Research

Publication Date: 6 October 2005

ID Number: G00131679

Advanced Planning Can Protect Your Records From

Disasters
Kenneth Chin, Toby Bell, Debra Logan

Take extra steps to back up and recover critical records in the event of a disaster. This
planning should occur as part of your records management process.

2005 Gartner, Inc. and/or its Affiliates. All Rights Reserved. Reproduction of this publication in any form without prior
written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable.
Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although Gartner's
research may discuss legal issues related to the information technology business, Gartner does not provide legal advice or
services and its research should not be construed or used as such. Gartner shall have no liability for errors, omissions or
inadequacies in the information contained herein or for interpretations thereof. The opinions expressed herein are subject to
change without notice.

WHAT YOU NEED TO KNOW

Some companies may neglect disaster planning for their important records because they believe
disasters like Katrina are rare and require a sizable investment to guard against. However, fire,
flood, theft and other dangers constantly threaten company records, especially paper records. To
protect against disasters, you only need to extend your records management program a little bit.
Identify which records are important and vulnerable and therefore need backing up. Good options
for backing up those records include the use of imaging technologies and outsourcing. After a
disaster, well-prepared recovery teams can quickly secure records to prevent theft and further
loss.

ANALYSIS
Hurricane Katrina and the flooding of New Orleans have damaged or destroyed untold numbers
of records. Virtually every type of business has suffered, from the smallest neighborhood shops to
large corporations, and the damage extends across numerous industries healthcare,
government, education, banking, retail and more. The lost records include deeds and wills,
patient records at hospitals and doctors' offices, signature cards for safety deposit boxes at
banks, birth certificates, transaction receipts, student files, law enforcement reports and insurance
paperwork. Managers overseeing records management and disaster planning want to know how
to recover paper-based and other records from a disaster of this sort and what they can
reasonably do to prepare their records for any type of disaster in the future.
Katrina and its aftermath revealed the enormous vulnerability of records not just the fragility of
paper documents, PC files and other formats, but the extent to which we rely on them. The loss of
records isn't merely a giant paperwork issue; it represents a tremendous amount of lost value and
extra costs for businesses and their customers. This vulnerability remains whether companies
operate in hurricane-prone areas or not. Accordingly, don't think about disaster planning as a task
separate from the general imperative to manage records properly. You need to take only a few
extra steps in your records management program to reduce the risks from disasters and to
recover records if disaster does strike.
Preparing Records for Disasters
Disasters on the scale of Katrina happen rarely, but your records still remain vulnerable to small
"disasters" that happen all too often: fires, floods, burst water pipes, theft, malicious destruction,
workplace accidents, employees misplacing files, losses during shipment, and PC crashes.
Prepare for all disasters within the normal framework of records management and mitigate these
smaller risks:

Inventory your records so that you know the volume and where they're located.

Evaluate their importance and create a retention schedule for each type of record.

Back up critical records and devise a recovery plan.

Elsewhere, we have described how to implement a records management program (see "Take
Seven Steps to Implement Enterprisewide Records Management"). Disaster planning occurs as
part of retention and backup operations. When determining the importance of records, factor
disaster scenarios into your evaluation. Key criteria to use include:

Obligation: A number of external factors may mandate that your enterprise safeguard
records. For example, certain regulations and laws require companies to produce

Publication Date: 6 October 2005/ID Number: G00131679

2005 Gartner, Inc. and/or its Affiliates. All Rights Reserved.

Page 2 of 5

records when asked, and a disaster may not represent an adequate excuse for losing a
record.

Value: Companies use many types of records to support operations, generate revenue
or find business opportunities (for example, by applying analytics to spot trends).

Risk: Rank records based on the harm that losing them would cause your company and
its customers. The theft of legal records about a sensitive legal case could damage a
client irreparably and the company's reputation with it.

Vulnerability: The physical situation of records may leave them vulnerable to loss.
Records stored at branch offices are generally more vulnerable than those stored at
company headquarters. Storage in a poorly secured warehouse or via an ill-conceived
process of transportation increases the chances of losing records.

Medium: Each storage method has its own strengths and weaknesses. Electronic
records are vulnerable to abuse by employees with system access, and electronic
media become obsolete quickly. Even records on a stable medium such as paper can
deteriorate if the paper stock is acidic. Water or fire can destroy paper records as well as
microfiche, a popular backup medium.

