New survey raises serious concerns about the effectiveness of disaster recovery plans
14th April 2008 Although almost all UK companies back up their critical IT systems and data, more than a quarter of them still do not have a disaster recovery plan in place. Half of those that do have plans, fail to test them. Also, 15% of companies do not take their backups off-site. This is despite the fact that 92% of businesses now consider disaster recovery planning an important driver of their IT expenditure.
These are among the early findings of the 2008 Information Security Breaches Survey (ISBS) carried out by a consortium, led by PricewaterhouseCoopers LLP, on behalf of the Department for Business, Enterprise & Regulatory Reform (BERR).
The survey shows that 58% of UK businesses would suffer significant business disruption if their IT systems were not available for a day the highest figure recorded since the surveys began. This rises to 70% of large companies.
The south-west has now overtaken London as the region with the most disaster recovery plans in place (possibly as a result of last year's floods), but fewer of these plans are tested than in other regions.
Chris Potter, partner, PricewaterhouseCoopers LLP, who led the survey commented:
It is encouraging to see that almost every UK business makes backups and the vast majority now take these backups off-site. The risks are well understood; it does not take an incident to raise awareness.
The number of companies with a disaster recovery plan has gone up. However, experience shows that plans are only effective if regularly tested. It is a concern that only half of plans have been tested in the last year.