A disruption to your computer systems does not have to be spectacular to create disaster.
A badly-timed blackout that knocks your servers out can be as damaging to your business as a dash of maple syrup is in the gas tank of your car. Most companies should have some type of disaster recovery solution in place, experts agree.
Disaster recovery specialists say that while SAP is very good at telling customers what they need to protect, it is up to the customer to make sure there is a disaster recovery plan in place. There are a number of options out there to make sure you are ready for disaster. Finding the solution that fits your needs without getting cumbersome and expensive takes some planning, the specialists say.
A good disaster recovery plan entails more than a backup-solution for your computer system, said Kenneth Graap, an AS/400 systems administrator at Northwest Natural, Portland, Ore.. Disaster recovery really means ensuring total business continuity, not just for IT operations.
David Budnick, director of services Marketing at BlueStar Solutions, Cupertino, Calif., said disaster recovery plans should include such simple things as having desks, telephones and other low-tech details necessary to keeping a business functioning.
"The key is looking at your data center [as a whole] rather than a particular server," he said.
Disaster recovery for SAP
When you have your SAP system installed, you don't have a disaster recovery solution, Budnick said.
"SAP has standard methodologies for doing backups and restoring the SAP environment, but there's nothing built into their application that specifically targets disaster recovery," he said.
In other words, SAP tells you very explicitly what you need to protect, but you're on your own in figuring out how to make it happen, Budnick said. It is common practice among third-party solution providers to ask about disaster recovery, but if you're doing your own thing it is important to be aware of the need for a disaster recovery solution.
Outsourcing vs. building a secondary site
There are two ways to go about setting up your disaster recovery solution: Outsource or build your own secondary site. Outsourcing may be more convenient and less expensive, especially for smaller companies on a tight budget. Simply approach the outsourcing company with your needs, and they will pretty much take it from there. Graap likens it to an insurance policy, where you pay a premium on an ongoing basis for the security.
If you decide to outsource, ask colleagues for recommendations and spend some time researching prices, which can vary a lot. But make sure the outsourcer can step up to the plate in the unlikely event that you need their services, Graap said.
Building your own secondary site requires a larger investment up front but the leaves you in full control of your contingency plans rather than be at the mercy of an outsourcing company. If your outsourcing provider falls through for some reason -- such as being in the same disaster zone as your main office during an earthquake for example -- you're in trouble. When building your own site, you can prepare for more scenarios and place it far enough away from your main office.
High availability vs. cost
Specialists say one of the most important questions to consider is availability and how quickly you need to get your systems back online. The difference between getting back online in 10 minutes or three days could be millions of dollars, so you want to make sure you get just the right solution for your company, Graap said.
Around-the-clock availability will require mirroring content across two sites in real-time, Budnick said. This enables you to do an instant failover with little or no downtime, rather than force you to physically move from the office to a backup site with a stack of tapes.
Regardless of whether you outsource or set up your own site, a high availability solution is expensive.
"But if that is what it takes to keep your business from going under, it's worth every penny of it," Graap said.
An added benefit of having a high availability solution is that you can avoid maintenance downtime by working on one server while letting the other handle all traffic, Graap said. In theory, this leaves a window of risk, but most maintenance tasks, such as backups, can be cancelled if need be, he said.
One consideration for mirroring data is the bandwidth to the secondary site, Graap said. Replicating data in real-time requires enough capacity to handle it without hitches. Also, a secondary site will require the same disk space as your regular servers. You can probably get away with a smaller and cheaper system, but you still need enough storage space to match your primary servers, he said.
Whatever the choice for disaster recovery, said Budnick, it is vital that both the technology and the business departments know about the plan ahead of time.
Testing your solution
Ok, so you have a disaster recovery solution in place. Great, you're home free, right? Not quite. It must be tested continuously it to make sure it works in real life, Budnick said. Sometimes management can be reluctant to spend the money for a real test, or perhaps there are pressing deadlines to keep but Budnick said it should be tested one or two times a year.
Many people who build good plans let them sit collecting dust for years, at which point half the key people in the plan have left or changed positions, Budnick said. Update the names, phone numbers and other vital information frequently and test them, he said. It is for the same reason you do fire drills: When the real thing strikes, there's no room for error.
In testing, consider different scenarios and the physical steps needed to get the data center up and running, Budnick said. For example, many disaster recovery solutions require at least parts of a staff to get on a plane and physically move to the secondary location. But September 11 showed how that is not easy when all planes are grounded, he said.
Costly but vital
Disaster recovery is not cheap, and it requires lots of testing to stay current, but it could save your critical data, said the specialists.
"Any customer who makes an investment in SAP is purchasing an enterprise-class application, and as such really should have this level of protection for their business," Budnick said. "I can't imagine why anybody would not have an interest in disaster recovery."
Dig Deeper on SAP security administration