Backup: Records of which only one copy exists deserve your attention. Businesses still
rely on unique paper records to a surprising extent, from signature cards and cash
register receipts to legal and medical files. Some records exist only on someone's PC
and would disappear if the hard drive failed.

Preparing for Backup and Recovery

These criteria will enable you to decide how long you need to retain each type of record and what
you need to do to safeguard that record for its entire life cycle. In devising a backup and recovery
program, we recommend that you:

Assign people to verify the exact situation of important records. Don't rely on a general
statement of where the records are. For example, the vaults in which safety deposit
boxes are kept may be immune to fire, flood and theft; but these vaults often fill up, so
bank branches make room by moving records such as depositors' signature cards to a
room outside the vault, where they become vulnerable.

Make it a standard procedure to create electronic copies of key paper records. For large
offices, imaging technologies can handle thousands of pages a day at a reasonable
cost; small-scale versions will suit branch offices. Outsourcing imaging and backup
operations can also be an option for many companies (see "When and How to
Outsource Document Imaging"). You can choose from a variety of effective vendors,
many of which specialize in particular industries.

Store the imaged records and other backups off-site. The backup location should be far
enough away that it won't suffer if a major disaster strikes the city in which you have
your frontline offices, yet not so far away that you can't recall the records conveniently.
Most companies have their recovery sites less than 50 miles from their production sites,
and a disaster like Katrina can disable both sites. Companies that fit this description and
that are located in high-risk areas should keep a third copy of their most-critical unique
records at a site outside the region.

Devise secure procedures for recovering records from the backup locations and test
them periodically.

Publication Date: 6 October 2005/ID Number: G00131679

2005 Gartner, Inc. and/or its Affiliates. All Rights Reserved.

Page 3 of 5

Recovery: Good planning can help you secure and recover records after a fire, flood or other
disaster strikes. Appoint recovery teams for every location. Local managers and workers primarily
can man the team, but you may also need to contract with staffing firms in case you need extra
hands. Prepare charts or checklists for the recovery teams so that they know which records are
most important to secure, where they're likely to be found and what they look like. As part of your
disaster plan, prepare secure locations to receive records recovered from a damaged site. Plan to
keep the recovery teams in the field for several days if necessary. They may have to revisit a site
several times to complete their mission, particularly if damage was extensive.
Sending in the recovery teams quickly after a disaster could save your company bigger
headaches later on. The faster you act, the less vulnerable the records will be to theft or further
loss. Paper records soaked by water are much easier to save if treated before they dry, and
certain vendors specialize in this kind of work.

Key Facts

To outsource document imaging, prices range from $800 per month to $40,000 per
month, depending on the volume of documents.

For an application service provider or Web delivery, per-document prices range from $5
to more than $50, depending on the medium used and the speed of delivery.
Alternatively, a flat fee will buy a certain number of retrievals per month.

Key Issues
What are the best ways to upgrade records management system to the Sarbanes-Oxley Act?
This research is part of a set of related research pieces. See "Hurricane Katrina Highlights Need
for Disaster Preparedness" for an overview.

Publication Date: 6 October 2005/ID Number: G00131679

2005 Gartner, Inc. and/or its Affiliates. All Rights Reserved.

Page 4 of 5

REGIONAL HEADQUARTERS
Corporate Headquarters
56 Top Gallant Road
Stamford, CT 06902-7700
U.S.A.
+1 203 964 0096
European Headquarters
Tamesis
The Glanty
Egham
Surrey, TW20 9AW
UNITED KINGDOM
+44 1784 431611
Asia/Pacific Headquarters
Gartner Australasia Pty. Ltd.
Level 9, 141 Walker Street
North Sydney
New South Wales 2060
AUSTRALIA
+61 2 9459 4600
Japan Headquarters
Gartner Japan Ltd.
Aobadai Hills, 6F
7-7, Aobadai, 4-chome
Meguro-ku, Tokyo 153-0042
JAPAN
+81 3 3481 3670
Latin America Headquarters
Gartner do Brazil
Av. das Naes Unidas, 12551
9 andarWorld Trade Center
04578-903So Paulo SP
BRAZIL
+55 11 3443 1509

Publication Date: 6 October 2005/ID Number: G00131679

2005 Gartner, Inc. and/or its Affiliates. All Rights Reserved.

Page 5 of 5