Managed Security Services

Gauging Potential Disaster Impact

This article provides a checklist of concerns any ISP will need to consider when building a disaster recovery plan. Business Impact Analysis (BIA) software can ease planning and implemenation.

by Elizabeth Ferrarini of CrossNodes, an EarthWeb site [December 19, 2001]

A key step in disaster recovery planning or business continuity planning includes analyzing the impact the disruption will have on an organization's business activity. A business impact analysis can help you identify which business departments, functions, or systems are most vulnerable to potential threats, what are the potential types of threat, and what effect each identified potential threat would have on each of the vulnerable areas within the organization.

Surveying tools, such as Business Impact Analysis (BIA) software, can help you to automate this very important task. BIA software enables you to query users for a business impact assessment so you can understand what critical processes the organization relies on, using the information provided to gauge financial and / organizational impacts over time.

The following purchasing template provides what you should look for in a BIA software, how to determine overall costs, what questions you should ask potential vendors, what questions you need to ask vendors' customers, what points you better double check, and how you can make sure you don't get a shock.

What things should you look for?
Select a product that provides tutorial materials to guide you through the use of the product. Look for a product that offers filters so users can sort information as they choose, that enables users to run multiple projects simultaneously, and that flags inconsistent or troublesome data. Make sure the product enables you to share BIA projects with other software packages. Other features to look for include the following:

• The ability to do currency conversions.
• The ability to import/export data, to print each project separately; and to archive information as needed.
• Compatibility with your operating systems and platforms.
• Technical support by telephone, and around-the-clock vendor support.
• A pool of survey questions (relevant to your business) that users can work with.
• Options for distributing a survey in different versions electronically via email, hard copy, etc.
• Security features, such as password protection.

What are your cost considerations?
You can uncover any hidden costs by doing a detailed analysis of all your costs. Some of the things to consider include:

• What does the license fee include? Is there a user fee? Are there any user limitations?
• What are the maintenance or upgrade costs?
• Is training included? If not, what does it cost to take a training class?
• Are consulting services needed? What is their cost?
• What information should you be prepared to give vendors?

What information should you have ready for the bidding vendor?
To bid for your business, vendors will need to know as much as possible about your network environment. Be prepared to provide them with the following information:

• Project time frame and budget.
• Scope of the project. Will it include international components or is it only US-based?
• How you view the BIA process. What do you expect to achieve?
• Resources you have to conduct a BIA.
• The number of employees using the software.
• How the company expects the BIA software to assist.
• How you might need to tailor the software.
• What platforms and systems the software will be running on.

What questions should you ask potential vendors?

• What's unique about your product?
• How long has your company been making BIA software?
• Will the software coach me through the process?
• Was the software purchased from another company or created in-house?
• How often are upgrades made? How are customers notified?
• How were the questions inherent to the software created? Can they be modified or added to?
• How experienced is the technical support staff? How many staff members are there?
• Does the software offer database technology, word processing, or both?
• Is the system tied to specific word processing or database programs?
• What types of security features are available?
• How is training offered?
• How flexible is the program? Is it scriptable? Can it be tailored?
• What are the printing options?

What questions should you ask the vendor's references?

• Why did you choose this particular vendor? What other vendors did you consider?
• What did your selection process entail?
• How long have you been using the software, and how has it helped you to do your job?
• Is the software easy to follow or to navigate around?
• Could you easily tailor the product?
• Describe your experiences with the vendor's support staff. What did you need them for?
• How quickly does the vendor respond to problems that occur?
• How was the training program? Did it address all necessary topics?
• Have you used consulting services as a supplement to the software? If so, how was the experience?
• Has the software enabled or hindered the process? In what way(s)?
• Were you able to use get product to do what you wanted it to do?
• Did employees have difficulty learning to use the software?
• Did the reports print as you had expected?
• Could you separate and sort information in the methods that you wanted? Have you been happy with updates and upgrades to the software?
• Do you find the security features adequate?

What things should you double-check?
Make sure the software can generate queries that are appropriate for your organization, and you can tailor as needed. Many organizations will use the BIA plan that the software helps create as a way to justify contingency planning costs to upper management. The software will need to produce quality information to be taken seriously.

What steps you should take before you the seal the deal?

• Request a demonstration disk to sample vendors' offerings and make comparisons.
• Ask if an evaluation copy of software is available. Be sure to find out how long you can use the evaluation copy.
• Determine which company employees should be included in the selection process and how many individuals will need to use the product.
• Create a sample of concerns you want the software to address.
• Find out about availability of on-site demonstrations by vendors that make your short list.

—End