Soumitra Agarwal, marketing director,NetApp India, told B.V.Shiva Shankar that an organization must determine what is the minimum infrastructure that should be available to users at any point of time; without incurring business losses. According to him, identifying real critical processes that cannot be interrupted at any point of time is most important. The excerpts of an interview:

CIOL: What is the importance of business continuity in the current scenario?
Soumitra Agarwal: Given that many businesses are 24x7x365, any downtime has a negative impact on the business. Downtime here refers to unavailability of data when it is required to be accessed; in other words, even if the infrastructure is up, but for some reason if access to data is not available, it is counted as downtime. Cost of downtime can be broadly classified into the following types:

Tangible costs: Lost revenue (e.g., despatches/invoicing from factory stops since delivery orders cannot be processed), lost manpower time (for e.g., waiting for the system to be up, while processing a transaction), marketing costs, bank fees/penalties, legal costs, lost intellectual property value (information value).

Intangible costs: Lost sales opportunities, employee retention, loss in share value, damage to brand, damage to goodwill, etc.

CIOL: What are the main challenges for business continuity?
SA: The important challenges that organizations encounter while drawing up a BC plans are:
Lowest possible recovery time objective (RTO),

•  Significantly lower cost of acquisition and implementation,
•  NIL or minimal need for additional network bandwidth,
•  Flexibility to meet different recovery point objectives (RPO),
•  Ability to leverage investment in existing IT infrastructure, and
•  Type of DR required.

The two most critical parameters are RTO and RPO. Where RTO is NIL, the redundancy should be a fully-clustered architecture, where fail over is immediate. Where RTO is set at few hours, one does not need clustering, but will need to replicate data to the DR site periodically. Where RPO is access to the latest version of data, just before the disaster, then synchronous replication is recommended; where RPO is few hours or even days, asynchronous replication will do.

From the perspective of type of DR, organizations need to decide among the following options:

•  DR for data only: Data should be available in case of disaster at primary site, but the users can wait for primary site to be up to pull back the mirrored data and start operations.
•  DR for operations: Where users cannot wait for primary site to be up and want to be able to start operations from the DR site itself. In this case, not only the data, but even critical infrastructure like servers, applications, peripherals, network, etc. need to be replicated at the DR site.

In addition, the examples could be bill processing/printing for a utility company, vehicle dispatch and scheduling system for a logistics services company, etc. The BCP must take care - at a minimum -- of continuous operation of the critical processes.

As organization's business grows and evolves, the need for BCP will also change in terms of SLA expectations from users, cost of downtime, RTO/RPO, etc. It will be useful to periodically update the BCP of an organization.