BIOS: Technology Means Business

The need for business continuity planning is as vital in the legal profession as it is in any major industry - and in some ways, more so. Traditional backup systems, commonplace in many legal companies, do not offer the level of data protection that is critical to professional productivity and practice continuity.

Many benefits accrue from business continuity planning, including high availability of systems, good disaster recovery procedures and better backup systems - all of which mitigate unplanned outages. Additionally, Sarbanes-Oxley and other compliance regulations have impacted data and record retention for many business sectors served by lawyers, including financial, government and healthcare.

Two notable factors make business continuity planning in the legal segment especially important. The average legal practice has the highest percentage of revenue generating workers per company of any major industry in the world. This results in an even greater need for high productivity and guaranteed uptime due to the hourly billable nature of the legal workplace.

Because of the level of disclosure that clients must give to their own lawyers as part of most major litigations, clients are often forced to trust significant amounts of their own data to their lawyers. By extension, this means that continuity regulations around the viability and security of data, arguably transfers to the practice representing those organisations. A law company’s IT department should focus on the three core aspects of business continuity planning: High availability (protecting productivity), disaster recovery (protecting the practice), and better backups (protecting the data). In business continuity planning, one of the primary goals most often pursued is that of ensuring uninterrupted productivity and to minimise the cost of downtime.

Consider a small practice, a 25-person office (10 lawyers and 15 support personnel). If the production server goes down in the middle of the day, data loss for both the first part of the day and productivity loss for the entire day will be incurred. We can measure productivity loss as the entire amount of manpower, which either is incapacitated or will need to be reapplied while repeating a task. In this case, we have data loss, plus a productivity loss for the time it takes to replicate lost work, plus the hours where users cannot access their data and may be completely idle.

Using industry statistics, this 25-person office has a manpower cost of £1000 per hour (considering average salaries and benefits for partners, lawyers, paralegals and administrative staff positions). Assuming half a day of data loss and a full day of productivity loss, a single one-day outage will cost this small organisation £16,000 (exclusive of any lost revenue). If we include the average billing rate (assume 60 per cent of revenue generators’ hours are billable and multiply that by industry-average rates), the company will lose an additional £18,000 of revenue. While this small office may have considered itself ‘too small’ for business continuity planning, a single outage per year carries a not-so-small price tag of £34,000.

Downtime happens, inevitably. Business continuity planning is about reducing its costs. If £5,000 can be spent to mitigate a £34,000 loss and any future £34,000 losses for the entire time that the business continuity technology is in place, there is a huge return on investment even for the smallest company. While E-discovery technologies, document imaging and online research libraries improve productivity they make a practice even more dependent on its systems and cause an even higher loss of productivity during any kind of service disruption. Gartner suggests that SMEs have a 50 per cent chance of going out of business after a disaster if they cannot gain access to its data within the first 24 hours following the crisis.

Business continuity is a broad strategy around uptime, data protection and crisis resilience, of which ‘disaster recovery’ planning - to ‘get the data out of the building’ and then plan for how you will access and utilise it - is just one element. Many disaster recovery plans never get off the ground due to lack of executive backing, reflected in an annually deferred budget - it becomes ‘something we’ll try to do next year.’ Yet the chances are that the costs of unplanned downtime are not in the budget either! Disaster recovery planning costs ought to be viewed like any type of insurance, and companies should implement their plans now rather than wait for the completion of grandiose documentation.

In traditional data backup, one should be prepared for the fact that the organisation will experience at least half a day of data loss and one day of downtime in what is typically a ‘best-case scenario.’ If data is backed up nightly, data loss will be measured in ‘days.’ And if spare hardware resources aren’t readily available, most of the next business day following a crisis will be spent getting the parts to repair the downed server. While the above tape scenarios are applicable to all tape backup environments, the effects are more strongly felt in the legal community than in many other industries because of the legal community’s dependence on hourly productivity. Law companies and legal departments must protect their data more often than nightly. This takes us from a nightly tape process and into the realm of continuous data protection or real-time replication.

Using real-time data replication, as data is changed it is transmitted from the production server(s) to the redundant server(s) at the same or alternate sites. Instead of having tape-protected data from last night, replicated data on the target server is a virtual twin of that on the production server. From a budget perspective, no other data protection technology is as cost-efficient. Leveraging host-based replication, one need only put a simple software licence on each production server and then point it at an offsite location.

Replication will transparently, automatically and without routine manual intervention send the data to a remote site, which by definition is the beginning of disaster preparedness. Instead of each site handling its own tape backups (and changing tapes, cleaning cartridges, monitoring jobs, and so on), all of the data on the production servers have a consistent copy at the core data facility and the centralised IT team can perform centralised backups. Tape backups can be done during the day from the replicated copy of data. Backups of the remote offices can occur, even though the remote office production data is actually still in use on their real servers. This results in fewer backup jobs to manage and maintain regardless of the size of the environment(s).

A major difference in the business continuity needs of law companies from those other types of business is their notably higher dependence on hourly productivity and data protection. This is compounded by the regulatory requirements that many law practices must comply with as part of supporting their clients in various specific industries such as healthcare, financial and government. Even the smallest of practices have significant uptime requirements and data dependencies, and traditional methods of data protection simply do not fit the vast majority of law companies. Data replication technology may be the solution that addresses your company’s needs to protect its data, its productivity and therefore its practice.