Choosing a Hot Site Vendor

85-01-60.2

DATA SECURITY MANAGEMENT CHOOSING A HOT SITE VENDOR

Philip Jan Rothstein

INSIDE: Types of Vendors, Factors in Vendor Selection, Examples of Vendor Offerings, Survey of Alternative Sites

PROBLEMS ADDRESSED Any organization that has decided to back up critical data processing operations must decide how it will do so. Two common methods of operations backup are hot sites and cold sites. Hot sites are fully equipped, ready-to-run computer centers designed to be activated when a subscriber declares that a disaster has occurred. Cold sites are ready-to-use facilities without computers or communications equipment in place. Other options include using company-owned facilities. Although using a hot site can be an expensive option, an organization whose survival depends on its computer processing capability may ﬁnd that it is ultimately the most cost-effective choice. This article provides some guidelines on choosing a hot site vendor.

TYPES OF VENDORS There are basically four categories of hot site vendors. The ﬁrst consists of organizations that are dedicated to disaster recovery. This includes the three companies that constitute the majority of the hot site market, Com- disco Disaster Recovery Services, Inc., Sungard Recovery Services Inc., and IBM Business Recovery Services. Each of these companies offers mul- PAYOFF IDEA tiple locations and classes of service. Many businesses, depending increasingly on The second category of hot site their data center, are realizing that no matter how offerings comprises hardware ven- well the data center is protected, the possibility dors (other than IBM), including Dig- exists that it may be unusable for an extended period of time. Subscribing to a commercial hot site ital Equipment Corp., and Hewlett- vendor is one option to ensure that computer pro- Packard, which provide recovery cessing can continue. This article addresses the services primarily for their custom- process and concerns of establishing a relation- ers. Both Hewlett-Packard and Digi- ship with a hot site vendor. A comprehensive survey of alternative site providers is also included.

tal Equipment Corporation have alliances with other organizations to support multiplatform recovery capabilities. The third category consists of regional, local, or specialty hot site vendors. Companies that depend on multivendor computing environments or complex communications networks may ﬁnd the hot site services of many of these vendors to be too limited. The fourth category is composed of mobile recovery sites. Mobile recovery sites provide the convenience of having a self-contained backup computer facility trucked or airlifted to or near the subscriber’s premises. The time delay for transportation may or may not be acceptable. CSC Provident Mobile Recovery Systems, Sungard Recovery Services, XL/Datacomp, Inc., Digital Equipment Corp., and Comdisco Disaster Re- covery Services are among the ﬁrms that offer relocatable recovery sites. Some of the minicomputer equipment vendors also have truck- or van- mounted emergency systems.

INDUSTRY OVERVIEW Since this article was last updated, the disaster recovery hot site industry has continued an accelerating trend toward consolidation. Three major vendors constitute the vast majority of the industry segment: Comdisco Disaster Recovery Services, IBM Business Recovery Services, and Sun- gard Recovery Services. The remaining independent hot site vendors consist of either computer hardware vendor captives (e.g., Hewlett-Pack- ard, Digital Equipment Corporation) or “boutique” vendors focusing on either specific niches (trading floor recovery, mailing recovery, specialized computer environments) or specific geographic regions. Many of these captives or boutiques have formed alliances with one or more of the three major providers. The second, accelerating trend since this article was last updated is the broadening of hot site services to increasingly address mid-frame, client/server and distributed computing environments, complex networks, and work-area recovery. As a result, the ability to handle complex, tech- nologically sophisticated hot site recovery capabilities at all may con- strain vendor choices.

FACTORS FOR CHOOSING A HOT SITE VENDOR Before beginning the hot site vendor selection process, the disaster recovery planner should ensure that all hot site vendors to be evaluated provide equipment that is compatible with that of the organization. This will eliminate the time-wasting process of reviewing inappropriate candi- dates.

Capacity and Growth Once the list of compatible vendors has been compiled, the ability of the hot site vendor to handle the projected processing work load, data storage, and data communications volumes as well as physical space requirements should be considered. The disaster recovery planner not only should consider the organization’s current needs but should project those needs at least through the duration of the proposed hot site contract. Flexibility on the part of the hot site vendor in meeting a certain de- gree of unanticipated capacity requirements or in adapting to functional changes over time is essential. Ideally, the hot site vendor should guarantee the available capacity and space through the duration of the contract and provide reasonable assurance (preferably in the written contract) of future capacity that would support contract renewal. In addition to computer space and processor storage capacity, non- computer space needs should also be evaluated. Sufficient space should be available for storing magnetic tapes and other media, printer paper, and custom forms and operational documentation. Consideration should be given to work areas for the staff who will be operating the computer system and to office space for support staff who will work in proximity to the computer area. In the event of a lengthy stay at the hot site, additional office, storage, or other space may be needed.

Recovery Experience The key test for any hot site vendor is its performance during an actual disaster. The ratio of actual disaster recoveries to the total client base may be low — or even zero. Given that actual recoveries are relatively rare, it should be reasonable to expect that a hot site vendor has never mishan- dled an actual recovery. The odds are that any vendor who fails in a client recovery would quickly be out of business. Therefore, contrary to expectations that emphasize vendor experience in recovering clients during disasters, vendor stability, technology and other factors tend to be weighted more signiﬁcantly. The extent of vendor participation in the development of the disaster recovery plan for clients who have successfully recovered can indicate the hot site vendor’s commitment to its clients. Interviewing clients who have experienced disasters can help uncover weaknesses. Comdisco Disaster Recovery Services, IBM Business Recovery Servic- es, and Sungard Recovery Services each have substantial experience supporting client recoveries.

Testing Capabilities Without regular testing of the disaster recovery plan, the ability to recover at a hot site is shaky at best. Most hot site vendors provide a testing

allowance; some even insist contractually on a minimum level of subscriber testing. Most also participate proactively in client testing. The availability and convenience of testing and vendor support of the testing process can significantly affect the cost as well as effectiveness of disaster recovery; if it is inconvenient or costly to test, testing may not be per- formed adequately; as a result, in an actual disaster the recovery effort could be useless. The frequency and duration of testing varies from vendor to vendor. Twenty-four to 72 hours of test time annually is typical. Additional test time can usually be arranged at extra cost. Any additional testing needs should be specified in the initial contract. The time to negotiate testing allowances is before signing a contract. Once an agreement is executed, additional test time may only be available at extra cost. Availability of the hot site for testing should also be evaluated. De- pending on the number of hot site clients and their testing needs, the lead time to schedule a test could be significant. Some hot site testing schedules are busiest on weekends, others on weekdays. It is a good idea to check into test schedules as early as possible. Of course, a declared disaster preempts any testing at a hot site. Even test time scheduled well in advance may be unexpectedly cancelled or interrupted; provision for such an event may be appropriate in the vendor agreement as well as in test plans. The hot site vendor should be included in the process of initiating and orchestrating a test. On completion of the test, the vendor should be able to offer specific feedback and recommendations. In some cases, remote testing may be necessary — or even more appropriate than on-site testing. Some vendors offer remote testing (and sometimes remote recovery) as an option, which could be particularly valuable if the hot site is far away.

