Table of contents. Providing continuity for your key business processes. A white paper on HP s Business Continuity and Availability Solutions

(1)

Providing continuity for your key business processes

A white paper on HP’s Business Continuity and Availability Solutions

Executive summary

To remain competitive and best address the needs of their customers, companies must maintain IT infrastructures and applications that enable the continuity and availability of their business processes. According to a survey by Gartner Dataquest, the top three business risks from downtime continue to be lost revenue, increased customer dissatisfaction, and decreased employee productivity.1

While most companies recognize availability as an issue and have taken various measures to improve it, many have still not implemented comprehensive business continuity plans. Furthermore, even when availability measures are in place for some components of their infrastructures, many organizations still do not feel secure about their current level of availability. According to a survey by Gartner Dataquest, companies with more than 2,500 employees experience approximately 135 minutes of downtime per month, while the acceptable amount of downtime for companies of this size is less than 5 minutes per month.2

Yet those companies that have made business continuity and availability a strategic imperative are finding immediate and sustainable results — reduced risks, improved profitability, and increased agility within their IT environments to support changes in business processes.

This white paper outlines four different business continuity and availability needs that many organizations face and how HP can work with companies to address these needs. The paper also provides examples of HP customers and outlines the benefits these companies have gained by deploying HP Business Continuity and Availability solutions.

1_{Gartner Dataquest, July 2003, North America Customers Reveal Preferred Services for Mission Critical Systems, Users Wants and Needs} 2_Ibid.

(3)

3

Reducing business risks

• Increased demands on IT departments to meet end-user service level agreements • Unexpected outages that adversely impact the business

• Changing business models that demand 24x7 availability • Stricter governmental rules and regulations

• Increased risk from terrorism, SARS, natural and other disasters

All of these factors are forcing companies to look closely at the stability and reliability of their IT environments. Companies must be able to react quickly to outside influences and must proactively analyze how best to use technology to increase business agility, improve customer interactions, and achieve a competitive advantage. By developing and implementing business continuity and availability strategies, companies can protect their most critical business processes from the negative effects of application failures, unexpected glitches, security breaches, vandalism, or full-scale disasters.

Business continuity and availability is not a one-size-fits-all proposition. Each enterprise — indeed each part of every enterprise — has its own unique business challenges, IT environments, and business processes. However, the goal of implementing a business continuity and availability solution remains the same — to establish a stable IT environment that helps a company’s critical business processes meet the needs of the business.

HP has seen four common needs that organizations typically express with respect to business continuity and availability. For each of these four needs, HP has put together integrated service and technology solutions to satisfy the need. At the same, our solutions provide flexibility so that we can deal with the variation that we find in each company’s unique environment.

(4)

Availability and continuity for new applications

Organizations that need to deploy new mission-critical applications or reengineer their current ones must ensure that appropriate levels of availability and continuity are designed in from the beginning. The need is fundamentally the same — although the scope differs — whether it is deploying a new ERP environment, rehosting an existing

application, or implementing IT consolidation for a full enterprise IT environment. This is an ideal time to take a holistic approach to dealing with the availability and continuity requirements of your application or environment.

Some of the availability concerns these companies are facing include:

• How long can the business tolerate this application or process being unavailable • How will the service level agreements for this application or process be met • How much data loss can be tolerated if there is an outage

• How can the organization deploy a business-critical application that is available when required — without incurring exorbitant costs

Companies that address business continuity and availability requirements up front and from an end-to-end or end-user view can:

• Reduce the risk of lost revenues, dissatisfied customers, or a drop in employee productivity • Save time and money by avoiding redesign and changes later

• Integrate new and revised business processes into a comprehensive and practical business continuity plan

HP helps companies look beyond the bounds of simply implementing an application or consolidating an environment. HP Services consultants can work closely with line of business teams and IT staff to plan, develop, and deploy end-to-end solutions to help meet availability, continuity, and performance requirements.

(5)

5 Providing real-time, round-the-clock information to clients

It is often said that information is the lifeblood of an organization. For a well-known information service company, that statement is a business reality. This internationally recognized electronic distributor of press releases knows that even minutes of downtime can be costly. So when the decision was made to replace its legacy systems to respond to business growth and to implement an Oracle ERP application, it decided it was time to address ongoing concerns regarding the stability and protection of its applications and data.

