The next step in developing the organization's information system recover plan is to take stock of existing hardware. As Cohen emphasizes, "If you have been hosting your company's Web site on an office computer, it is time to stop. For the cost of a cup of coffee per day, a Web-hosting center can fully protect your site off-site, where it will not tie up your company's bandwidth" (p. 3). This approach to maintaining important contacts with customers and an organization's intranet has several strengths over an organization's hosting the Web site in-house. For instance, Reagan (2006) notes that, "A hosted solution provides an organization with the flexibility of deploying an IP-enabled system without the maintenance costs involved in a self-maintained model. Network upgrades, enhancements and, most importantly, the scaling of bandwidth and phone lines are all handled by the provider" (p. 61). Here again, the primary strength involved in this step relates to the ability of an organization to continue operations in the event of the unexpected with a relatively modest cost being the corresponding weakness.

After the organization has identified its mission-critical important systems, the next step concerns determining how best to replace them in the event of loss. In this regard, Cohen (2004) emphasizes that, "If a critical system fails how long could you do without it before it would negatively affect your business? Think carefully, because the answers will have a major impact on how you will protect your systems and how much you will spend to gain that protection. If your business absolutely, positively, cannot afford to be off-line for more than a few hours, you might think about moving your systems to a hosted data center" (p. 4). Hosted data centers and so-called "third-party hot-sites" are becoming increasingly commonplace and the cost is low compared to the potential savings that can be realized in the event of a disaster. As Reagan (2006) points out, "The third-party hot-site is currently the most attractive option for many organizations that wish to implement a disaster recovery plan. These sites offer attractive pricing on the storage and real-time back-up of an organization's critical information systems, and typically offer cubicles or work stations on a per-seat basis" (p. 61).

While...

In this regard, Reagan advises, "During recent events, these third-party organizations performed well in protecting and providing access to their customers' critical information systems; however, problems did arise in supporting the enterprise telecommunications network" (p. 61). To overcome these constraints, Reagan recommends designing and deploying a voice-over Internet protocol (VOIP) plan in addition to third-party hot-sites. For example, Reagan points out that, "Organizations may want to consider a 'self-maintained' telecommunications recovery solution, which involves co-locating VOIP recovery equipment alongside data recovery equipment at a third-party service provider's site" (p. 61).
Conclusion

The research showed that organizations of all types and sizes should expect the unexpected when it comes to their mission-critical information systems. Manmade and natural disasters can disrupt a company's information system operations in major ways, and unless steps are taken in advance of such occurrences, the impact on the organization's bottom line could also be disastrous. Fortunately, there are some fairly straightforward steps that organizations can take today that can help them overcome the impact of such unexpected disruptions in their information systems, including inventorying their data files and hardware, maintaining additional backed-up copies off site and contracting with third-party providers for Web site hosting and "hot-site" access. In the final analysis, it is clear that the time to think about information system recovery plans is before a disaster strikes, rather than during or after its occurrence.