Geography The disaster recovery planner must consider location of the hot site in light of both recovery and testing. Costs for communications, transportation, and lodging are likely to be higher if the recovery site is farther away. On the other hand, a more distant site is less likely to be affected by a regional disaster (e.g., ﬂood, hurricane, toxic contamination, or communications or power failure). In general, a hot site should be at least 25 miles away. The disaster recovery planner should consider the impact of the hot site’s location on personnel. In addition to affecting costs, a remote hot site requires that employees make an abrupt transition to a distant location for recovery; the disruption in their lives could hinder the recovery effort.

In the event the contracted hot site becomes unavailable because of a declared disaster by another client or for any other reason, an alternate hot site may be offered either at the same location or at a different location. It is important to make provisions in the recovery plan for the possibility of a different hot site location. Issues related to logistics and possibly system conﬁguration must be addressed, particularly if travel is involved. Most of the same consideration used in situating a data center apply to the location of a hot site. A hot site should not be a in a high-risk location that is subject to external disruption. Access to transportation, including airports, interstate highways, and rail lines, is important to expediting disaster recovery and even more important in the case of a regional disaster. Such predictable occurrences as rush-hour trafﬁc or the effects of inclement weather should not seriously impair access to the hot site.

Cost Hot site costs fall into several categories. Some hot site vendors offer testing and initial setup at no cost. Most charge a monthly or annual subscription fee to the organization for the ability to use their facilities and services when needed.

Subscription Fees. Subscription fees may range from a few hundred dollars to tens of thousands of dollars a month (for very large, complex mainframe environments).

Declaration Fees. Most hot site vendors charge a one-time declaration, or activation, fee. This is designed in part to ensure that clients take the decision to declare a disaster seriously and in part to cover the vendor’s immediate costs in supporting the client’s recovery. These fees can range from a few thousand dollars to tens of thousands and are paid only when a disaster is declared.

Recovery Use. Once the hot site vendor has received a declaration of a disaster, the clock usually starts ticking. In addition to hourly or daily use fees, there may be other time- or resource-related fees during the period of the actual recovery as well as during the subsequent operation at the hot site facility. Some hot site vendors limit the amount of time a hot site may be occupied after a disaster is declared, so that the hot site can be returned to “ready” status for other clients. This may mean that it becomes necessary to relocate from the hot site in a matter of weeks after the disaster, possibly to a cold site within the same facility, or elsewhere. The length of time the hot site may be used should be deﬁned in the contract, along

with clear responsibilities for the additional work and expense should a relocation become necessary. The return to normal operations following a disaster may involve additional costs and effort. This should be considered in recovery planning, testing, and budgeting.

External Costs. Expenses incurred on the client’s behalf by the hot site vendor are usually billable and should be identiﬁed explicitly, both for testing and in the event of a disaster declaration. These will likely include both one-time and duration-dependent costs, such as telecommunica- tions connections or extra equipment rental.

Storage and Maintenance Costs. The vendor may charge a fee for locker or storage space used to store documentation, materials, supplies, and so forth if beyond the basic allotment. If dedicated equipment or network connections are necessary, it is likely the hot site vendor will charge a fee covering space occupied, equipment maintenance and mon- itoring, electricity, etc.

Testing Costs. Testing at the hot site should be done at least once a year and, in many cases, as many as four to eight times a year. The hot site vendor provides a testing allowance addressing time and resources. Additional costs may be incurred for testing beyond the basic agreement. Before an organization enters into a contract with a hot site vendor, testing costs should be projected and reﬂected in the agreement.

Cost Increases. Some hot site contracts have annual or other periodic cost increases. In addition, the costs for future increases to function or capacity should be negotiated and committed up front to the furthest de- gree practical. Hot site contracts typically cover multiyear periods, because the up-front investment in establishing a working hot site vendor- subscriber relationship may be substantial relative to ongoing costs.

Software Costs. Even if disaster recovery planning software is bundled with the hot site subscription, there may be additional costs for options, enhancements, and annual software maintenance.

Other Costs. Specialized resources, vendor personnel time, and such direct expenses as ofﬁce furniture, supplies, food, and external vendor fees, may be chargeable to the subscriber during testing as well as during a recovery. These costs should be identiﬁed in advance whenever practical. Costs associated with evaluating hot site vendors and negotiating an agreement may include travel to vendor sites and legal costs.

Insurance. Insurance may cover some of the costs associated with recovery to a hot site. The hot site vendor may be expected to provide the insurer with detailed documentation in order to obtain compensation from insurance coverage.

Technical Environment As stated previously, the vendor’s technical environment must be compatible with the client’s configuration and environment. The vendor’s technical staff should be well versed in the specifics of the client’s environment. In some cases, the vendor may provide operating system software, communications drivers, or other offerings that may or may not be under the subscriber’s control or may be shared with other subscribers. Techni- cal and technological compatibility must be an integral aspect of the contract. Increasingly, client technical environments are becoming more complex and volatile. Information technology trends such as client/server, In- ternet connectivity, remote computing, and mobile computing have made the process of hot site recovery planning and execution more dif- ficult. The effective hot site vendor will demonstrate flexibility as well as the ability to adapt and improvise as needed to cope with evolving client needs. In addition, clients operating multiple computing platforms may find that hot site vendors may house the recovery platforms in more than one location, or may operate a particular platform in only one location. The vendor’s ability to deliver computing services through dedicated or pub- lic communications networks to the client’s site will be essential to a suc- cessful recovery.

Recovery Center Facilities The hot site should be operated as a going business, with appropriate at- tention to maintenance, testing, security, cleaning, and stafﬁng. It should offer a professional environment appropriate to a facility that will house the subscriber’s vital operations in a crisis. Physical security and access control are especially important at a hot site facility. Multiple clients may be testing or recovering concurrently within a facility housing multiple hot sites. Some hot site facilities may share hardware (such as logically partitioned processors) and communications facilities. The client should understand the level of physical as well as logical security provided by the hot site vendor and the mecha- nisms used to prevent security breaches and to detect violations. The client may also wish to employ multiple levels of security clear- ance among its own personnel. For example, certain people may be per- mitted to enter the computer area or tape library, and others restricted to

ofﬁce work areas. Many hot site vendors offer card-key access control systems that may be programmed to allow this. The infrastructure of the hot site facility is also important. Some (but not all) hot site vendors provide alternate electric power sources, with uninterruptible power supply systems and backup generators. Redun- dant environmental systems are also common. Some clients ﬁnd it useful to store key documentation, including their disaster recovery plan and operating procedures, at the hot site. They may also store backups of key systems data to expedite the startup process. Many hot site vendors provide limited storage or locker space for this purpose as well as limited space for such on-hand supplies as special printer forms. Arrangements can be made to ensure that the client can access this documentation or data.

Alternate Facilities A hot site may be only part of a recovery solution for a client. Several hot site vendors offer alternate facilities for computer recovery. These may include mobile, fully equipped, self-sufﬁciency, trailer-mounted computer rooms; “quickship” capabilities, with computer and support equipment rapidly delivered to the client location (or alternate recovery location); even self-contained electrical power generation and stand- alone communications facilities such as satellite or microwave links. These alternate facilities may be integrated with the basic hot site agreement or may be contracted separately. The client’s recovery time- frame, economic constraints, technical environment and location should be weighted carefully when considering an alternate facility or hot site.

