Metrics for Disaster Recovery and Business Continuity

Benefits of DRP Metrics

Metrics present information on performance in objective terms.
In order for that to happen there needs to be awareness training for what is expected when the Disaster Recovery Business Continuity Plan is activated. Metrics help focus on issues that management needs to know.

For example, if the Disaster Recovery Business Continuity plan indicates a recovery time objective (RTO) of six hours and the true recovery based on testing is 24 hours, it needs to be communicated so that It can be put into people’s objectives (i.e. responsibilities) and measured.

Part of the process in creating an accepted enterprise-wide Disaster Recovery and Business Continuity plan is to create metrics and expectations that meet the strategic objective of the enterprise.

There are two components that are critical for this process: Service Level Expectations and Recovery Time Standards.

Service levels Expectations

There is an expected service level that the business relies on to assess the 'up time' required for specific business functions. Information Technology (IT) has this responsibility. The IT group may be an internal organization or an outsourced one. On at least an annual basis or when service level contracts are established and/or renegotiated, service levels are set for various activities, such as metrics, billing, etc.

Application 'up time' is based on normal production processing throughout the day/week/month and is gauged a success or failure by the percentages that are agreed upon. These are normal production expectations of service delivery.

Recovery Time Standards

When there are disruptions in the service and the expected service levels are at risk, another metric standard is used: recovery time. The standard defines the allowable time between when the clock starts and stops for the disaster recovery and business continuity processes. If 0-4 hours recovery time is acceptable, then disaster recovery and business continuity should be started at least one to two hours prior to the maximum recovery (four hours).

Service level expectation versus recovery time standards

Recovery times are closely monitored during recovery process. Working in a framework which understands roles and responsibilities not only allows management to understand the difference between service levels and recovery times, but solidifies the involvement and value with our IT with the business units that it serves.

Sample Metrics for the Disaster Recovery Business Continuity Plan and Implementation Process

Total number of applications supported from the computer facility - The breath of the potential for Disaster Recovery Business Continuity requirements
Percent of total applications covered by a Disaster Recovery Business Continuity strategy - Could include hot sites, high availability systems, quick ship requirements, etc.
Number of Disaster Recovery Business Continuity test hours scheduled each year - This is the total scheduled test time in a one-year period
Percent of total Disaster Recovery Business Continuity scheduled test time actually used each year - Could be under or over 100%, and can be reported as a cumulative metric throughout the year
Number of months since the last Disaster Recovery Business Continuity Plan “Maintenance Cycle” - Ideally, this should not exceed three to four month.