June 17, 2009, 5:35 PM — Okay, all you Yankees, I'm going to talk again about the British Standard 25999, or British Standard for Business Continuity again. But before you click somewhere else, let me remind you that even if it doesn't apply directly to you, it still has some very useful information that pertains to everybody on both sides of the pond.
BS 25999 introduced the term "Maximum Tolerable Period of Disruption" (MTPOD). It's a new acronym, and it's pretty cool, because it sounds like "Empty Pod," which seems somehow strangely ominous. But although it gives us a new set of capital letters to bandy about, the concept itself isn't new. MTPOD is just a useful metric that determines how much unavailability you can stand before everything crashes and burns and can't be put back together again. the standard says it in formal language, as the "duration after which an organization's viability will be irrevocably threatened if product and service delivery cannot be resumed."
An MTPOD needs to be determined in the strategizing stage of disaster recovery, and this information will help determine some of the technology and protections that you put in place. For the most part, the metric is subjective. It has less to do with hard numbers, and more to do with an estimate of what the consequences would be of a long-term outage. What for example, are your customer expectations? Consequences of an outage can be disastrous in more ways than one--your customers may decide, after a point, to quit waiting for you and go elsewhere. Just how long a period is that? Your key stakeholders, including those who have a greater customer-facing role such as sales and PR, can have some valuable input here. Yes, IT guys and PR in the same room and working towards a common goal--it does happen. Not often, but it happens. What it comes down to is everyone getting into agreement on a timeframe for recovery. The IT department may issue a proclamation saying that assuming everything is lost, they can be up and running again in two weeks--but will that be quick enough to avoid business being lost forever? It may not be easy, but it's valid for non-IT, customer-facing areas of the business to say, "that's not good enough"--and then IT needs to respond with a new plan.