Communications Capabilities In the past few years, communications capabilities have become one of the most critical aspects of disaster recovery. A backup computer conﬁg- uration in a remote conditioned space is of little value if the computer cannot communicate effectively with the subscriber’s business. More than line access is involved. The vendor should play an active role in designing, implementing, and managing the backup network. Ex- pertise and facilities should be in place to operate, troubleshoot, and re- conﬁgure the network. Custom generation of network control software to meet subscriber needs should be possible. Spare capacity, redundan- cy, and diagnostic capabilities should be in place. Modems, multiplexers, patch panels, cables, dial backup units, and other components should be inventoried, tested, and ready to use when needed. The network capabilities should also be compatible with the subscribers’ requirements. It may prove necessary to install client communications equipment or circuits to the hot site in advance. The hot site vendor may charge fees

for the space occupied by client equipment, as well as for management, testing, and coordination. Voice and other communications needs should be considered as well as data. Beyond basic PBX or Centrex service, the client may need to re- direct incoming telephone calls and faxes to the hot site. Availability of automated call distribution systems, voicemail, and other specialized equipment should be considered if it is in use at the client’s existing site.

Complementary Services Some hot site vendors offer a variety of complementary services that may be of value to the subscriber, including cold sites, electronic vaulting, planning software, off-site storage, or consulting support. In addition, some organizations may rely on such specialized equipment or services as laser printers, microform production or handling, check sorters or signers, and custom equipment. (There are even recovery facilities for trading operations.) Furthermore, such basic office needs as a telephone PBX, facsimile, copiers, or other components may be vital to a recovery effort. The vendor’s responsibilities regarding this equipment should be specifically identified. Vendors may also provide disaster recovery planning software. The software cost may be bundled with the hot site subscription. This may or may not prove to be an advantage to the client: (1) the software may not be ideal for the client’s specific plan development needs or environment; (2) annual software maintenance costs could become considerable; and, (3) upgrades or options for the software may be necessary at additional cost. Therefore, in weighing the value of bundled software or services with a hot site contract, the true value to the client organization should be considered, along with ongoing costs, if any, for maintenance.

Stability and History Disaster recovery hot sites are a relatively new industry. Only a few companies have been active for more than 10 years. The disaster recovery planner should look for a company with a steadily increasing client base (to a declared maximum) and history of enhancement as an indication of stability. In addition, actual recovery experience is a powerful advantage that should not be overlooked; some hot site vendors have not yet actu- ally supported any declared client disasters. The continuing vendor consolidation in the disaster recovery hot site industry, noted earlier, is an important factor. A hot site vendor’s policies, practices, philosophy, facilities, staff, and more may change if the vendor is acquired or merged. If a hot site vendor fails, the cost and impact of reimplementing and retest- ing the disaster recovery plan with a new vendor may exceed the cost of the hot site agreement.

The ﬁnancial data, ownership, and history of a hot site vendor can be a decisive factor in the selection process. Some companies have entered the hot site business as an adjunct to their service bureau or other business. When an organization is checking references, service bureau clients should be considered separately from hot site clients.

Contract Terms The typical hot site agreement duration ranges from 2 to 5 years. Sub- scription costs tend to decline dramatically with increasing terms beyond three years. An important tradeoff to consider is that client needs may change dramatically during the contract term. Therefore, subscription fees should not necessarily be weighted as heavily in the decision process as such factors as costs associated with initial plan development, implementation and testing; transition costs if the client were to move to another vendor; or, excess or insufﬁcient hot site coverage as the client’s conﬁguration, recovery needs, or technology evolve.

Responsiveness and Flexibility Disaster recovery requirements are likely to change over time. The hot site vendor should be able to support such changes, although there may be additional costs. Most organizations find that the ability to change configuration or other aspects over time without renegotiating the base contract is valuable. In addition, the vendor’s history of innovation and responsiveness to industry trends can indicate its commitment to its clients. The vendor should explicitly define the nature and extent of their commitment to new client technology, equipment, capacity, or functional needs. The process of activating the disaster recovery plan is another area to look at with regard to responsiveness. The vendor should have an ex- plicit, documented plan for the declaration process that meshes with the subscriber’s disaster recovery plan.

Activation The process and time delay associated with initiating a disaster declaration should be considered from both a recovery and ﬁnancial perspec- tive. Most vendors prefer that a client who is considering declaring a disaster ﬁrst issue an alert, so that the vendor can begin preparations to support the client in the event the client formally declares a disaster. Generally, there is no cost to a client for alerting the hot site vendor. Once alerted by the client, the hot site vendor should be able to rapidly activate the hot site if a disaster is declared. The hot site agreement should be unambiguous with respect to activation timeframes as well as

speciﬁc vendor and client responsibilities. However, it should be noted that the hot site agreement typically contains limitations regarding the vendor’s liability, hot site availability, and adequacy of the facilities.

Personnel Support The recovery center should not be merely a shell housing a computer. Subscriber staff will likely spend a great deal of time at the center con- ducting testing as well as carrying out recovery procedures in the event of a disaster. It is important that lodging, food, access to medical care, transportation, logistics, communications, and any other special needs of the personnel who will be assigned to the recovery team at the hot site be addressed by the hot site vendor. Most hot site vendors provide such basic amenities as break rooms, vending machines, and coffee service. Some even provide more elabo- rate facilities, including basic on-site medical care, cots, and VCRs or vid- eo games for off-duty personnel. While not critical to a recovery effort, such conveniences can have great value in relieving the stress and incon- venience of a recovery.

Availability Most hot site vendors limit competition for their resources to ensure that they are able to serve any client promptly. The contract should limit the maximum number of subscribers to the hot site. Many vendors will not sign on a subscriber to the same facility as another subscriber in the same area (e.g., building, block, neighborhood, telephone central ofﬁce, or power grid). In addition, to improve the odds of being able to serve clients in the event of a regional disaster, some hot site vendors offer alternative facilities or locations in case the primary hot site is already in use. Once a subscriber declares a disaster, it is completely dependent on that hot site; a fallback facility could become critical. This is particularly important if the vendor is limited to a single recovery facility and that facility was unavailable for any reason—already in use by another customer, or dis- abled by a local or regional disruption.

EXAMPLES OF VENDOR OFFERINGS There are several dozen U.S. hot site vendors and perhaps 10 relocatable-recovery-site vendors. Some examples of vendor offerings are dis- cussed in the following sections.

Comdisco Disaster Recovery Services Founded in 1980, Comdisco Disaster Recovery Services is one of three major players in the hot site business, the others being Sungard and IBM

BRS. Comdisco offers a broad range of locations, conﬁgurations, and services, including a sophisticated dedicated communications network, mobile recovery facilities, consulting, electronic vaulting, trading-ﬂoor backup, MICR check processing, and a planning software package, Com- PAS. Comdisco has successfully supported numerous client recoveries.

Digital Equipment Corporation Digital Equipment Corporation offers RESTART, fully conﬁgured hot site facilities; DECReady, mobile recovery facilities; and, Recover-All, a com- bination of repair and replacement for damaged equipment, together with insurance reimbursement for recovery expenses. Digital partners with IBM Business Recovery Services to offer multi-platform hot site recovery.

