|
Although almost all UK companies back up their critical IT systems and data, more than a quarter of them still do not have a disaster recovery plan in place. Half of those that do have plans fail to test them.
These are among the early findings of the 2008 Information Security Breaches Survey (ISBS) carried out by a consortium, led by PricewaterhouseCoopers LLP, on behalf of the Department for Business, Enterprise & Regulatory Reform (BERR)
The survey shows that 58% of UK businesses would suffer significant business disruption if their IT systems were not available for a day – the highest figure recorded since the surveys began. This rises to 70% of large companies.
Some 68% of companies polled believe that business continuity in a disaster situation is a very important driver of their information security expenditure, and a further 24% say it is important. Only 2% say it is not very important.
As a result, UK businesses appear better protected than ever:
• 99% of UK companies back up their critical systems and data. 86% do this at least on a daily basis.
• 85% of all UK companies take their backups off-site (up from 76% two years ago);91% of large businesses take their backups off-site.
• 72% of all UK businesses have a disaster recovery plan in place, up from 58% two years ago. 91% of large companies have a disaster recovery plan.
However, there are concerns about the effectiveness of these controls. The survey found that 28% of companies do not have a disaster recovery plan in place. Of those firms with disaster recovery plans, almost have not been tested in the last year.
When companies suffered a systems failure or data corruption incident, 31% had no contingency plan in place and a further 10% found their contingency plan to be ineffective.
The south-west has now overtaken London as the region with the most disaster recovery plans in place (possibly as a result of last year’s floods), but fewer of these plans are tested than in other regions.
Chris Potter, partner, PricewaterhouseCoopers LLP, who led the survey commented: ”It is encouraging to see that almost every UK business makes backups and the vast majority now take these backups off-site. The risks are well understood; it does not take an incident to raise awareness.
“The number of companies with a disaster recovery plan has gone up. However, experience shows that plans are only effective if regularly tested. It is a concern that only half of plans have been tested in the last year.”
|
