Brad Wood, Senior Director of Enterprise Technology, Corrections Corporation of America

Assuring Availability

Rolling out proprietary disaster recovery solutions at off-the-shelf prices

For Brad Wood, building a proprietary recovery system isn't about recovery. "When I first took the job I said, 'We're not going to say recovery anymore,'" says the senior director of enterprise technology for Corrections Corporation of America (CCA) in Nashville, Tennessee. "If I have to recover, I've failed."

Failure isn't something you want when it comes to disaster recovery. That's why more organizations are turning basic disaster planning into proprietary disaster recovery solutions and business continuity plans.

The road to building a customized recovery solution should include at least four aspects: executive support, people, communications, and technology and testing.

Building a proprietary recovery solution is more than simply deploying backup and recovery software. "You need to focus on technology when creating a disaster recovery plan. But the people and the processes surrounding it are more important, because the technology simply automates what's already in place," says Gavin Dent, director of business development for CCS Group Limited, an IT consulting company in Bermuda that helps clients such as Bacardi Limited deploy, manage, and maintain networks in Bermuda that can withstand business continuity challenges due to the severe weather the island receives. "Too many companies leap into a technology solution before they truly understand the expectations of the business."

Executive vision and understanding

As the largest provider of private prison services in the United States, CCA owns and operates prisons in more than 20 states for federal, state, and local governments. The company has two data centers serving 8,000 users that provide authorized users access to prison management systems, electronic health records, and other key management functionality. CCA's goal is to be as paperless as possible, so having a highly resilient infrastructure supporting its data centers and online applications is critical. "By centralizing and automating our business processes, we've achieved significant savings," Wood says. "We've cut our inmate booking times in half."

With the company's complete prison management system-including booking, commissary, back office financial management, and electronic health records-automated and hosted at a centralized site, CCA has dramatically increased the importance of having a strategic recovery plan.

Wood recommends that the work of building a proprietary recovery solution start at the top. "First, the CIO needs to talk with the CEO and determine from a business perspective what's acceptable," says Wood. "For example, recovery for my business is not acceptable because of our business needs. Recovery for someone else's business-say 24, 36, or 48 hours-may be well within tolerance."

An important step that Wood took in designing his strategies was asking business managers to define acceptable recovery times for specific applications and systems. Every businessperson will say that he or she wants systems available all the time, even in the event of an emergency. For most organizations, however, this option is too expensive and usually not necessary. Wood asked CCA's business leaders to define the absolute time lag they could live with in terms of recovery; then he engineered the solution to that timeframe.

"Anything more than that-like absolute availability-is unrealistic," Wood says. "We used all the VERITAS high-availability products and have real-time replication of all applications above the back-end infrastructure. We're putting in additional products that allow more transparency in the applications. This way, if an application or database layer dies, we're able do some scripting and automatically move everything around so that we'll have a true business-resilient infrastructure that can transition in a five-minute range. Being able to recover multi-terabytes of data in five minutes is fairly substantial."