Hewlett-Packard Hewlett-Packard offers BACKUP, hot site recovery for HP 3000 and HP 9000 systems; and, BACKUP EXPRESS, delivery of fully operational systems to the client location with 24 to 48 hours of notiﬁcation.

IBM Business Recovery Services IBM Corporation entered the disaster recovery market in 1989 with its Business Recovery Services offering. Although newer to the industry than Sungard or Comdisco, IBM has substantial experience supporting recoveries among the vast array of company-controlled and client computer facilities around the world. IBM offers a broad array of hot site conﬁgurations and ancillary facilities such as network recovery, voice recovery, and end-user work area recovery, with extensive offerings internationally. Computing platforms supported include virtually the entire range of IBM computer systems as well as may non-IBM computers.

Sungard Recovery Services SUNGARD Recovery Services was established in 1978 and offers a wide variety of services and geographic locations. In addition to IBM main- frames, Sungard supports Stratus, IBM System/88, Unisys, Tandem, and Digital Equipment clients. SunGard offers DP/90, a contingency planning software package, as well as consulting support. Several subscriber disasters have been successfully handled to date.

Wang Laboratories Inc. Wang Laboratories Inc. offers a range of services to Wang customers. In addition to a fully equipped hot site recovery center located in Lowell, MA, Wang offers a Rapid Recovery program, with specially designated

replacement hardware shipped to the subscriber if the subscriber premises (or alternative site) is usable. Wang also offers assistance to clients in establishing alternative processing sites and reimbursement for additional expenses. The annual fee for these services is 1% of the current hardware price. Wang also offers a model disaster recovery plan to Wang customers, and consulting and training as well as testing support.

RECOMMENDED COURSE OF ACTION The ﬁrst question that a disaster recovery planner should ask before considering hot site vendors is whether a hot site is really necessary and appropriate. Some organizations enter into hot site agreements without fully considering other alternatives (e.g., cold sites or other company- controlled facilities) or contract with hot site vendors before they are able to implement recovery procedures or to test. Without those procedures or thorough testing, a hot site contract is nothing more than a costly piece of paper. Once the organization has decided that a hot site is required, the disaster recovery planner must have a clear understanding of the requirements before contacting vendors. Examples of organizational requirements include:

•The minimal conﬁgurations and capacity necessary •The most important factors in vendor selection •The factors that would rule out a vendor from further consideration

A list of weighted selection factors should be prepared before vendors are contacted so that the most important considerations are identiﬁed and resolved early in the evaluation process. The next step is to determine which vendors have the potential to meet the basic recovery requirements. Exhibit 1 lists some sources for general information about vendor offerings. Exhibit 2 is a list of hot site vendors. It is helpful to provide hot site vendors with speciﬁc written requirements. Some vendors may decline to bid because of the organization’s particular functional, capacity, or logistic requirements; by ruling them out early in the process, the disaster recovery planner can save much time. Contacting current clients of the hot site vendor is a vital step. Each of the factors affecting selection should be addressed to the extent practical with the vendor’s clients as well as the vendor itself. The list of potential hot site vendors should be narrowed rather quickly; however, the disaster recovery planner should remember that vendor pricing is only part of the total cost and therefore avoid ruling out a vendor early on pricing alone.

EXHIBIT 1—Information Sources for Hot Site Vendors

Disaster Recovery Journal P.O. Box 510100 St. Louis, MO 63151 314.894.0276 E-mail [email protected] http://www.drj.com

The Rothstein Catalog on Disaster Recovery Rothstein Associates Inc. 4 Arapaho Rd. Brookﬁeld, CT 06804-3104 203.740.7444 E-mail [email protected] http://www.rothstein.com

Survive! The Business Continuity Group P.O. Box 5030 Branchburg, NJ 08876 1-800-SURVIVE E-mail [email protected] http://www.survive.com

In addition to Survive!, numerous regional disaster recovery groups throughout the world provide access to information about hot site vendors. Each of the above sources can provide information on these contingency groups.

Once a vendor has been chosen, it is imperative to ensure that the contract provides for all the organization’s current and projected needs. Relationships with hot site vendors may deteriorate because of unrealistic expectations made on the basis of oral or assumed agreements. Once a contract is signed, it may be difﬁcult or costly to address additional expectations; a costly transition to a different hot site vendor may be necessary, possibly even before the end of the contract term.

Source: Fax (913) 233-6862 (913) 232-0368 Topeka, KS 66618 1620 N.W. Gage Blvd. Dennis Friedl BACKUP RECOVERY fax (909) 656-2520 (909) 656-2238 Riverside, CA 92507 Locations B: 2nd 6455 Box Springs Blvd. Carole A. Gudde ARCHIVE MANAGEMENT Company SERVICES INC. EXHIBIT 2 “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate —Alternate Sites —Alternate Topeka, KS locations Two power source? 5B CA in Riverside, e 2200/400, Unix Yes UPS tem Sys- Micros Computers & Midrange Host Mainframe 6000 M9760 Colorado One ADUis aeDie Front-end Tape Drives DASD Units 10 Gig ix— 26 Gig, Un- U-36 II, tridge U-40 car- DCP- 15, One One Processors HLC aaLnsVoice Data Lines Dial-Up, 1100 pair, 56kb Lines 048 free 10 652 Hours Testing Annual No 1)Yes— Not at this No Site Mobile odSt Office Work Cold Site curity premise se- systems, sprinkler controls, vironmental erators, en- diesel gen- floors, UPS, raised curity premise se- systems, sprinkler time—UPS, Yes—3 PCs, Yes—7 PCs, Space phones 10 tele- terminals, 6 dumb phones 15 tele- Tape storage, rotation, forms microfiche storage struction, microfilm, CDs and document storage and de- Other Services

Source: (212) 612-4175, fax 612- New York, NY 10038 100 William St., 6th floor Dina M. Becker CHUBB CONTINGENCY (860) 947-5000 Hartford, CT 06114 245 Locust Street D. Richard Normand CADRE INC., A Fiserv Solution (412) 321-0600, Locations B: 2nd Pittsburgh, PA 15107 555 N. Bell Avenue TomerHerman BRM/GATEWAY Company 4672 TRADING FACILITY fax (412) 321-5152 EXHIBIT 2 “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate AtraeSts(continued) Sites —Alternate Long Island City, Metrotech, Hartford, CT Pittsburgh, PA power source? 5B Queens, NY Brooklyn, NY e N/A Yes Yes, Yes, tor era- Gen sel Die- and UPS ion cat- lo- one at A12, A6F, A1FX, Can interface Computers & Midrange Host Mainframe MA800 V380, V530, SunGard co, ISSC, and with Comodis- / HP Sure- N/A (32) M9710 - N/A N/A ADUis aeDie Front-end Tape Drives DASD Units 20gb MD2400- 9ms (14) Marco (8.7GB), dom, 4x16 DSI Free- 13.5-gb, MD1200- Macro 22GB, (20) (10) 89495- tridge EDRC Car- (4) 5073- ro—DAT, (2) Mac- VT-200E, (2) Virtual HS8500, isys 24, (1) Un- (2) store 60001 / DS3 fiber links N/A (4) CP3680, CompuTerm Processors HLCN Connect1, (1) (3) CP2005, CE’s aaLnsVoice Data Lines (70) dial-up, (5) 48+, Digital itan Fiber. port, Metropol- NYNEX, Tele- providers, local access from separate 51, 56k Lines 1200 64 70 No 48+ ity facil- each at Varied Hours Testing Annual needs ents by cli- mun maxi- oYes—raised No Yes— No Yes— Site Mobile footage square various Yes—raised odSt Office Work Cold Site system pression fire sup- lon 1301 curity, Ha- premise se- systems, sprinkler controls, vironment erators, en- diesel gen- floors, UPS, curity premise se- systems, sprinkler controls, vironmental erators, en- diesel gen- floors, UPS, curity premise se- systems, sprinkler controls, vironmental er-ators, en- diesel gen- floors, UPS, raised Yes—500+ Yes—10 Yes- 225+ Space telephones PCs, 500+ telephones minals, 20 dumb ter- PCs, 25 phones 48+—tele- terminals, 12+—dumb 12+—PCs, seats, Disaster recovery planning, space, di- Cold shell and office “Quick-Ship” equipment op- and LAN recovery. Primary business is trading multimedia trial presentations. tronic data discovery and records, imaging, paper/elec- consulting, storage of vital testing and disasters arrival loading and setup for analysis, remote testing, pre- saster data comm design and vendors.” frame and mid-range hot site and telecom to primary main- site” via channel-extension technical support, “remote hot tion; copiers, printers, fax’s; Other Services

