Contingency Planning

Planning for the Unexpected

Sometimes life throws us a curveball, and it'll do the same thing to businesses. When business is running, there are things that can happen that can disrupt the flow of business, and we need to plan for those types of events. If we don't have a plan ahead of time, then it could be devastating when we reach the point at which one of these events occurs.

Contingency planning just means a backup plan to deal with unexpected events. One of the examples that I like to use for this is earthquakes, and the reason is because I live in an earthquake-prone area, where when we get an earthquake it could be devastating to our infrastructure. What it could affect is the technology within our building. It could even affect the people that are at home trying to deal with the destruction of these earthquakes. So we have to deal with all aspects when it comes to contingency planning, not just technology.

These types of events can affect our data center, our workforce, our customers, our partners, assets that we have, processes that we go through. It could really disrupt all aspects of business, so we need to start coming up with a plan.

In my example of an earthquake, we start thinking about geographical distribution — but not just the geographical distribution of our data center, making sure we have multiple regions with our data and our services, but also with our workforce. Maybe we go to a remote workforce where we have people living all around the country, so that if one area of the country is affected, that doesn't destroy all of our business processes, only a certain element of it. Then we also think about things like automated recovery and a disaster recovery plan.

The Different Plans

One aspect of contingency planning is a disaster recovery plan. Where a contingency plan is thinking about all aspects of some sort of event, a disaster recovery plan really tackles the issue of how do we recover when we have some sort of technology issue.

Now, there are some differences between disaster recovery and the rest of these. In fact, we have multiple plans. We have an incident response plan: when an incident happens, we need to respond to it and start investigating it. So actually a disaster really starts out with an incident response — we're responding to an incident, maybe we got attacked by a hacker and we're responding to that, and then we discover we need to fail over to a whole other disaster recovery site, or we have to start doing replacements of systems or something, because this is a full-on disaster. So we call it at some point in time that this is a disaster.

A contingency plan starts looking into what the contingencies are for different events. Let's say an earthquake: we have an earthquake, and now what is our contingency plan?

A business continuity plan is like a full shell that encompasses all of this, so we roll in our contingency plan into our business continuity plan, our disaster recovery plan. It's our whole plan for all of these contingencies. So when you look at the contingency and business continuity plan, this is kind of the business operation level, so it's much bigger in scope, versus an incident response plan and a disaster recovery plan, which have more to deal with systems.

People, Processes and Technology

With all of these, we want to look at people, processes and technology. PPT is something that we can use to really understand where it is that we need to be looking.

• For the people: who's responsible? Let's say if we're talking about a disaster recovery plan, who's responsible for rolling it out and getting systems set up and all the communication — what are their roles?
• With the processes, we're looking at the tasks and the documentation needed to roll different pieces of equipment out, or different services out.
• With the technology, we're looking at the servers, facility, alternate sites and supporting technology needed to roll all of this out.

Capacity Planning

One thing we really need to keep in mind is capacity planning. If there was an earthquake in this area and all my employees are from this area, that could be problematic, because now I'm relying on people who could be taking care of their families, could be taking care of their homes that have been broken from this earthquake. So we need to think about what is the capacity that people are going to have in these incidences.

And what is the technology, what's the capacity of the technology? Maybe we don't have a full failover site with all of the same technology. Maybe it's different technology and it's not quite as robust — the processing power is not quite as robust and the machine specs are not as much. So we need to think about that.