Component Four: Cost Analysis
You now know what our vision of a successful disaster looks like. You’ve assessed our needs and you have defined the RTO’s and RPO’s necessary to meet the overall objective. You now need to outline how much you should spend in order to achieve the desired results.
Many credit unions allocate significant portions of their budget to sell and market the services that generate the most revenue. Unfortunately, for many, IT is not considered a revenue generator. Many credit unions, especially those which have never experienced a natural disaster, security threat, or human error, struggle to justify spending on disaster recovery.
Disaster recovery spending is insurance against the risks of user downtime, data loss, and business interruption. While life insurance, health insurance, and homeowners insurance are pretty much a given, it’s difficult to assess how much coverage is enough, and how much to spend.
IT managers face the same issues in planning and justifying disaster recovery spending. While every credit union knows it needs some level of protection, determining the extent and the appropriate financial investment is an ongoing challenge.
Credit Unions don’t just hand money to anyone. They have a formula for determining the level of risk. They factor in the credit score, time-on-job, annual income, etc. Depending on the type of loan, they may even require the member to purchase insurance. All of this is done to mitigate the risk on the investment. Determining the appropriate financial investment for disaster recovery should be treated no different.
Disaster recovery is competing with new business applications, security solutions, migrations and upgrades, operations and maintenance, and IT cost reduction projects for a share of diminishing IT budgets. The challenge for IT managers is assuring that spending remains at adequate levels so they’re ready, should the unlikely occur, and that important new technology, training and processes are implemented to mitigate or recover quickly from realized internal and external threats.
| Unplanned Downtime
|
Typical Uptime | Hours Down per Year | Cost per Unplanned Downtime Hour | Downtime Risk |
| Average | 98% | 175.00 | $42,000 | $7,350,000 |
| Very Good | 99% | 87.60 | $42,000 | $3,679,200 |
| Outstanding | 99.5% | 43.80 | $42,000 | $1,839,600 |
| Best in Class | 99.9% | 8.76 | $42,000 | $367,920 |
Figure 1: Typical downtime risks for various availability levels. Note that a 1% increase in availability translates to more than $3 million in value. Comparing the cost of the disaster recovery plan with the risk mitigation value allows IT managers to make valuable spending decisions, and justify additional investments in disaster recovery solutions.
To determine how much disaster recovery spending is needed, IT managers should perform a three-step analysis:
- Assess the downtime costs for crucial business systems
- Calculate the potential disaster risks and impacts
- Compare alternative plans to determine benefits of each proposed solution, and how much spending is enough.
This review helps put the risks, possible projects, and benefits into perspective. Being systematic helps executives make the right spending decisions, and justify the disaster recovery investments against other competing IT projects.
Please check back with us next week when we cover “Component Five: In-House vs Outsource”.