Source: fax (410) 987-6710 (410) 987-7003 Millersville, MD 21108 Suite 308 8227 Cloverleaf Dr. Paul Keys COMPUTER ENGINEERING (203) 925-3900, 944-9008 Shelton, CT 06484 One Enterprise Drive, 4th Floor Robert H. Urion COMPUTER ALTERNATIVE (313) 462-5785, fax 462- Livonia, MI 48152-7520 39200 Six Mile Road Tony Silva COMERICA BANK INC. www.comdisco.com (847) 518-5988 (800) 272-9792 Rosemont, IL 60018 6111 N. River Road Scott McCormack COMDISCO DISASTER RE- ASSOCIATES, INC. PROCESSING SITES, INC. 5555 COVERY SERVICES “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate Mt. Laurel, NJ; Secaucus, NJ Shelton, CT Hills, MI Auburn 25 hotsites in the Pittsburgh, PA ter) (1997 3rd quar- internationally da; 6 locations tions in Cana- U.S.; 5 loca- oeData General MV Some LANs only Yes Unisys V530 Yes Mainframe: IBM Yes and Aviion and FileNet General, Unisys AT&T, Data Pyramid Nile, VLX, Stratus, Cyclone and Sun, Tandem Alpha & VAX, RS/6000, Digital AS/400 and HP9000, IBM 8824; Midrange: 5890, HDS GX- 3090, Amdahl ES/9000; IBM l oesAll models All models N/A N/A 6.2 GB Over 17 ter- disk MB SSD disk—512 MD8 12 spindles CASD disk; M9710 and platforms. leading all market including available, abytes are (2) BT3200 All market- able. are avail- platforms leading AV2000, HP Compaq (1) Switched (1) CP2000 All market Pentiums Netserver ers 1500 Serv- models. leading ISDN, T1, 56k, T-1, 56kb, IS- SW56, SWT1.5, dial ups DN, Fiber 56kb tions network communica- high-capacity SONET-based, CDRS Net, a linked by facilities are Comdisco DR vary by site. All and offered DN, SMDS are and Prime IS- Relay, Basic SWT 13, Frame 016—32 40 40 300 724 Var- tion loca- by ies Max. hours ment quire- re- cust. per ally annu- lowed al- hours oNo No Yes—raised No No— Yes—fa- 6,500 space ous floor continu- feet of square 000 760—10, from provide ured to config- can be cilities N/A Yes—raised curity premise se- sprinklers, controls, vironmental erators, en- diesel gen- floors, UPS, ple parking curity, am- premise se- systems, sprinkler trols, ment con- environ- floors, UPS, Yes—25 Yes—4 offic- Yes—5 PCs, Yes—6000+ phones 50 tele- terminals, PCs, 300 telephones PCs, 200 rooms, 100 ference es, 2 con- telephones 7 terminals, 20 dumb place phones in 2000+ tele- place, minals in 1000+ ter- seats; workarea Maintenance, depot repair, Business function recovery Complete check image disaster Professional services, busness sales, software consulting with 300+ seats, disaster plan tions—(20) T-27 terminals Pkts—(55) Image, worksta- & Car—(4) DP500 HSEM 36 recovery, (3) DP1800 w/Image partners. ware leasing, Alliance ery, Asset Management, Hard- Recovery, Applications Recov- nual User Conference, Internet Floor Continuity Services, An- Quick-Ship Services, Trading Millennium Testing Services, Advanced Recovery Services, continuity planning software,

Source: (817) 457-9400 Fort Worth, TX 76112 200 East Loop 820 Louis Scoma, Jr. DPS MANAGEMENT CON- Fax (516) 563-5185 (516) 563-8880 Bohemia, NY 11716 200 Knickerbocker John C. Kossman CONTEMPORARY COMPUTER home.navisoft.com Fax (201) 672-8069 (201) 672-6000 Locations B: 2nd Orange, NJ 07050 397 Park Avenue John Painter COMPUTER SOLUTIONS, INC. Company SULTANTS (DPS) SERVICES INC EXHIBIT 2 “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate AtraeSts(continued) Sites —Alternate Birmingham, Birmingham, Bohemia, NY Orange, NJ; power source? 5B HI; Tulsa, OK TX; Honolulu, AL; Ft. Worth, Clinton, NJ oNCR 8595-II, No IBM ES/9000, Yes HP3000, HP 9000 Yes Computers & Midrange Host Mainframe w/16 pockets 3892 Model 1 AS400—IBM IBM w/16 pockets; 3892 Model 1 AS400—IBM IBM w/36 pockets; Reader/Sorter NCR 8575-6780 S/38 AS/400, S/36, 3090, 4381; IBM tems business sys- NCR 6550, 3420; 3480; 3380, 3390 All HP Units All HP Units ADUis aeDie Front-end Tape Drives DASD Units NCR 658 NCR 6370 3490 C 2 T.1, 56KB NCR 621 Multi, 56k T-1, 3725; 3745 Custom Config- N/A Processors aaLnsVoice Data Lines switch Dial-up urations Lines Up to 40 50 One N/A voice pairs 120 12-24 Hours Testing Annual able avail- if more site) (hot- hours time ed limit- un- with al test annu- oYes -up to No Yes—UPS, No Yes—rap- Site Mobile tems ble sys- shippa- with program ery id recov- Yes—raised odSt Office Work Cold Site support curity, tech. premise se- trols, mental con- environ- floors, UPS, cess control system, ac- detection sion, water suppres- lon fire curity, Ha- premise se- systems, sprinkler trols, ment con- environ- tors, sel genera- floors, die- ft.—raised 33,00 sq. floors raised curity, premise se- systems, sprinkler erators, diesel gen- Yes—up to Yes—30+ New replacement hardware, Yes Space required available as phones and tele- terminals PCs, dumb square feet; 15,000 30+ PCs phones, tele- minals, 30+ dumb ter- Management consulting in di- Hardware maintenance, re- nel partner services outsourcing, rentals, HP chan- (continuity) planning vices, business resumption storage ser- programs, offsite diovisual emergency training saster recovery planning, au- planning software ning, tape storage, disaster software, contingency plan- software support, application placement hardware, systems Other Services

