief organizations, while responding to unforeseen disasters. This offering from Comdisco availability solutions helps companies develop proactive disaster response plans for all aspects of their business so they are better prepared to manage corporate risk toward an end-to-end response and recovery strategy. To implement ICS, Comdisco works with companies to create enterprisewide response teams, trains the team members and conducts drills to hone a company's response agility. The use of ICS also gives companies a method to meet regulatory disaster response needs and enables companies to better gain assistance from the public sector.
- To help customers manage Ground Zero resources, customers can also use the Ground Zero portal, which allows customers to place resource requests, document communications, and monitor staff and vendor activities online.
- Servers are provided from most manufacturers in whatever designated state the customer desires — delivered fully configured or partially to any facility. The Comdisco services include the designation of an account manager to see that the needs and planning requirements of each customer are met during testing and during actual disasters.
- WorkArea — Comdisco built facilities to house 6,500 workers through North America. Comdisco designated three services under WorkArea services:
- Emergency response providing hot backup positions in advance to avoid complete business process disruption
- Business recovery is for longer-term disruptions in which the customer may bring in additional staff to the recovery facility, or have mobile resources brought onsite to augment initial emergency resources.
- Though a mobile cluster, Comdisco can facilitate quick shipment of additional resources to a Comdisco facility or alternate facilities that the customer has prepared.
[return to Table of Contents]
Comdisco provides the following professional services to clients:
- Assessment and plan development
- Plan development and validation
- Business continuity benchmarking services
[return to Table of Contents]
Gartner Dataquest displays its estimates for total external expenditure on BC and DR in North America in Table 3-1. The figures include global company revenue for traditional recovery services and continuity consulting, exclusive of software license maintenance, and support revenue and remote data protection service revenue. The figures do not count high-availability computing services sold as support contract offerings by hardware manufacturers and their partners for computer hardware systems.
|
