Toolbox

How to Evaluate BC/DR Consultants

Five questions to help weed out the posers from the real deal. Plus: a checklist of topics a BC/DR consultant should know.

By Stacy Collett

July 11, 2008 — Siemens IT Solutions and Services always had a solid business continuity and disaster recovery (BC/DR) plan in place. But it wasn't until 9/11 that BC/DR planners truly understood what was lacking.

"We probably had the larger things covered, but on a moment's notice we were not as well put together as we could have been," says Debbie Hoppenjans, manager of business continuity planning. "It made us, as a company, really take a step back and look at what we would do."

So the company began its search for business continuity consulting services. But it wasn't exactly thrilled with most of its prospects.

"There seem to be a lot of them out there, and from our experience a lot of them are not very good," says CISO Dave Bixler.

Overall, complaints range from a lack of knowledge about the business and miscommunication, to not understanding the scope of the challenge.

"A lot of times the [consulting firms] are so dead-set on upselling," Hoppenjans says. "Any BCP 101 person will tell you that we have to document our plans up to today. So many times you find companies trying to help you plan for years to come." If they don't know your business and what you're going through, "how do you know this is where we need to go?" she adds.

The problem can be traced to the days following 9/11, says Russell Wooldridge, marketing manager at the Disaster Recovery Institute International in Washington, D.C. Many security firms simply added business continuity to their list of services to meet companies' demands, but offered little training and experience to back up their claims, he says.

Business continuity services represent a $3 billion to $4 billion business, according to Gartner. Some 28 percent of companies manage their business continuity plan with the assistance of an external provider, according to a survey of 254 senior executives by consulting firm KPMG. There is a higher reliance on external support—38 percent—in midsize enterprises, and the financial services sector showed the highest preference for external service providers at 41 percent.

Companies have taken giant steps in business continuity preparations, says Ben Thornton of Corus, a disaster recovery and business continuity consulting firm. Larger companies are forming their own DR and BC staff and certifying their skills through disaster recovery groups like The Business Continuity Institute, DRII and the Business Resilience Certification Consortium, to name a few.

• Email
• Print
• Comments
• Digg This
• SlashDot

• Business Continuity and Disaster Recovery Planning: The Basics
• Five Steps to Evaluating Business Continuity Services
• 5 Ways to Build a Business Case for Business Continuity
• Iowa's Floods: Tragic Lesson in Business Continuity
• Disaster Recovery: Write People into the Plot
• Tabletop Exercises: Three Sample Scenarios