Fax (216) 838-4037 (216) 838-4044 Brecksville, OH 44141 6625 West Snowville Road Gregory W. Sedlacko FIRSTMERIT, DISASTER RE- Source: Fax (612) 755-9100 (612) 755-9100 Andover, MN 55304 P.O. Box 909 Robert D. Katvala FINANCIAL DIVERSIFIED www.drs.net Fax (704) 525-0098 (704) 525-0096 Charlotte, NC 28217 4901 Dwight Evans Rd., Suite Steven King DRS DISASTER RECOVERY COVERY HOTSITE SERVICES, INC. 132 SERVICES “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate San Ramon, CA; Mobile teller fa- Charlotte, NC window and drive-up safe, drop off cameras, night line, security, plete with teller unions com- and credit ered to banks cilities delivery labs 2 mobile recov- e Unisys A11-411 Yes N/A No NCR, Unisys Yes (16 pockets) Reader/Sorter NCR 7770-3000 pockets; one pable) with 32 (one is NDP-Ca- Reader/Sorters Unisys DP1800 Micro-A; Two memory; Unisys V430 with 20MB memory; Unisys with 48MB 10 packs of N/A N/A 7/14 Gb …, N/A of 11.18GB bined total for com- (4.48GB) SCSI Unisys 8 packs of 7GB) plus M9710—(6. Unisys Unisys (1) DAT tape Unisys (1), 4mm DAT tape mm virtual tape (1), 4 (2), 8 mm Cartridge USR 5073 Reel (4), BT3200 Tape Gb DLT 10/20/40 CPDLP, ED- N/A N/A 5 N/A tocols with all pro- 18 ports CP2000— DLP, Telecom DCDLP, CDLP, 18 dedicated lines 56KB, 10 ISDN and switched up to 9600 bps, dial-up/RS232 0Varies 20 N/A 6 48 8 hours oNo No Yes—800 Yes—1200 sq. feet lab recovery mobile in each sq. feet No No Yes- up to Yes—within Yes—45 phones to 120 tele- minals, up dumb ter- 12 PCs, 20 square feet, 2,000 phones unit 3 tele- the mobile telephones minals, 15 dumb ter- PCs, 4 Unisys DP500, S6000, and Mobile/onsite and hot site so- formed at the site. formed service bureau work is per- recovery—no production or Hotsite is solely for disaster and emergency processing. technical support for testing service, statement rendering, land Federal Reserve, courier check clearing with the Cleve- nancial Institution backup; coders; specialize in Unisys Fi- proof backup with 30 NCR en- DP1000 backup; single pocket NDP1800, DP1800 and S4000 backup, Unisys lockbox processing systems imaging, reject-reentry, and peripherals, speciﬁc to check 500, 1000, 1800 Systems and 7790, 7795, and Unisys NDP lutions for NCR 7770/7780,

Source: www. household.com Fax (847) 559-7177 (847) 291-8740 Prospect Heights, IL 60070 2700 Sanders Road Gerald Stokes HOUSEHOLD www.hp.com Fax (425) 957-4949 (800) 863-5360 Bellevue, WA 98006 Locations B: 2nd 15815 SE 37th St. Millie Seal HEWLETT-PACKARD Company INTERNATIONAL COMPANY EXHIBIT 2 “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate AtraeSts(continued) Sites —Alternate Schiller Park, IL Wayne, PA; Fed- power source? 5B io, Canada Toronto, Ontar- eral Way, WA; oDEC 6210 No All models HP Yes Computers & Midrange Host Mainframe 3000/9000 / N/A N/A All model ADUis aeDie Front-end Tape Drives DASD Units HP All model StorageTek HP, IBM All model HP Processors trollers 3174 con- 3720/11, six 3000/9000 aaLnsVoice Data Lines eight 5-1 ana- Various T1, logs AT&T, Sprint 56kb—MCI, Lines 9 Nego- 192 More ter cen- ery cov- re- per 100 than Two Two Hours Testing Annual tiable chased pur- can be tional Addi- 16 hrs 48 & able: avail- plans oNo No Yes—300- Site Mobile feet square to 3,000 Yes—raised odSt Office Work Cold Site curity premise se- systems, sprinkler controls, ronmental ertors, envi- diesel gen- floors, UPS, Yes—work Yes—25+ Space 350 phones up to 150; # terminals negotiable ship” pcs, “quick 5—15; pacity for ca- office tions—350, sta- phones 100+ tele- minals, dumb ter- PCs, 60+ Small 486 LAN, data lines are consult- Planning, performance port—Chicago 5-10 minutes of O’Hare air- cat-5, others are cat-3, within ing, Business Impact Analysis Other Services

Source: www.ibm.com Fax (914) 759-4690 (800) 599-9950 Sterling Forest, NY 10979-0700 300 Long Meadow Rd. Larry Ellis IBM BUSINESS RECOVERY www.mdyadvtech.com Fax (201) 797-6852 (201) 797-6676 Fair Lawn, NJ 07410 21-00 Route 208 South Roy Strunin MDY ADVANCED SERVICES TECHNOLOGIES, INC “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate Fair Lawn, NJ 20 recovery fa- tries non-U.S. coun- 96 sites in 61 cilities in U.S.; / DEC, VAX 3400 N/A 9672, Parallel Yes Digital, HP, Sun, RS/6000, SP, S/88 S/36, AS/400 B- Superservers DOS) Netframe Windows/NT, ers (Novell, (4) AST file serv- Xerox Stratus, Wang, Data General, laya), Unisys, Tandem (Hima- 530/2162 models 400 thru AS/400 RISC 320/2052. 200 thru Series models F97, Advance 3081, 4381, 9370 3090, 3084, 9121, 9221, Facilities, 9021, 9674 Coupling Sysplex with 4 GB disk, 9336; 9337; Ramac Vir- tems Novell Sys- dows/NT/ DOS/Win- of wk, tems, 6 GB VMS Sys- 451X) XL80, 4500, (V8, V80, Tandem 7133; 7135; Optical 9345, 3995 3380/D-K; 2/3/9, 3390- mac 1/2/3, (RVA2), Ra- tual Array 1600BPI, 9 3490, 7208, Magstar DEC Tk50 mm, 4 track, 8 519XACL) 518XACL, 517X, dem (513X, Data) Tan- Decision (7208 and 9348 8 mm cartridge, .25 inch (VTS) Server al Tape 3420, Virtu- 3490, 3480, 3490E, 3590, / 8 POTS lines N/A 3746- adaptors munication grated com- OEM inte- others. and term Compu- Networks, 3Com, Bay Cisco, from CNT, products suite of 5645. Fall Comten 3705, 3725, 3720, 3745-61A, 3745-170; 3745-210; 3745-310; 3745-410, 900/950, Multiprotocol 50+ countries locations in points in 860 access ternet DS3); local in- svcs (up to and switched frame relay ported, incl. carriers sup- capacity. Major multiple OC-48 tech. up to ber SONET self-healing fi- jor rec. ctrs. via Access to ma- APPN, others; TCP/IP, IPX, SNA/ SDLC, support for: 100+ countries; 850 cities in connections in line or dial (DS3); leased 45 mbps speeds up to network at 5As per 25 Var- tion loca- by ies 24-72, tract con- fee for a tained be ob- may hours tional addi- Yes—2400 Yes—up ft. square days within 7 sq. ft. to 3500 Yes—UPS, Yes—raised erators diesel gen- key access water, card loop chilled closed- dundant curity, re- systems, se- sprinkler controls, vironmental erators, en- diesel gen- floors, UPS, Yes— unlim- Yes—PCs, telephones terminals, PCs, dumb ited # of seats end-user with 7500 Worldwide uted Sites 55 Distrib- available. options are Quick ship location. varies by equipment Amount of phones. terminals, ers, dumb LANs, serv- LAN/WAN network integration, Business recovery consultation software implementation Certified in 25 countries 13.2 K Mips; 38 Terabytes; ISO 10,500 contracts worldwide; consulting engagements; consultants; 1200 worldwide and testing capability. 200 age support; remote access ment, optical storage and im- services and crisis manage- solutions; business resumption quick shipment of recovery and mail distribution services; call center protection; print full featured ACD recovery for ery Management Solutions; 2000 testing solutions; Recov- services and software; Year Intrusion Detection; Anti-Virus sponse Service with Real Time Emergencytion); Internet Re- WWW and Interact applica- business recovery services (for electronic data protection; solutions for all platforms); roring and electronic vaulting ability Solutions (remote mir- planning services, High Avail- services, business recovery

