Disaster recovery strategies: Should you outsource, manage in-house or partner?

• Does the existing data center facility meet DR site resiliency and reliability needs?
• Does the existing facility have enough power and cooling to meet the DR needs?
• Is the existing facility located far enough away from the production data center to be safe from disaster risks in the area?
• Does your business continuity plan demand production service levels when operating at the recovery site or can the business operate on reduced IT service levels?

If your answers to these questions indicate that existing facilities will meet your needs, then do-it-yourself is your answer. One last point to consider is the size/cost of the existing facility after a virtualization consolidation project. I have talked to several IT organizations that saw a dramatic decrease in space, power, and cooling requirements after they virtualized and consolidated their data centers to the tune of a 10-fold decrease. Their DR facilities were so large that it was less expensive for them to sell their oversized facility and build a newer, smaller facility; collaborate with a partner; or purchase space at a colocation facility.

• Can they produce a reference list of their existing DR clients whom you can contact? Your outsourcing candidate should be able to supply at least five good references. Any hesitancy or excuses in responding to this request are a red flag. Furthermore, the references should either be from varied vertical markets or from your same vertical market.
  
• The DR outsourcing firm should clearly state their prices, service levels, and their penalties should they fail to deliver in their offering to you. Penalties usually occur in the form of fee rebates or credits.
• Does the DR firm engage in over-booking? Should a wide scale disaster hit your region, contracting with a DR firm that engages in over-booking their facilities may leave you standing when the music stops. Some DR providers refuse to over-book so that they can guarantee service to their clients but peace-of-mind comes at greater cost. Be aware that the old saying still applies: "you get what you pay for." Firms that over-book their DR facilities tend to be substantially less expensive. On the other hand, a lower cost over-booking DR provider may be an option in a region that has very low risk of wide scale disasters.
• Does the DR outsourcer encourage and utilize virtual infrastructure? Virtualization both speeds disaster recovery and lowers overall costs. Most are just now getting on the virtualization bandwagon, so check how long the outsourcer has been implementing virtualization technologies and ask for virtualized reference customers. They should have two or more years of experience with virtualized DR.

In selecting a DR provider, you must absolutely check the providers' references. I've been surprised at the number of IT organizations that have told me they were dissatisfied with well-known DR outsourcing providers, and much happier after switching to another provider.

• Shared DR facilities work best between partners in the same industry. This makes it easier to maintain the integrity of regulatory requirements and audits.
• Both partners must have nearly identical security and operational governance of their production data centers.
• Clear contractual terms are a requirement for sharing a DR facility sharing. Employees come and go, so everything must be spelled out in well-defined contracts.
• Supplier/consumer partnerships are beginning to grow in popularity, but the consumer may also be working with the supplier's competitor – a condition that may spell too much risk for a DR partnership.

Lastly, if you have a DR facility in place already, you should review its applicability to your business continuity requirements on an annual basis. You may find that making a change can improve your service levels, reduce your costs or both. In today's economic environment, attaining cost savings through a different DR solution from the one you currently use is in order.