MORE THAN 20% OF COMPANIES HAVE NO DISASTER RECOVERY PLAN

12 October 1999

by Cutter Consortium

According to a new study from Cutter Consortium, 20.4% of organizations have not developed a disaster recovery plan. The Cutter study also examined the importance of disaster recovery plans to security and why companies initiated these plans. Nearly half (47.3%) said that they developed their disaster recovery plans because doing so is considered a "best practice." Additionally, nearly one-third (31.3%) created their disaster recovery plan as part of the company's strategic plan. Y2000 planning motivated 15.2% of the responding companies to develop disaster recovery plans.

Sheila Green is a Senior Analyst for Cutter Consortium. Says Green, "When we discuss security issues, we often forget about preparing for instances when a problem actually arises so that we have to recover lost data. But recovery is as essential to security as authentication. Companies need to make sure they don't short-change security strategy by undercutting investments in systems recovery and business resumption planning."

Green continues, "A disaster recovery plan is useless unless it will work when needed. In order to find out if it will work, it must be tested, but 26.1% indicated that their plans had not been tested."

"Although it appears that the majority of companies are at least addressing the basic IT security issues by developing a formal policy and standards, we need to be concerned about those that are not. They put the rest of us at risk. Also, we do not know from this survey how comprehensive or detailed the plans are, how frequently they are updated, and whether or not there is adequate communication and training regarding the plans. These are all critical issues that deserve our attention."

-- Cutter Consortium