Top management knew that working in a 24x7 business environment meant that even planned downtime for system backups was unacceptable. In addition, because its main offices were located in San Francisco, natural disasters, such as earthquakes, were a very real possibility. So having a solution that could enable system failovers was a necessity. After listening to the needs of the company, HP recommended that the company roll out an integrated business continuity and availability solution in two phases. During the first phase, HP designed and implemented a solution for the company’s San Francisco office. Consultants assessed the business situation, created a high-level conceptual solution design and detailed infrastructure design, and then used those designs to configure the environment exactly to the company’s needs.

In the second phase, HP focused on the company’s secondary data center, which was located on the east coast of the U.S. This solution included software to perform geographically remote failover to protect against regional disasters and to enable fine-tuned transaction replication. With this solution, if data became corrupted in the San Francisco office, the company had one hour to prevent it from being duplicated in New York. However, if San Francisco became unavailable, the company would only lose one minute of data as it switched over to the backup data center. Critical to the solution was the inclusion of HP’s mission-critical support services, which enable the company to maintain high levels of availability at both sites, through proactive and reactive measures. At the same time, HP consultants helped the company’s IT staff develop the skills and expertise they would need to maintain a highly available environment.

HP was able to successfully complete the implementation in just four months, which surpassed the company’s original deadlines. According to company officials, the ability to work with a single vendor that could understand its availability concerns and deliver all the hardware, software, and services required to address those concerns was a huge benefit.

HP Solution

• Disaster Tolerant Design and Implementation Services • Mission Critical Support Services

• rp7400 HP-UX servers • Oracle Replication Server • OpenView Storage Data Protector • Serviceguard cluster technology • Continental Cluster software

(6)

Business continuity for the data center, work

area, and enterprise

Another typical organizational need deals with the continuity of business processes associated with a data center, a work area, or even a full enterprise. Even if a particular application or set of systems has strong, local high availability measures in place, what if the data center itself is inoperable or inaccessible due to a long-term power outage, public strike, or health hazard, such as SARS? Similarly, what if a call center or trading floor is damaged due to fire or flooding? Although these sorts of business interruptions do not occur frequently, they represent 90 percent of all outages over 12 hours!3

Moving beyond the individual site, new corporate governance regulations are requiring continuity measures at the level of the business unit, enterprise, and even the full cross-organizational supply chain. In many cases, the combination of new business risks and governmental imperatives is giving a new sense of urgency to business continuity measures.

Some of the concerns that companies with these needs must address include:

• How to mitigate loss of stockholder value, corporate reputation, revenue, and profits in the event of the unexpected • How to seek to protect critical IT and work area business functions in the face of unexpected external events • How to meet or improve recovery time objectives (i.e., the time between a disaster and the resumption of a

critical business process) and recovery point objectives (i.e., amount of data lost, if any, when the business process is resumed)

• How to design and implement a comprehensive business continuity and recovery plan or enhance what is already in place

• How to better and more cost effectively address continuity needs as business processes, personnel, and IT environments change

Companies with these needs want to be prepared to address full site outages and disasters. They desire cost-effective solutions that can accommodate their entire multivendor IT environments. By implementing a business continuity solution, these companies can:

• Reduce the risk to their business operations due to a wide range of natural and manmade disasters, such as long-term power outages, burst pipes, floods, epidemics, or terrorism

• Establish recovery plans that address the requirements of new regulations and laws mandating business continuity • Protect people-based business processes, such as call centers, trading floors, and data entry

• Address the need to protect a distributed, multivendor IT environment cost effectively

HP understands companies have a full range of business processes with differing levels of criticality. We also understand that organizations must deal with budget constraints. Accordingly, HP provides a comprehensive portfolio of technologies and services to meet a company’s full range of criticality requirements and budget constraints. In addition, HP offers a business impact analysis service that provides management and boards of directors with guidance regarding spending choices in protecting their fundamental business processes.

(7)

7 Implementing a business continuity plan

Recently, a large software development and distribution company based in the southeastern U.S. turned to HP for help in enhancing its existing business continuity capabilities and reducing its overall operational costs. The company had three major issues. First, the company wanted to increase continuity coverage for its key applications from 70 percent to 100 percent. This was key due to the exposure of its production data center to seasonal hurricanes. Second, storage demands were quickly outpacing the company’s storage capacity. And third, the company wanted to eliminate its backup data center, on the west coast of the U.S., in order to reduce costs.

