Hope for the best, prepare for the worst

Whether it's a computer virus, oil spill, tornado or flood, all companies should have a plan to keep operating when disaster strikes.

In the field, those are called "business continuity" and "disaster recovery" plans.

Patrick Dunn, a consulting manager for Eden Prairie-based Datalink Corp. in Atlanta, advises organizations on business continuity, disaster strategies and best practices. He has more than 20 years of industry experience working with Fortune 500 companies and Big Five accounting firms in both the United States and Europe.

More organizations are planning and implementing business continuity and disaster recovery strategies, especially with regulatory practices that enforce more stringent safety measures. But headlines about Colorado wildfires, Texas droughts, flooding in Minnesota or the latest computer virus are daily reminders of the need for planning.

Yet some businesses don't put a priority on continuity and disaster recovery planning. That omission can prove fatal.

QTalk a little more about disaster recovery.

AAll companies should have a disaster recovery plan. For example, if you're on the East Coast and you have hurricane warnings, you have to be able to get people out of harm's way, and you have to be able to shut down your systems efficiently. You also have to have a strategy of how you're going to store your backup data so that you can recover it later.

QWhat if companies don't have these recovery or continuity plans?

AA Gartner study shows that, typically, 90 percent of the companies who don't have a plan will never recover their operations. This 90 percent of companies that lose data will go out of business within two years.

But, for the ones who do have a plan, 95 percent of them recover their data. But, you can't just have a plan. You have to test it, exercise it, so people know what to do in such a situation. You have to provide a real-life scenario.

QWhat is the difference between business continuity planning and disaster recovery?

AIn a nutshell, disaster recovery is more concerned with the IT side of things. This includes technical aspects of security, like IT infrastructure. Business continuity planning is more of the people side, such as how people actually operate and oversee the recovery strategies.

QWhat do you recommend companies do to prepare?

ANo one should operate in a silo. In the past, IT and business kept to their sides of the office. That can't happen anymore. There needs to be communication between IT and the business side. There needs to be a high-level conversation about how IT can be of value to people so they can apply their expertise to security.

Typically, these conversations weren't happening, but now they are more common, because people are realizing more and more how important this is. IT has become more communicative, which helps businesses meet their objectives.

QHow much does this planning cost?

ACost is relative, because it depends on how you interpret the data you have. How do you determine the financial implication of your data being gone? How much data are you willing to lose if, say, your electricity went out for two hours? Two days? It really depends on the company.

AAbsolutely. If a company knows something bad has happened or is happening they can be posting status updates about it on Facebook; they can be Tweeting about it; or they can text message people about it to let them know what is going on. Don't reveal any proprietary information on social media, of course, but reveal enough so that people know what course of action to take.

QHow does geography play a role in recovery planning?

AEvery company should be aware of its environment. For example, if you're on the West Coast you're going to be more alert to earthquakes than you are to tornadoes. But being aware of your environment also includes knowing whether you're located next to a major highway, or if there's hazardous chemicals nearby.

Companies have to keep all scenarios in mind. Every company should be prepared for anything. You have to be diligent, especially if you're a publicly traded company.

Sunny Thao is a University of Minnesota student on assignment for the Star Tribune.