Malaysia SMEs lack BC and DR plans

KUALA LUMPUR--Many small- and medium-sized enterprises (SMEs) in Malaysia still do not see the need for business continuity (BC) and disaster recovery (DR) planning, industry players say.

According to hosting service provider Emerge Systems, the majority of its 25,000 corporate customers, mainly SMEs, do not have a BC plan. Since 1999, Emerge has been offering off-site DR services at its Internet Data Center located in Technology Park Malaysia.

Raymond Chee, managing director of Emerge Systems, said: "The percentage of our clients that have BC and DR programs is extremely low.

"Most of these enterprises overlook the importance of BCP (business continuity planning), just like many still overlook the importance of insurance. There's a lot of convincing and education required to highlight the importance of being able to conduct their business continuously and that disasters can strike anytime, anywhere, without warning," he added.

Chee said it is a fallacy to assume that only big organizations need BCP. "A general rule of thumb for implementing such programs is they must be able to continue running their business and service their customers, even if they wake up the next morning knowing all their data and vital information are gone.

"If they can't run their business and office operations, and their databases are wiped out, then it's time to consider DR," he added.

However, SMEs are not the only organizations which have neglected to protect their vital business information.

The IT director at a foreign-owned financial institution claimed there are still large companies in Malaysia that have not thought of disaster recovery planning (DRP). Without a DR program, "they are actually digging their own graves", he noted. These large organizations risk damaging their corporate reputations if it was known they lacked a DR plan, or if their operations were crippled by a disaster, he added.

But there is hope, yet. More businesses realize the importance of DR systems, especially after the September 11 terrorist attacks in the United States. "Companies are now realizing that their business operations can be devastated by disasters or terrorist attacks anytime," he added.

Being a financial institution and part of a multinational group, his company has had a BC and DR program in place from day one, he said. "It's a standard requirement from our regional office. We even have a BCP director," he said. The effectiveness of its DR system, situated both on-site at its Kuala Lumpur headquarters and off-site in Cyberjaya, is tested annually through both simulated and live testing.

According to an IDC Malaysia survey of 53 IT and business decision makers, awareness for BCP and DRP among the medium-sized and large enterprises is high. BCP and DRP spending will also continue to be driven by these larger companies, rather than smaller businesses.

The survey results, which were released in May, identified several key drivers which include security concerns, financial pressure, business resiliency, corporate reputation, and productivity improvement.

Katherine Chan, research manager, services research, IDC Malaysia, said in the report: "It is interesting to note that medium-sized to large companies in Malaysia are treating loss of backup data, virus attacks, and corruption of replication data as the top three threats to the enterprises.

"The current maturity levels of the industries has created prime opportunity for IT service providers (ITSPs) to implement new BC/DR sites, upgrade existing BC/DR sites, and also consolidate data centers, especially with the active mergers and acquisitions (M&A) exercises going on locally," Chan added.

IDC's survey revealed that most respondents prefer to have both on-site primary and secondary DR environments. Almost 70 percent of the respondents had undertaken a business impact analysis (BIA) before embarking on any BC and DR infrastructure. The majority of the respondents had their business continuity plans tested less than a year ago.

On the average, 92 percent of the respondents have a recovery time objective (RTO) and recovery point objective (RPO) of 0 to 24 hours. Large multinational companies tend to have more stringent service levels of less than three hours of RTO and RPO, the report said.

The Sunway Group, whose businesses are in construction, property development, investment, manufacturing, leisure and entertainment, is another large Malaysian conglomerate with a DR plan in place.

Cheah Kok Hoong, general manager of Sunway's IT shared services center, said: "We are in the midst of preparing a DR plan and system, and we hope to roll it out in the coming months."

The group currently has "proper backup systems in place" for both its on- and off-site storage, he said. Hardware or software failure, "acts of god", compliance requirements, and the importance of business resiliency are reasons for the DR plan.

So far, the group has not encountered a loss of business information stemming from virus attacks, hackings, or hardware failures, he added.

Lee Min Keong is a freelance IT journalist based in Malaysia.