• News
• Pressroom
• Pressreleases S&T Group

Three quarters of local companies do not know

Many Czech companies have no crisis scenario for their operations in case of an unpredictable emergency event. “At least 75% companies have no emergency plan that could support their operations in case of emergency,” says Martin Rus, an S&T expert for business continuity. S&T analysis even shows that less than 5% companies have a functional, i.e. documented and by testing verified crisis scenario. Similar conclusions arise from a survey done by Ernst&Young, National Security Office and DSM magazine (Data Security Management), see the infobox.

“Mostly just organisations whom even a little breakdown can bring enormous financial loss or health hazard are well prepared. For example energy suppliers, hospitals, air traffic centres, banks or big Internet shops,” explains Martin Rus. Life saving is always the first but the most important IT systems functionality follows it tightly in all scenarios.

Even when IT systems do not represent the most valuable company asset, their breakdown can cost company dear. “IT systems directly support company business and mostly include information of critical value,” says Rus.

Costs paid for a damaged cable can reach millions: “Floods in 2002 devastated IT centre in a Prague firm. Loss in manufacturing due to breakdown of an vital application was 35 million crowns. Similarly, a broken power cable paralysed an information system in a company that had to give up a 38 millions tender” Martin Rus, security expert in S&T CZ.

TABLE: the most endangered sectors, source S&T CZ (Percentage reflects risk measure in case of a disaster event)

Health service Finance On-line bisiness Manufacturing Government Services 100% 90% 70% 50% 50% 40%

Warning because of non-existent emergency scenario comes also from David Kesl, senior manager in Ernst&Young: „Most of Czech companies live in illusion that to be save against unpredictable events jeopardizing their business, suitable insurance with
a satisfactorily high backing is sufficient. They do not realize that even a few days interruption of their operations may cause them high irreversible damages. These are not only financial ones, often a loss of customers and good reputation is much worse.”

Local companies often wait until a disaster comes

Companies with high level of automation or dependence on IT are threatened at most. Besides banks and health services, especially manufacturing companies undergo the highest risk, as well as all companies that cannot excuse any delay in their products or services delivery. “Not only big firms like banks are in danger but in common each company depending highly on its information systems,” adds Rus.

Annually repeated IT security survey shows that only half of investigated companies have prepared business continuity plans or emergency scenarios. “During the last two years 31% companies experienced a situation when they had to use their business continuity plan. At the same time only 22% companies assess their business continuity plan as very efficient. This is really alarming,” David Kesl, Ernst&Young. Source: IT Security Survey done by Ernst&Young, National Security Office and DSM magazine (Data Security Management).

Most of businesses are able to work without information technology for a very limited period only. “Then such companies start to collapse. This can lead to the loss of their good reputation, operating losses, and optionally to their bankruptcy. For example an Internet company becomes untrustworthy already after several hours of breakdown. Its competitors are ready to offer similar services only a few clicks apart,” warns Marin Rus.

Emergency scenario may be started even by a very banal event. It is not always because of a nature disaster or a thievery. “A company might be paralysed by a damaged cable or broken water pipeline, that deluge the room with company servers,” says Martin Rus (see the infobox).

Demand for solution of emergency scenarios is doubled each year

In spite of depressing situation in area of risk assessment, an interest in business continuity systems and emergency manuals increases. “During last five years the number of orders doubles every year, “ comments Martin Rus. S&T records the biggest demand for business continuity systems during global natural disasters, for example after floods.

Companies usually implement a solution only after they experienced some critical event. “Up to this time, managers resist and do not calculate costs that an operation breakdown could bring. They are often shocked by the fact that a one-day breakdown could cost them one million crowns and after three days they would reach the boundary of bankruptcy,” says Martin Rus. At the same time, costs necessary for a proper business continuity solution represent only a small fraction of money needed to solve all problems emerging after a real emergency event occurs.

Remarkable growth of demand for business continuity plans after each bigger natural disaster is confirmed also by Ernst&Young company: “Usually only in such situation come people in company management to know that cash obtained from the insured benefit itself cannot ensure recovery of their operations, to say nothing of the lost customer credit. Furthermore, the insured benefit comes only long time after the end of critical situation.” According to Ernst&Young knowledge, only hard experience with impacts of interrupted company operations forces management to a real implementation of functional business continuity plans.

Almost half of companies never update and test their emergency plan

Business continuity plan is a prepared scenario describing what to do in case of emergency and enables an efficient defence against possible risks. This plan says in detail what to do e.g. in case of power failure or other crisis event. “It is necessary to distinguish between the risk probability and impact. When the detailed analysis discovers that some less probable risk is absolutely unacceptable, an alternate option must be prepared,” explains Martin Rus. For example, it is possible to double the information systems. Then in case of a breakdown the backup system, sitting in a different place, immediately takes the control over.

Of course, even an existent emergency plan gives no guarantee that the company will survive any crisis without troubles. According to an S&T’s survey, the prepared solution is never tested or not regularly updated by approximately three quarters of companies. (Ernst&Young came to similar results, see the infobox.) Any plan can be disrupted after short time already. “Somebody can replace the door lock in the room with backup generators and the thoroughly prepared plan fails. Only regular checks can discover all its weak points,” says Martin Rus. “Quality functional plans are certainly the basis but a sound training for people is equally important. Even stressed by critical situation, people must exactly know what to do,” adds David Kesl.

Emergency scenarios sometimes end in manager drawers also from more prosaic reasons: they are being prepared rather formally, just because of auditor requirements. Without an emergency plan would no company pass through any security audit. “Such plan has no sense when the company never checks it. It is almost the same as if nothing were prepared,” says Martin Rus, security expert in S&T CZ.

Preparation of good business continuity plans is a difficult job requiring a substantial support of company management, as results from Ernst&Young consultant experience. “Anyway, a saying ‘heavily on the training field, easy on the battlefield’ proves to be true. To get perfect and error free emergency plans on the first attempt is very difficult. The plans can be verified and finally tuned only by detailed and regular testing, “ confirms David Kesl.

More than two thirds of companies test and update their plans at least once a year. At the same time 15% of companies never test their plans 16% of companies update their plans less frequently than once every two years Source: IT Security Survey done by Ernst&Young, National Security Office and DSM magazine (Data Security Management).