This Is Guernsey

NEARLY 80% of British companies’ disaster recovery plans are ineffective, according to a report from the Chartered Management Institute.

An information security breaches survey found that a third of companies still did not have a business continuity plan and half of those that did failed to test it. Dick Bush (pictured), managing director of local disaster recovery specialist MDS International, said the figures painted a very bleak picture.

‘The disturbing thing was that the vast majority of plans are lacking in some way when they are tested. A third have no plan whatsoever and a lot of those that do don’t even test it. When you link these factors together it’s extremely disturbing. The level of preparedness is nowhere near enough. That’s not just my opinion, but the evidence of independent reports.’

But it is not all doom and gloom.

According to the ISB survey, 99% of companies backed up their critical data and 86% did so on a daily basis.

While almost three quarters of businesses had a disaster recovery plan in place (up from 58% two years ago), 91% of large companies did so.

However, there are concerns about the effectiveness of these measures.

Chris Potter, a partner of PricewaterhouseCoopers who led the consortium that carried out the ISB survey, said it was worrying that only half of all plans had been tested in the past year.

HP Security Systems director Martin Sadler, another consortium member, said businesses needed to back up their data frequently.

‘One in five large companies now automatically replicates data to an off-site location…which poses its own security risks.

‘Many are now considering whether to encrypt their data.’

According to Marsh’s European business continuity benchmarking report, the main barriers to having a plan are lack of time (47%), conflicting priorities (47%), lack of resources (35%), lack of understanding (27%) and lack of budget (22%).

‘The conclusion to draw from this is that the barriers do not lie in lack of direction or general good intent,’ said Mr Bush.

‘They are more related to a lack of understanding of the level of resource and commitment required to do the job properly.’

Mr Bush did not accept that best practice was the main driver behind disaster recovery plans and highlighted the fact that regulatory compliance was a significant factor for certain firms.

‘Anyone in a regulated sector such as fiduciaries is taking it seriously,’ he said.

‘There is a trend nowadays for business continuity to be embedded in our culture, amongst those who do it.’

Seventy-three per cent of respondents said they thought that top management understood business continuity and provided full support.

‘If you don’t have commitment from the top, then the plan is doomed to fail, in my experience,’ said Mr Bush.

‘And while the economic downturn seems to be affecting business continuity, with around a fifth of barriers being related to budgets, our evidence is that this is not the case.’