Based upon the customer’s requirements, HP recommended a cost-effective solution featuring a managed disaster tolerant solution and relocation of the company’s backup data center functions to HP’s recovery center (sometimes known as a warm site or hot site). The solution was enabled through a full lifecycle of services, including a business impact analysis, data replication design, storage implementation, business continuity plan, and mission-critical support. In addition, the company utilized HP financing to fund the entire project.

To help meet its storage requirements, HP delivered a managed storage solution that increased the storage capacity from 16 TB to 25 TB in a customized storage area network (SAN). Based upon HP’s managed storage model, HP manages all the hardware, software, support, monitoring, network, and maintenance of the SAN. HP also continues to own all the assets and charges the company for usage on a per GB/per month basis.

HP addressed the company’s desire to eliminate its own data recovery center by relocating the center to HP’s Atlanta recovery center. This facility offers replication of all the company’s data and provision of backup servers, thereby facilitating the continuity of the company’s business-critical systems.

According to company officials, the reasons for choosing HP were quite clear. First, they believed that HP could offer the most comprehensive business recovery solution to meet their specific requirements. They were also impressed with HP’s prior experience and expertise, which they witnessed first hand during a tour of HP’s Atlanta facility. Moreover, they were pleased that HP offered an open environment that could support multivendor hardware and applications. Today, the HP solution is helping the company improve the overall effectiveness of its business continuity plan — and giving top management a sense of security that enables them to focus on their customers and not on whether their underlying infrastructure is operational.

HP Solution

• Business Continuity Consulting Services, including Business Impact Analysis, Risk Assessment, Business Continuity Plan Development, and overall implementation

• Managed Disaster Tolerant Solution based on XP Continuous Access data replication

• Managed Storage Solution with utility-based pricing (based on 16 TB growing up to 25 TB of StorageWorks XP storage)

• SAN/storage implementation, data replication design and implementation, and data migration • HP Mission Critical Support Services (providing proactive operational support for the SAN and servers) • Business Continuity Program Management (to handle regular disaster rehearsals and evolution of the

(8)

Availability for current applications

Due to increasing demands upon IT to enable business process change and improve service levels, companies frequently encounter a need to increase availability for existing applications. Changes in the business environment, modifications to service expectations, recent service outages, or unplanned downtime can drive the organization to address the availability need. Whatever the reason, many companies know they need to improve the availability of a current application or service, but require external assistance and resources to determine the best plan of attack. Some of the objectives companies with this need must address include:

• How to set up ongoing processes to proactively meet the availability objectives of the business (instead of reacting to outages)

• How to continually improve on the ability to meet service levels

• How to better manage costs — both in terms of asset utilization and staffing • How to develop world-class IT management practices

By focusing on availability improvements in the IT infrastructure, IT organizations can: • Better act as strategic partners to the business

• Continually improve service levels

• Reduce the business risk caused by downtime • Manage their IT operations more cost effectively • Improve staff productivity and asset utilization

• Improve customer satisfaction by making customer-facing applications available

HP has helped companies deploy solutions that reduce the effects of planned or unplanned downtime, improve the utilization of an infrastructure, and help companies meet service level commitments. Working closely with a company’s IT staff, HP high availability experts can uncover the problems that are causing availability issues. Since IT processes and people issues are responsible for approximately 70 percent of all downtime, we take a comprehensive view of the IT environment, and employ industry-recognized, ITIL-based IT Service Management practices to help our customers address these issues.

(9)

9 Improving availability for an international brokerage firm

The financial services industry is a highly competitive market that demands around-the-clock access to applications. So when a large international brokerage firm began encountering performance and stability problems, including two unexpected outages in its critical investment applications, management knew it had to address the problems head on. But the question remained; where to begin?

To help the company better understand the problems it faced and the possible solutions to resolve those issues, HP conducted an availability assessment to study the company’s current IT environment. Based on that assessment, HP consultants were able to uncover several critical risk areas and recommend steps the firm could take to reduce those risks.

HP recommended a solution that included new server, storage, and network equipment; enhanced system support; and the creation of a new computer room, with the old room turned into a disaster recovery center. The result of this work was a stable, secure, and highly available IT infrastructure that was better able to support the company’s constantly changing business requirements.