Source: www.NCR.com Fax (937) 449-2599 (800) 587-0911 Dayton, OH 45479 1611 South Main St. SDC-3 Michael Kurilec NCR CORPORATION— Fax (817) 458-4943 (800) 433-5526 Locations B: 2nd Sanger, TX 76266 P.O. Box 856/521 S. Stemmons Kimberly K. Shaw MPA SYSTEMS Company SERVICES BUSINESS RECOVERY EXHIBIT 2 “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate AtraeSts(continued) Sites —Alternate Hotsites: Day- Buildings power source? 5B NJ; Chicago ton; Cranbury, VA.Beach; Bos- lumbia, MD; Hartford; Co- ami; Atlanta; CA; Dallas; Mi- CA; San Fran, Warmsites: LA, elle Park, NJ ton, OH; Roch- ous states housed in vari- e NCR WorldMark Yes Gen- ble la- avai tors era- N/A Computers & Midrange Host Mainframe NCR 9800’s S16, S26, S46, 3400; NCR S10, Servers: 3500, 4300, 4500; NCR 5100S, 4100, Servers: 5100C, WorldMark Systems; NCR Data Warehouse tems; NCR 3600 Warehouse Sys- 5100M Data 6356, 6547, N/A N/A ADUis aeDie Front-end Tape Drives DASD Units Tek 6400 Storage- 3500 EMC; 6540, 6543, 6376; 8mm 4mm 3490E; 3490; 40); 3480; DLT (20- 10-20); (5-10, 7-14, Comten 5675 10 lines N/A Processors tension Channel Ex- and 3690; aaLnsVoice Data Lines T1.5; T3; ISDN, Dial Lines 5 Varies 450 10 lines N/A Hours Testing Annual min.) hrs. (48 needs tomer cus- by Yes—up Yes—980 Site Mobile sq. feet to 1000 feet square Yes—raised Yes—diesel odSt Office Work Cold Site neers onsite field engi- curity, NCR premise se- systems, sprinkler controls, vironmental erators, en- diesel gen- floors, UPS, tems sys- alarm camera and restrooms, compliant unit, 2 ADA AC, heating lobby area er line, dastals, tell- steel pe- counter safe, under- pository, night de- window, driveup curity, premise se- generators, Yes—250 Yes—10 Space telephones minals, 300 dumb ter- PCs, 210 wiring computer phones, tele- Consulting; planning software, Program members have avail- backup item/image payment system remote data mirroring, ability Systems and software, tion, education, High Avail- 2000 Services, Power Protec- QuickShip Programs, Year for $795.00 annual fee. use of building and equipment 72 hours, and six months free ability, response within 24 to Other Services

Source: www.strategiacorp.com (502) 426-3434, (800) 325- Louisville, KY 40223 1030 Linn Station Road Dean Gardenhire STRATEGIA CORPORATION Fax (514) 955-0214 (514) 955-0213 St-Leonard, QC, Can H1R 1Z7 5055 Metropolitan Blvd. E Suite Jocelyn Audette SERVICES CONSEILS RDI INC. Fax (612) 938-2495 (800) 365-7274 Eden Prairie, MN 55344 10351 West 70th Street Farrell Ball RECOVERY BUSINESS 3977Fax (502) 426-3028 104 SYSTEMS, INC. “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate Louisville, KY Montreal, Cana- Minneapolis, da San Ramon, CA Heights, MN; MN; Mendota e Bull: DPS 90/94, Yes N/A Yes IBM AS/400s: Yes 3090/600J 6/95; IBM: DPS 8/70, DPS 8000/82, DPS 8000/83, (Total: 16GB) tel Cached Disk DASD, 12GB Zi- 4GB Unisys A6/311; DASD: A2400/A14-311, Unisys A-Series: (60GB total); Cached disk 9337, IPL 9337 DASD: IBM B60, 9406-B60, 300/2044, 9406- 9406-F60, 9406- 3380K, N/A N/A 60 3390MOD2 MOD3, 3390 3380D, DASD Unisys DASD, 46B 12GB, Zitel DASD AS/400 9336 GB—9337, MTH630 (28 All types dresses) 3490 (6 addresses), (32 ad- es); 3480 address- 4780 (18 es); STK address- DN 8120 (4), One, ISDN N/A Per customer N/A 3745, 3174 3705, 3725, DN8130 (2), XS Dialup, 8 2 ISDN Reserved T1s, AT&T Accunet Switched 56, 2 AT&T specifications more 13 144 Per 24 than tions ifica- spec- r tome cus- 72 24 -72 hours free /year hours oYes—raised No Yes— No Yes—600 unit sq. ft. per Yes—raised curity premise se- system, sprinkler controls, ronmental erator, envi- diesel gen- tial UPS, floor, par- curity premise se- systems, sprinkler controls, vironment erators, en- diesel gen- floors, UPS, curity premise se- systems, sprinkler controls, vironment erators, en- diesel gen- floors, UPS, raised Yes—12 Yes—48 of- Yes—up to terminals IBM dumb minals, 16 dumb ter- PCs, 16 Bull telephones minals, 12 dumb ter- 11 PCs, 4 available, fice spaces tions er specifica- per custom- telephones minals, and dumb ter- ees, PCs, 40 employ- Consulting services, contingen- Disaster recovery plan software Quick ship hardware replace- cy planning software nancial institutions ment, check processing for fi-

