1 EDUCAUSE 2006 Tracking the Storm: Higher Education IT Readiness for Business Continuity Ron Yanosky EDUCAUSE 2006 2 EDUCAUSE 2006 Cant imagine? A weak defense I cannot imagine any condition which would cause a ship to founder. Modern shipbuilding has gone beyond that. FutureTitanic Capt. E. J. Smith, 1907 3 EDUCAUSE 2006 BC at risk What level of performance has your institution achieved in its IT readiness to support business continuity? (N=336) 4 EDUCAUSE 2006 What is business continuity? The institutions ability to maintain or restore its business and academic services when some circumstance threatens or disrupts normal operations. BC encompasses disaster recoverythe activities that restore the institution to an acceptable condition after suffering a disasterand also includes activities such as risk and impact assessment, prioritization of business processes, and restoring operations to a new normal after an event. 5 EDUCAUSE 2006 Some characteristics of BC emphasis on front-end service delivery, not back-end infrastructure holistic, collaborative, enterprise-wide concerned with post-recovery change IT supports it but cant deliver it 6 EDUCAUSE 2006 ECAR BC study 2006 IT readiness to support business continuity Web-based survey May-June 06, 340 responses qualitative interviews case studies 7 EDUCAUSE 2006 BC awareness 84.4% is higher today than two years ago 52.5% Sr. management places high priority on BCP 61.1% Awareness of the need for BCP is high Strongly agree + agreeStd. Dev.Mean At my institution: 1=Strongly disagree, 2=disagree, 3=neutral, 4=agree, 5=strongly agree BC/DR in EDUCAUSE Current Issues 2006: #4 in strategic importance #3 in likelihood to become more significant #9 in occupying IT leader time (tie) 8 EDUCAUSE 2006 Primary drivers for BC planning 9 EDUCAUSE 2006 BC in the organization Central IT is represented on 9 out of 10 reported ERTs 10 EDUCAUSE 2006 Exec responsible for institutional BCP 11 EDUCAUSE 2006 Institutional risk assessment 12 EDUCAUSE 2006 Status of planned/in-progress RA StatusYesNo Dont know Completion date set Assigned staff Allocated funds Exec/mgmt sponsor Participation from BUs Percentage responding in each category 13 EDUCAUSE 2006 RA procedures v. formal RA status Even some institutions with no plans for formal RA have some RA procedures... and most in- progress institutions have one or more. 14 EDUCAUSE 2006 Central IT BC/DR plan 26% of institutions provide depts/units with a framework for developing unit BC plans 15 EDUCAUSE 2006 IT BC/DR procedures v. formal plan 16 EDUCAUSE 2006 IT BC/DR procedures v. formal plan Plan Status BC Procedures MeanStd. Deviation Median No plan anticipated Planned for the future Work is in progress Work is completed Total Mean and median number of documented procedures rises with advancing plan status 17 EDUCAUSE 2006 What good is a plan, anyway? Those with a completed institutional RA, institutional BC plan, and/or central IT BC/DR plan are more likely to: have one of the other types of planning document have individual documented BC/DR procedures conduct tests of IT readiness to support BC have a hot site agree that BC practices are woven into business operations rate their institutions preparedness to restore centrally controlled systems higher 18 EDUCAUSE 2006 IT: Is there an alternative? IT BC/DR Plan StatusMean Std. Dev. Completed In progress Planned Not anticipated All If central IT systems and services were not operational at my institution, business units could carry out essential operations. (N=332) 1=Strongly disagree, 2=disagree, 3=neutral, 4=agree, 5=strongly agree 19 EDUCAUSE 2006 Bad things do happen: the top 8 Overall, 46 percent report disruptions in the past 5 years that triggered central IT emergency response 20 EDUCAUSE 2006 Consequences of disruptions 21 EDUCAUSE 2006 Testing Tests at my institution are...Mean Std. Dev. frequent enough challenging enough Does your institution conduct tests to assess IT readiness to support business continuity? (N=340) 1=Strongly disagree, 2=disagree, 3=neutral, 4=agree, 5=strongly agree 74% among those with completed IT BC/DR plans 22 EDUCAUSE 2006 Testing rate by institution size More doctorals report testing (54%) than other Carnegies (27% - 31%) 23 EDUCAUSE 2006 Hot sites Location relative to primary IT site % same building2.2 same campus38.0 < 5 miles miles miles12.4 > 100 miles16.8 Does your institution have at least one hot site capable of assuming key IT operations? (N=340) 24 EDUCAUSE 2006 Resources IT BC/DR Plan StatusMean Std. Dev. Completed In progress Planned Not anticipated All We have the necessary funding to deliver IT support for business continuity. (N=336) 1=Strongly disagree, 2=disagree, 3=neutral, 4=agree, 5=strongly agree 25 EDUCAUSE 2006 BC in the Budget MeanStd. Dev.Median Percent of central IT budget dedicated to supporting BC* *Excluding outliers reporting > 15% 26 EDUCAUSE 2006 What would it take to make you happy? We have the necessary funding to deliver IT support for business continuity. Percent Central IT budget for BC Mean Std. Deviation Strongly disagree Disagree Neutral Agree Strongly agree About 1.3 points of budget separate mean disagree & agree responses. 27 EDUCAUSE 2006 Mutual aid With...% Other higher ed97.0 State govt31.3 Local govt38.8 Other18.0 Does your institution participate in formal mutual aid agreements? (N=340) 28 EDUCAUSE 2006 Primary barriers to BC planning 29 EDUCAUSE 2006 Outcomes: restoring systems IT BC/DR Plan StatusMean Std. Dev. Completed In progress Planned Not anticipated All My institution is prepared to restore centrally controlled systems in the event of a disruption. (N=333) 1=Strongly disagree, 2=disagree, 3=neutral, 4=agree, 5=strongly agree 30 EDUCAUSE 2006 Some preliminary findings most respondents believe their institutions are at risk though they may be afraid of tempting fate institutional guidance on BC seems underdeveloped institutions lacking a completed BC/DR plan often have considerable procedure-level documentation still, plan completion is associated with good outcomes testing is infrequent and institutions worry about it two-thirds of respondents report they do not have the necessary resources for BC 31 EDUCAUSE 2006 Ron Yanosky