Based on this work, the company has asked HP to provide an availability assessment to two of its other sites located in Europe. Once completed, the three assessment studies will be consolidated into a single proposal that addresses availability from a global perspective. The final results are expected to be operational cost savings, increased service levels due to improvements in performance and availability, a cross-branch disaster recovery solution, and improved operational efficiencies across the three data centers based on best practices.

HP Solution

• Availability Assessment • ProLiant Servers • StorageWorks SANs

• Mission Critical Support Services • Project management services • Financial Services

(10)

Availability for a single IT element

Companies that have already invested in improving their IT operations frequently identify specific IT functions or components of their IT infrastructures that are causing availability issues and decide to work with their IT vendors to address these issues. For example, data protection issues, server outages, network design problems, or security vulnerabilities may hurt an IT organization’s ability to deliver to the availability and continuity levels required by the company. Holes in security may have resulted in denial-of-service problems impacting availability. Data may have been lost due to an inability to replicate that data on a consistent basis. Breakdowns in network infrastructures may have resulted in communications and connectivity problems for employees, partners, vendors, and customers. For example, some of the concerns these companies might address include:

• How to improve the reliability of the storage infrastructure and availability of data

• How to address capacity, performance, and/or configuration issues within the IT environment • How to mitigate security risks

• How to enhance the automation of IT operations

Companies experiencing these needs want to improve their current IT infrastructures and processes, while increasing system and application availability. HP helps companies reach these goals by addressing the root causes of these problems with technical consulting services and associated technologies that address key areas of the IT infrastructure and processes.

By implementing a business continuity and availability solution, these companies can better: • Meet service level agreements, providing nearly continuous access to data and applications • Provide security to enhance application availability

• Improve operational processes in an effort to proactively avoid downtime • Improve their ability to recover from significant service interruptions

By working with HP, companies can take advantage of the experience and expertise of HP’s consultants to quickly identify and solve the specific problem, thereby reducing the amount of time and money required to correct the problem.

(11)

11 Providing adaptive security for an international electronics company

Within the electronics industry, like many others, the security infrastructure needs to provide the appropriate access controls for company employees and appropriate people in subsidiaries and supply chain partners. A global electronics company, headquartered in Asia, faced challenges in providing such access controls. Although a current solution was in place, the company needed to eliminate single points of failure (SPOFs) that could impact service availability, eliminate security holes, reduce networking costs, and more easily and efficiently allow for network changes.

The company selected HP to provide a solution to the company’s security requirements based on HP’s collaborative style, our global capabilities, and our change-facilitating Adaptive Network Architecture (ANA).

HP’s ANA solution allows enterprise-wide security policies for each group of users and servers. This means that geographically distributed individuals can be assigned to a compartment with equal service availability regardless of their physical location. It also makes it simple and fast to add, as needed, additional systems to any given

compartment over time. Another benefit of ANA is that it eliminates SPOFs, reducing the availability impact when network troubles occur. Finally, ANA decreases the potential risk of individuals hopping from allowed servers to restricted ones.

Overall, the solution has provided not only better security, but also more cost-effective stability and improved business agility for the electronics company.

HP Solution

• IT Infrastructure Design and Implementation • Security Design and Implementation • Cisco Catalyst switches

• Network and Infrastructure Management (NIM) • Customer Support Services

(12)

For more information, visit www.hp.com/go/businesscontinuity

© 2004 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

5982-5421EN, 04/2004

Conclusion

Today’s competitive marketplace demands that enterprises maintain IT infrastructures that are stable, available, secure, and capable of adapting to change. To address these needs, HP’s Business Continuity and Availability Solutions help companies mitigate operational risks to their businesses, improve efficiencies in their operations, enhance their ability to meet service levels, and develop agile IT environments that can easily support changes in their business processes, IT infrastructures, and personnel.

HP’s Business Continuity and Availability Solutions address the unique requirements of each customer — whether it is a company working to deploy new business-critical applications, enhance its current business continuity and recovery solution, improve the level of current application availability, or address specific issues in its IT environment.

HP offers a tailored solution that brings stability and reliability to these companies’ IT environments. Just as important, HP’s full spectrum of integrated solutions enables companies to choose the level of solution they need today — knowing that they can expand their level of IT availability in the future.