• Nicely said, a good balance of information and humor.

    I was involved in the Sarbannes Oxley preparations last year at my company and we implemented the CobiT framework in IT (Control Objectives for Information Technology) to prepare. One of the sections I had to deal with was "Ensuring Continuous Service". Our charter was based on the fact that we lost our data center building and had to quickly come up elsewhere  and how do we build preparations for dealing with this.

    I jested that I thought it was a silly exercise (in my company) since I'd likely be cutting my resume rather than putting this place together.

    Actually it was an interesting exercise, and given the scope (> 1000 Servers) it seemed somewhat silly. Everyone said to get a list of priorities from the business, but guess what? First they don't care. Each person's system (finance, HR, sales, etc) is the most important and rather than creating a big arguement, especially since most people in the business don't know about IT dependencies, I setup a list of servers I thought were important. DCs, LDAP, DNS servers first, mail, major business, etc. We continued on with the process, knowing that most of it would never be implemented because we'd never get to test it because of time and money.

    DR is a nice idea, but beyond covering your basic items, hardware failure, data entry issue, virus, minor, limited scope stuff, I'm not sure there is value in doing a lot. Many of our systems are running the enterprise, mail, sql, etc., but for many of them a few hours or downtime or even a day isn't threatening to the business. We don't implement clusters because of the cost, complexity and the bang for the buck. A major press release (like last summer when my company was acquired) can disrupt business for a few days and very little gets done while IT systems hum along quietly. The reverse wouldn't be the end of the world for many places.

    As for true disasters. Fire, bio, terrorism, etc. These are extraordinary events and complete planning for them (unless you're in a life endangering industry, hospital, power, etc.) isn't worth it to most businesses. That's why you buy insurance and you deal with them when you can. Clustering and a number of other solutions won't help if your data center goes up in a fire. In that case, you pick up the pieces, get your backup tapes from offsite (where they should be) and go forward.