Let's face it: The 21st century has gotten off to a bad start. We've had threats of pandemics (avian flu and severe acute respiratory syndrome); major natural disasters (hurricanes, earthquakes and tsunamis); and large-scale, man-made crises (terrorist attacks and power grid blackouts). The list is long for a century that's less than a decade old.

Disaster recovery, also known as business continuity, also known as continuous data protection, has been a common practice for as long as businesses have kept records. But its real meaning didn't become clear for many until Hurricane Katrina hit New Orleans in August 2005. Hundreds of businesses in Louisiana and southern Mississippi were forced to invoke plans that hadn't been used before, but had to work perfectly at the time.

There are many aspects to disaster recovery that warrant exploration. What kind of event constitutes a disaster? For many, it would not take an event the size of Katrina to put a business out of commission. In fact, small businesses may have a more pressing need to establish a sound disaster recovery plan than the largest corporations, which may be able to absorb blows on a local level. IT managers need to ask themselves if their current disaster recovery plan is sufficient, and what if any new technologies should be deployed to make a plan more reliable and more flexible depending on the crisis.

Leaders in emergency management, information technology, archives and records management have strong opinions on how essential business data and paper records can be protected during times of disaster.

When disasters strike, emergency responders need records to locate utilities and establish chain of command. State and local governments need records to continue operations, and individuals need records to prove their identity and re-establish their lives.

When Katrina and Rita struck, the hurricanes were a wakeup call. Emergency responders and governments had simply taken records for granted, and some of those proved to be essential to the response and recovery. Responders, for instance, needed maps and building plans and delegations of authority in order to respond appropriately to the disaster. More poignant were the losses suffered by ordinary people. People along the Gulf Coast assumed that their deeds were safe because the courthouse had a copy, and they had a copy at home. But then courthouses and homes were completely wiped out and people were left scrambling for proof of property ownership. The records became very important at that point.

Iowa has just recently experienced record breaking flooding and the resulting damage was extensive to both personal and public property. It will take years to rebuild and the floods have tragically impacted thousands of people. Access to records was critical during the response efforts and will be invaluable during the recovery.

Some Statistics:

• 28% of IT managers at SMBs view upgrading disaster recovery capabilities as a "high priority."

• 20% say it's a "critical priority."

• More than 90% of companies that experience one week of data center downtime go out of business within 12 months. - National Archives and Records Administration

• 89% of IT managers test their disaster recovery/fail-over systems only once a year or not at all.

• 70% of respondents said it would take at least four hours for their servers to recover completely from failure, including restored software, configuration and network and storage connectivity.

• More than 50% of those polled estimated it would take several days to bring their systems back up to full capacity.

In today's world, it is not a question of if your IT systems will be struck by some form of disruption, but when. Whether this is a full blown site disaster or a limited window outage of key systems, the results are the same. If IT stops, business stops. Since data is one of irreplaceable assets of any business, it makes sense to ensure the storage strategy you deploy provides for, not just the best business value, but the best business protection.

Disasters happen to businesses of all sizes and can take a variety of forms-ranging from fire and flood to janitorial accidents. Yet, many companies do not have a continuous data protection plan in place. What are the best steps to take regardless of the size of your company or the disaster?

Smaller companies might not have sufficient data backup in place, but outsourcing, cloud computing and virtualization are some technology options that can help skirt data disaster, and not break the budget in the process.

Here are four recommendations:

    1.    Know what's critical. Start by identifying your critical systems and sensitive data. Assemble business and technology experts who can answer simple questions, such as: What can't we live without? If certain databases were lost, what would we do?  While many organizations have a hard time ranking their priorities, most can group systems into critical categories. Create an ongoing process to update this list every year.

    2.    Determine current capabilities. This "as is" analysis is harder than it sounds, and you need to know what your capabilities are before you can truly build your case for more redundancy, much less fix anything. Pick the top three or four most likely disaster scenarios and figure out their potential impact to critical systems. Don't assume data is backed up just because your tapes or other media go offsite. Have you ever tried before to restore those tapes? What if the hardware is destroyed? Could you read the media with other hardware? Don't forget to examine all critical system components such as alternate power sources and networks (including the resiliency of items such as DNS and DHCP).

    3.    Get information to key decision-makers. Once you have the data from the first two steps, provide options to key business leaders who own those functions. They may be shocked by your list.  Start the dialog and agree on whatever the plan is. The bottom line is business units must be aware and willing to accept the risk for any missing pieces. On the other hand, IT must ensure expectations are met or exceeded in providing the DR services the business is paying for and counting on.

    4.    Test your plan and measure effectiveness. Testing is important, and not only for well funded projects that have great DR plans. You need to test your plans at least once a year. Some organizations will neglect to test their backup tapes - and they're surprised later when recovery efforts fail.