Complacency in BCP Adoption One Year After the Blackout

One year ago today, I was working at my desk when the power went out. As it was just after 4 in the afternoon, I thought I would pack up for the day and go pick my daughter up from pre-school. It was only after I got behind the wheel of my car did I realize that the power outage may be much bigger than I originally thought.

We've all heard countless stories from that day, and I actually used the opportunity to make my first blog post from a blackberry. A year later we are that much wiser about the vulnerabilities associated with our dependence on external systems, as well as the perils associated with disruptive events. Or are we? Seems as though the answer is not quite. A spate of articles that have come out over the past week indicate that despite our exposure to an increasingly high number of disruptive events, organizations big and small and across several countries still aren't getting the message about the need for adequate preparedness.

In the UK for instance, a recent poll suggests that businesses still remain complacent about disaster planning and business continuity, despite having direct experience with a large-scale event of mass disruption:

A poll of more than 1,000 firms in and around Manchester taken shortly after a serious fire in a BT hub in the city last March reveals evidence of complacency about communications disaster planning...Three quarters of organisations quizzed by Direct Response admitted they would lose sales calls if the event of a similar incident again. Almost one in five (18 per cent) estimated they would lose more than 100 enquiries per day in the event of a repeat performance of the fire. Despite this only a third of the companies polled by Direct Response had a disaster recovery or business continuity plan in place.

A poll that was just released in Canada this past week reveals a similar degree of apathy:

only about half (45 percent) of decision-makers in Ontario's medium to large-sized businesses are confident that government leaders have taken the necessary steps to ensure another blackout or similar state of emergency will not occur. Despite the immense disruption in business they experienced last year, only a third (30 percent) of the organisations surveyed have a full-blown business continuity plan in place

If there is a silver lining to this, it does appear that on the data side (particulary data backup) although some gaps may still remain, the message seems to be getting through.

It appears as though the key distinguishing factor between adoption rates among U.S.-based enterprises and those in places such as the U.K. and Canada is that organizations in the U.S. seem to have a bigger picture understanding of the implications and the business rationalization for preparedness:

"The regulations are driving the need as well...In this day and age, if you don't have a DR plan in place, you are being irresponsible as an employee. So the Big Blackout was just icing on the cake — the DR engine had started to move well before that. The other thing to realize is that even mid-size companies are evaluating products in this area. And mercifully, the technology curve has caught up such that DR does not need to be the prerogative of only the rich and few."

Enterprise Strategy Group analyst Peter Gerr sees two trends accelerating the adoption of disaster recovery and business continuity solutions: the need to comply with the new regulations, and the development of lower-cost alternatives to enterprise-class solutions.

Compliance -- especially to more stringent requirements of insurance companies -- in our opinion, will be the biggest driver of greater adoption of enterprise-wide business continuity thinking. It will be interesting to see the progress we have made on the second anniversary of the big blackout.