Start Building the Case

Once you have learned what you need to know, the next step is to begin to put together a calm and rational case that explains in nontechnical terms what the vulnerabilities, risks, and costs are. The case must include a discussion of the risks of inaction.

Find Allies

Ask around your organization. Look for friends and colleagues who share your concerns. Maybe you’ll find someone who has tried to convince management of something in the past. At the very least, though, it is best if you can find people in other organizations who agree with you and who can help build the case. If you are a Windows system administrator, speak to the Unix system administrators and see if they agree with you. Contact database administrators, as well as network and storage administrators. If the problem that you have identified is a real one, it surely affects some of these other people. Maybe you can also identify some end users who share your concerns and invite them to join the fight. If your organization is large enough to have multiple facilities, contact peers in other facilities and see if you can find allies there. If you can demonstrate to management that your concerns are shared in different parts of the organization, your case will be much stronger. On the other hand, if you can’t find allies in a medium- to large-sized organization, that may be an indication that your efforts will not succeed and that you should probably reconsider your efforts.

One problem that can arise when you bring in additional people is that different people have different perceptions of a problem, as well as different priorities. To be successful, you must take input from every member of the team and make sure that their concerns are addressed in the final presentation. It may become necessary to compromise and change the level of priority that certain issues receive. But if you aren’t willing to compromise, you run the risk of having some of your allies drop from the effort or, worse, form a competitive group. If that happens, both movements will likely fail.

Develop a Set of Recommendations Once your list of vulnerabilities and ratings is complete, it’s time to develop a list of recommendations. If you have made a solid and sober case, and you can follow that with some equally well-thought-out recommendations, you will maximize the likelihood that you’ll get the resources you are looking for. Choose no more than three or four of the most serious vulnerability scenarios— the ones with the highest likelihoods and impacts. Develop complete plans to address each of them, with alternatives at different cost levels. Choose one that you like best, and recommend it the most strongly, but make sure that all of the alternatives are palatable. The recommendations should include a pure business discussion of costs versus risks, along with those old business school chestnuts return on investment and time to payback. What are the objectives? Why are we discussing this? What is the potential benefit to the business? Be as specific as possible. Discuss the impact on current ongoing operations of implementing your solution; will there be downtime? How much? What will it all cost? When estimating costs, be sure that your numbers are realistic. If someone challenges you on acquisition or implementation costs, be sure that you can defend your numbers. Cite sources for your information. Discuss the hidden benefits of your proposal. For example, will having better recovery plans result in a reduction in the enterprise’s business interruption insurance premiums? (You may not be able to accurately determine this, but it’s something to include as a potential hidden benefit. For example, a completed and tested disaster recovery plan can reduce these very expensive premiums by 20 percent or more.) If the plan includes purchasing additional computer equipment or real estate for a disaster recovery site, what additional benefits can these resources provide the organization? Will you be able to offload backups from primary systems? Will you be able to house additional personnel? Is there a chance the property value will rise? Remember that financial arguments are most likely to get attention from upper management.

Be sure you also consider the short- and long-term business impacts of extended outages to the organization’s reputation. Will there be front-page articles on our experiences? How will those articles affect future business? And then there are the intangibles, like loss of market share and investor confidence. Your outage could put you in violation of all sorts of industry regulations, including some of the ones we discussed before. Your outage could even tarnish the reputation of your entire industry. It could also alienate customers, either present or future.