Back in 2001, the Bank of New York -- the oldest in America -- was one of the few businesses with a disaster plan in hand. Yet, the September 11 terrorist attack wreaked havoc on the bank's operations. The World Trade Center catastrophe blew out the windows of the bank's data center, which was located across the street from the Twin Towers, and littered its offices with debris. Damaged communications lines forced the bank to vacate its downtown Manhattan offices and relocate 8,000 employees. Some data were lost in the confusion, and the staff spent weeks reconciling transactions.
The bank, a subsidiary of Bank of New York Co. (BK), has learned from the experience. Now, it backs up 100% of its data in two locations, in real time. Just to be safe, it also copies the files to backup tapes several times daily -- so that if a disaster were to strike, reconciling transactions would be easier.
The bank has also built a new data center outside of New York, and it has new facility where it has created a complete replica of its current network -- just in case the original is ever destroyed. It has also reorganized its most critical businesses, such as its funds-transfer unit, into geographically dispersed, independently functioning concerns, says Jeff Kuhn, the bank's senior vice-president in charge of business continuity.
DOWNTIME IS WORSE. The Bank of New York has done more than most companies to protect against terrorist threats, at considerable expense. But it had no choice. Its customers -- among them some of the world's leading corporations and banks -- wanted assurance that it could function no matter what. "To be in this business, you need to be a leader in business continuity," Kuhn says. And the investment in that effort -- which the bank will only say is "significantly" higher than before 9/11 -- is nothing compared with the cost of downtime, which can range from $86,000 to $6 million an hour, depending on the industry, according to market consultancy Gartner Group.
Post-September 11, the global financial industry has led the private sector in business-continuity spending: It will lay out $3.56 billion on such projects this year, up 26% from 2001, estimates Virginia Garcia, an analyst with the financial-services industry consultancy TowerGroup in Needham, Mass.
Now other organizations are opening their wallets: After months of delay, government spending on business continuity is on the rise. "In the past four weeks, [government] budgets are finally getting unlocked, and we're seeing orders," says Don Hirsch, vice-president for information technology at American Management Systems (AMS), a technology consultancy based in Fairfax, Va.
UP TO THE BOARD. Nonfinancial companies likely will ramp up their spending, too, as the economy improves. According to a recently published Gartner survey of 620 chief information officers, business continuity is a top-three priority -- ahead of such initiatives as Web-enablement. After all, most companies are still unprepared for the worst. A November, 2002, Gartner survey of 205 companies showed that one-third were at risk of losing critical data or operational capabilities in a terrorist attack. About 24% of the respondents blamed their predicament on budget constraints.
That could change as business continuity gains a higher profile. Already, the decision-making on this "has gone beyond the IT director, to the CEO and the board," says Steve Cooperman, vice-president for homeland security solutions at database software company Oracle (ORCL). Having witnessed the disruptions from 9/11, CEOs see value in making their companies' data and communications systems more robust.
Some are buying MirrorView software from computer storage maker EMC (EMC). It allows for real-time replication of data over distances -- meaning that every transaction recorded at a data center in New York City can instantly be copied to a data center in New Jersey. Recently, the product has become more automated, so that it detects when the system is down at the primary site and immediately switches to the alternative location, says David Purdy, EMC's director of business continuity.
AUTO-RECONFIGURATION. With business units becoming more geographically dispersed, being able to find key data from multiple locations is another must-have for many companies. Previously, managing such data often had to be done using a specific PC in a particular location. But with Omegamon DE, a product from Candle, a private outfit that manages the tech infrastructures of large companies, corporations can use several dedicated notebook computers for this function, says Pete Marshall, assistant vice-president for systems management at Candle.
An Oracle product called Real Application Clusters, released last year, uses a similar approach. It allows access to the corporate database via several "nodes," or small servers. If one machine goes down, the system will reconfigure itself in less than a minute to run on the remaining nodes.
Many companies are also looking at making more use of data to beef up security -- which has come to be viewed as an integral part of business continuity. Later this year, EMC plans to introduce a security product that will include applications such as facial-recognition software that will search through databases for faces of wanted criminals -- or people who it might want to deny access, says Purdy. That could come in handy for corporations that issue badges to all visitors -- and take their pictures as part of the process.
IS IT A VIRUS? And about four months ago, Oracle released its Health Data Integration Hub, which allows the combination of information from different hospitals, say, into a single data warehouse. That could make it easier to spot trends: If hospitals start issuing more decongestants, perhaps a virus is on the loose.
Making communications systems more robust is another key corporate priority. Last summer, equipment maker Avaya (AV) introduced an emergency notification system that makes it possible to preprogram communications networks for various disaster scenarios. Each scenario is given a code. If disaster strikes, a designated employee can pick up the phone, punch in the code, and activate the program, which then sends special messages -- by phone, fax, e-mail, or pager -- to the appropriate employees. This product retails for $15,000 and up, depending on the number of people on the system, says Steve Hailey, senior business-continuity consultant at Avaya.
Last summer, Avaya also began selling a piece of software that grants corporate emergency staffers access to phone lines when the network is overloaded. Each emergency responder gets a special code that, when punched into a phone, frees phone lines so the person can coordinate the company's evacuation efforts, for example. Avaya also now markets its mobile communications network -- previously sold mainly to companies that manage trade shows -- to corporations that fear their communications lines could go down in an emergency. Rugged portable boxes, weighing about 150 pounds each, allow for phone calls and Web access via phone lines, satellite, wireless, or two-way radios. The system costs $20,000 and up, says Hailey.
WHERE ARE YOU? A simpler solution is the wireless cart from computer maker Gateway (GTW). It's literally a cart loaded with laptops -- each equipped with wireless cards for connecting to the Web. The technology, designed originally for classrooms without wired Internet access, is now marketed to corporations looking for a communications alternative if their phone lines go down, says Jay Lambke, a vice-president at Gateway. The cart can rely on DSL or cable connections, and enable a corporation to access the Web -- and, with special gear, even make phone calls -- over those connections.
Like Gateway's laptop cart, many business-continuity improvements don't require huge sums of money. After September 11, it took AMS three days to locate all of its employees, who had worked in offices near Ground Zero. Since then, the company has implemented a special sign-in system that other companies also use. Whenever employees sign into its network, a page pops up asking them to enter their location, explains Hirsch. During the times of high terror alert levels, when the system was tested, 90% of employees have been accounted for on a given day, he says.
Testing backup systems often is as important as buying the right one. During 2002, IBM's (IBM) disaster-recovery clients tested their systems 35% more than the year before, says Don DeMarco, Big Blue's vice-president for business resilience. IBM also does business-continuity outsourcing at 4 regional and 17 local facilities in North America, for clients that don't want to run their own backup systems. This service can cost anywhere from several hundred dollars to $1 million a month, depending on the customer's size and requirements. IBM's revenues from this business have risen at double-digit annual rates since 9/11, DeMarco says, though he declines to disclose specific numbers.
STILL UNCERTAIN. Whether corporate customers will turn business continuity into a mainstay of the technology business remains to be seen. "The dialogue around business continuity and homeland security is way up, but the actual buying is not," says Gateway's Lambke. In part, that's because "the buyers are unsure of what they need to protect against." What's more, projects related to business continuity are often perceived as preserving revenues, not creating them -- and in a tight economy that gives CEOs pause, says Larry Kalmis, vice chairman of the Business Continuity Institute, a professional association.
Still, customers such as Bank of New York's are inquiring often about where their suppliers will stand in case of another 9/11. And sooner or later, even the most frugal CEOs will have to deliver what their customers want. By Olga Kharif in Portland, Ore.