Asian firms prep for disaster, but not well

More companies in the region recognize the need to establish business continuity (BC) and disaster recovery (DR) plans, but many still face challenges ensuring the successful deployment of such efforts, say industry players.

According to Andy Ng, Asia South and Korea senior director of global services at Symantec, most enterprises today have already put in place some sort of DR measures.

"A survey conducted by Symantec noted that there is high awareness of DR among Asian companies," Ng told ZDNet Asia in an e-mail interview. "The top three issues that have prompted Asian businesses to create DR plans include measures against virus [and malware] attacks, the fear of losing customer data and natural disasters." Conducted last year, the survey polled 1,000 IT managers and C-level decision makers, 30 percent of whom were based in the Asia-Pacific region, including Japan.

The survey also indicated that Asian companies may still be exposed to risks from inadequate DR planning and testing, Ng noted, especially since 92 percent of respondents said they tested their DR plans only once since such initiatives were established. This, he warned, was insufficient to ensure the company's BC plan is effective.

He added that due to the increasingly complex environment and proliferation of devices in the workplace, less than half of DR plans in Asian companies included desktops and laptops, remote offices, mobile technologies and employees' home computers in their DR strategy.

The survey findings highlighted the need for Asian companies to reassess their DR plans and strategies to ensure successful recovery of data and applications, with the least amount of impact to business operations should an emergency arise, Ng noted.

Graham Titterington, principal analyst at Ovum, said some enterprises may not even have a BC or DR plan because of their inability to accurately estimate the risks involved and convince management to support the assessment.

"People tend to overestimate the likelihood of rare but serious threats, while underestimating the rate of occurrence of more normal events that still have a serious impact on their businesses," Titterington said in an e-mail interview.

In addition, the returns on investment for DR implementation are difficult to determine as such plans are a form of insurance, the analyst said.

"Most organizations approach insurance by deciding what they need, and then searching for the best available deal for it," he explained. "For these cases, companies can look at the rate of incidence over five years, for example, to estimate the cost of each incident and the cost of BC provision to protect against them."

However, it is challenging to justify the expenditure to protect against big disasters, Titterington said. For all categories, companies can compare BC budgets against insurance budgets and assess whether these are comparable in terms of the cut-off expenditure point, he suggested.

"Beyond that, companies can decide what they can afford to spend on BC and what disasters really would be devastating for the business," he said, adding that enterprises cannot protect against every risk as the cost of protection would be too great.

How prepared is Malaysia?
According to Raymond Chee, CEO of Emerge Systems, enterprises in Malaysia, especially small and midsize businesses (SMBs), are not actively pursuing, let alone implementing BC plans. Emerge Systems is a local Web hosting provider.

Chee noted that SMBs tend to follow a three-stage business maturity curve, where the first is to establish an online presence and use e-mail and the Internet to conduct business. The second phase involves scaling up their infrastructure to support e-commerce and online payment, and the last encompasses the deployment of BC plans, he said.

"Most SMBs have only begun grappling with the first stage of the curve," Chee told ZDNet Asia in an interview. "Some larger SMBs may be at stage two, but few are at stage three."

While BC is critical to the survival of SMBs, he noted that many were not immediately concerned with the issue because the first priority for these companies is to ensure business survival. He added that the cost of implementing BC plans is still prohibitive for these small businesses.

"Many SMBs are still ignorant of the importance of a BC plan, and the only way to address this is to educate them," Chee said. "The industry as a whole must work together, from vendors that need to provide affordable solutions for SMBs, to service providers that need to show SMBs the greater opportunity costs of losing information if they didn't invest in BC."

Edwin Yapp is a freelance IT writer based in Malaysia.