? It's all about the bucks: Systems that provide data protection and recovery in an hour, day or week are less expensive than ones that deliver business-critical service, which should experience close to zero downtime. You and your business's key managers need to look at all of the business functions and processes that are dependent on IT. Then ask, "What is the financial impact on each of these services if IT goes down?"
? Always start with the application: A critical first step is determining which applications require 24x7 availability. To help with this task, SMBs can build a dependency tree for each application that should be available. Make a list of what makes the application work (such as switch, server, desktop).
? RPO, RTO: Determine your business's recovery point objective (RPO) and recovery time objective (RTO). The RPO, in effect, is the amount of data loss your business can sustain, while the RTO is the amount of time you can afford your systems to be down -- the maximum tolerable outage. If a disaster occurs, how much time can your business afford to lose? An hour? A day? A week? This depends on the nature of your particular business and your owners' or managers' appetite for business risk, so it's important that IT alone does not decide what the RPO and RTO are.
? Five nines: Most SMBs should strive to achieve five nines reliability, which means systems are available 99.999% of the time. Not all businesses need or can achieve five-nines reliability - perhaps four or three nine is adequate in some cases. The decimal point differences may seem like hair splitting, but they reflect significant duration or frequency of outages. Think about it this way -- a system that is 99.999% available to a business that operates only 40 hours per week (and most operate more hours than that) is not available for two minutes per year. One that is 99.99% available is not available for 20 minutes per year. One that is 99.9% available is not available for two hours per year -- and of course, management doesn't get to decide which two.
How much does two hours of down time matter to your business, especially if you can't pick and choose which two hours you lose? That question demonstrates the Russian Roulette of ignoring system availability in your business plan.