percentage of cost impact for DR plan costs

kmurphy used Ask the Experts™
I have been provided the cost impact analysis of our company receiving some disasterous event scenario. I am to compare this to the cost if instituting a DR plan, thus comparing the cost of being "out of business" to the cost of the plan with respect to how quickly we cna be back up and computing again. Of course, the cost goes up as the response time goes down. There are non-recurring costs entailed with establishing this, as well as recurring costs (i.e. co-location, connectivity, DR hardware maintenance, patching, monitoring, etc.).

I do IT for a CPA firm, and I am wondering if there are any guidelines for this industry (or maybe all industries) as to what percentage of the cost impact should be spent on DR.

I don't even know if there is such a thing.  In the end, I know it will be a case of  . . "To be back up within 48 hours will cost $x, up in 24 will cost $y, . . " and so on.  The company Share-Holders will then respond with what they're willing to spend (and thus tolerate in down time).

But, I am hoping to indicate to them some sort of guideline/standard of how much companies typically spend each year on DR as a percentage of the cost of being down.

Is there such a thing?
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
I don't think there is an industry standard for doing this. In fact, I think most small and medium size businesses spend the money on backup because they know it's important but don't really associate any ROI with doing so. Same with DR but even less are thinking about this.

With that said, I don't think that calculating an annual DR budget based on a percentage of the cost for being down is a common methodology. More often the budget is probably based on the rate of return or break even point for the investment that's made in preparation for a disaster calculated over a certain period of time.  

I think having some clear answers to this or some recommendations would be beneficial to many. I'm going to do some exploratory work and once complete potentially post it on our benefits site.
Top Expert 2007
I agree that there are probably no fixed numbers.

In general, you start planning your DR, come up with costs for doing each part, and convince the managers of the importance of each part and get a budget to start doing the important pieces first ( usually ).

Each company has a different view of this, and even a risk analysis audit done by two different firms, may give totally different numbers, so you do what you can .....

It is also an issue of perceived threats.

What's more important to protect against,

Hurricane, Terrorist, Internal employee who is out to destroy the system  etc.

I hope this helps !
Agreed. According to my own experience - backups, antivirus software, hot spare drives, online UPS'es, physical security etc. are predictable and budgetable. If you miss any of them, you'll pay for DR. Thus, all "savings" may be written into your budget as DR costs :)


No solution provided, but input was helpful

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial