Marathon Banner

Tuesday, August 24th, 2010 - 5:27 pm EDT

Effective Risk Assessment: Q&A

Posted by: Michelle Liro

We had a very lively presentation and Q&A during last week’s webinar “How to Cut Risks and Costs with a Downtime Analysis and Action Plan.” A summary of the Q&A is below.

Q: Should branch offices be included in a downtime assessment?
Absolutely – you can’t ignore branch offices. Forrester estimates that 20% of your business comes from branch offices. IT needs to make sure to include those in your assessment plans and budget.

Q: How often should I conduct a business and risk impact assessment?
We’ve found with our customers that an annual assessment is usually sufficient, unless you have some significant kind of change like an acquisition or new location. In that situation you obviously need to do a refresh. You can then use that info moving forward as you conduct your annual assessment.

Q: Is there any available information about rough cost estimates of down time impact in control systems like DCS or SCADA and Historians like the one you showed for IT systems in one of your slides?
We work with a number of ISVs in the process control space including GE, Johnson Controls, Rockwell and many others. We conducted an assessment in a pharmaceutical plant where one minute of downtime lead to the discard of an entire batch, which resulted in a loss of $950,000 to $1.1 million. In process automation and process control, downtime also effects efficiency. We had one company doing waste water treatment and they couldn’t handle the processing levels because of the downtime that they were having, and they were considering opening up a second facility. The assessment revealed that they could actually just retool their existing applications to increase their efficiency and not have to open a second facility. There’s a huge safety element here as well. When some types of systems go down, it can cause significant safety hazards to employees and others. This should also factor in to your downtime risk assessment.

Q: What about hosted applications? How can I incorporate those into my assessment?
Very often, some of your most critical applications are no longer hosted at your site. There’s still obviously extremely important to the business and need to be included as part of your assessment. Treat them exactly the same as your on-site applications, but just make sure that the vendor has the protections in place to keep your applications at the necessary levels to ensure their availability.

Q: With the increased reliance on the Internet, how do you factor the loss of the Internet (i.e. nationwide cyber attack) in risk/mitigation planning?
What we covered in the presentation is mostly what’s under your control, but you do also need to factor in security needs as well. Look at the areas out of your control as well. For example, what would happen to your business if my internet connection is down? Should you have a secondary carrier? ARe you going to go from a T1 connection to some other kind of connection?

Q: Are Marathon’s assessment services delivered primarily as a way to introduce Marathon software into the account, or do you sometimes recommend other software solutions that may be a better fit?
It depends on what you need. Sometimes we’ll go into an organization and do an assessment and they’ll have applications that aren’t necessarily mission critical and they can deal with several hours or days of downtime. What they already have in place might be acceptable for that situation. Or they may be in a situation where they just need disaster recovery. For the instances where there are mission critical applications involved and they can’t tolerate downtime or data loss that’s where we come in.

Q: Would you ever recommend the use of cloud-based VMs for disaster recovery?
It depends on your needs. When you look at the spectrum of availability, there are just so many buzz words and acronyms out there. Fault tolerance, high availability, disaster recovery, business continuity, replication, and on and on. There are efficiencies with cloud-based DR, but the reality is that a lot of these services use a “recovery” model, which means there is downtime involved. These type of services don’t keep your business going during an outage, they just help you to recover after the fact. At Marathon, our focus is on the prevention of downtime and the continuation of business.

Q: Is there a tactic (rule of thumb) you'd recommend to avoid departments classifying everything as mission critical, as everyone believes there app is mission critical.
Every department likes to think that their particular applications are critical to the business. This is why companies like to engage third parties to help them with this process. Companies like Marathon can come in with an objective perspective, ask detailed questions, and provide guidance without any of the internal politics getting in the way.
 

Show Discussion / Comments (0)
Webinar  Downtime 

| More