Source: www.recovery.sungard.com Fax (610) 341-8739 (800) 247-7832 Wayne, PA 19087 Locations B: 2nd 1285 Drummers Lane Donna Baun SUNGARD RECOVERY Company SERVICES INC. EXHIBIT 2 “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate AtraeSts(continued) Sites —Alternate Atlanta; Bir- power source? 5B inster, PA Toronto; Warm- Scottsdale, AZ; is; St. Paul; Seattle; St. Lou- Santa Ana, CA; Ramon, CA; Pittsburgh; San Philadelphia; City; Montreal; City; Kansas don, VA; Jersey Detroit; Hern- las; Denver; Cleveland; Dal- ton; Chicago; mingham; Bos- e Mainframe: IBM Yes Computers & Midrange Host Mainframe PC/LAN servers broad range; Tandem— tem/3X, tus, Sun, Sys- Graphics; Stra- Sequoia; Silicon 2000 systems; and NUMA-Q cluding SE80 SP; Sequent in- range; RS/6000 RS/6000—broad ers; Prime; NetFRAME serv- systems; NCR, ing mult. T500 HP9000 includ- HP3000, range; Filenet, tal—broad General; Digi- Data forms; range of plat- AS/400—broad Midrange: IBM avail.; Unisys; and links is coupling facility with separate Parallel sysplex 3090, Hitachi, ES/9000, 9672, Mainframe: ADUis aeDie Front-end Tape Drives DASD Units storage abytes of over 5 ter- providing models variety of Midrange: tion; one loca- abytes in over 6 ter- cluding models in- variety of 3390, 3380, EMC, IBM Mainframe: available model every drives, 500 tape More than Midrange: drives; berline with Tim- Tek Silo Storage- star); 3590 (Mag- available; hundred several 3490E— 3480 and All current Processors available models aaLnsVoice Data Lines Self-healing fi- BRI/PRI lay, ISDN x.25, frame re- tional, 56kbps, T3, T1, Frac- FDDI, ATM, bone: SMDS, work back- National Net- based SunGard gy; SONET- ring technolo- ber SONET Lines more 2500 than Based Hours Testing Annual ments quire- re- tomer cus- on 9 avail- Site Mobile hours within 48 ment of equip- stallation and in- delivery ensures tion Ship op- Quick- units. chaise with two equipped 28' units, and five units; three 45' unit; One 53' able— Yes—raised odSt Office Work Cold Site cess card key ac- ter supply, chilled wa- curity, premise se- systems, sprinkler controls, vironment erators, en- diesel gen- floors, UPS, Yes—De- Space terminals terminals and 10-50 Servers; 5—75 PC/ phones, tele- 30—300 tions, work posi- 30—300 between there are location, pending on Electronic vaulting; PC/LAN sulting recovery planning and con- tice, Professional Services; and vices; SAP Technology Prac- services; check processing ser- software; printing and mailing business recovery planning SunGard National Network; vaulting;, Year 2000 services; Other Services

Source: www.vanguardsvaults.com Fax (916) 686-8227 (916) 686-8286 Sacramento, CA 95865 P.O. Box 254575 Todd Sperber VANGUARD VAULTS Fax (703) 620-7151 (703) 620-7025 Reston, VA 20191 12010 Sunrise Valley Drive Ed Dougherty UNISYS CORPORATION Fax (414) 290-8276 (414) 290-8272 Wauwatosa, WI 53151 12009 W. Capitol Drive George Sweet TOTAL CORPORATE Fax (612) 361-9366 (612) 361-9355, (888) 361-9355 Chaska, MN 55318 323 Lake Hazeltine Drive Don Christensen THE RECOVERY ROOM, INC. RECOVERY CENTER “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate Sacramento, CA Phoenix; Wauwatosa, WI Chaska, MN Cincinnati NY; Utica, NY; Lake Success, Cherry Hill, NJ; Eagan, MN; Indianapolis; CA; Cleveland; Long Beach, Concord, CA; Bakersfield; e N/A Yes Var- Yes— 9221-421, 9221- Yes lines feed er pow- 2 site by ies N/A IBM, Unisys, ard, Sun Hewlett Pack- 170 / N/A N/A Varies by N/A N/A 3490, 9348, 9345, 3390 site Varies by site 3480 / N/A N/A site by Varies Varies by site DS3 on SONET N/A T1 N/A Ring N/A 6 Var- 24 73 De- T1 site by ies Nego- tiable tract con- on pends / Yes—raised N/A Yes—raised No Yes—raised No No Yes—UPS, curity premise se- systems, sprinkler controls, vironment erators, en- diesel gen- floors, UPS, curity premise se- systems, sprinkler controls, vironment erators, en- diesel gen- floors, UPS, curity premise se- systems, sprinkler controls, ronment floors, envi- curity premise se- controls, vironment erators, en- diesel gen- Yes—10 Yes—num- Yes—28 Yes—4 PCs, phones PCs, 8 tele- varies telephones minals, and dumb ter- ber of PCs, telephones minals, 24 dumb ter- phones 16 tele- terminals, 12 dumb Individual vaults for off-site Individual vaults for off-site Year 2000 test environments; Cold site, replacement services testing storage of all media; disaster ment outsourcing; facilities manage-

Source: www.weyer.com Fax (206) 727-7060 (800) 654-9347 Federal Way, WA 98003 33330 8th Ave. S. MS-PC2/150 Michael Pearce WEYERHAEUSER RECOVERY www.drs.wang.com Fax (508) 967-0594 (508) 967-2690 Locations B: 2nd Lowell, MA 01852 155 Merrimack Street Francis A. Ascolillo WANG LABORATORIES, INC. Company SERVICES EXHIBIT 2 “1997 Alternate Site Survey” ©1997 Disaster Recovery Journal. Used with Permission. Site Survey” ©1997 Disaster Recovery Journal. “1997 Alternate AtraeSts(continued) Sites —Alternate Philadelphia, PA Seattle, WA Mobile Recovery Billerica, MA power source? 5B attle, Chicago planned for Se- Dallas and City, Herndron, ton, Salt Lake Centers at: Bos- e Mainframe: IBM; Yes Remotely Yes Computers & Midrange Host Mainframe HP—all, DEC Midrange IBM, 3380, 3490, 200GS ADUis aeDie Front-end Tape Drives DASD Units SSA DASD 3480, 3490, 3420, 3480, and 3590 drives PC tape DLTs and mm, 4mm, 7348, 8 3490, 7208, 3720, 3725, Multiple T1 3174, 3721 Processors 3745, 3172 aaLnsVoice Data Lines Dial, 56K, T1, satellite switches ISDN and Lines 0 Mini- 200 60 Hours Testing Annual of 48 mum oYes—raised No Yes— Site Mobile site mobile feet per 600 sq. Yes—(mo- odSt Office Work Cold Site ty connectivi- satellite mote and curity, re- premise se- trols, ment con- environ- generators, UPS, diesel ery centers) bile recov- curity premise se- systems, sprinkler controls, vironmental erators, en- diesel gen- floor, UPS, Yes—PCs Yes—from Space phones 200 tele- required; as terminals and dumb telephones number of unit, same PCs per MRC, 16–50 ers per 16 to 50 us- LAN recovery, survival commu- en- 24 hour set up, local office ning nications, contingency plan- vironment Other Services

Philip Jan Rothstein, FBCI, is president of Rothstein Associates Inc., a management consultancy focusing on business continuity and disaster recovery (203.740.7400; www.rothstein.com; e-mail [email protected]). Mr. Rothstein is editor of the book Disaster Recovery Testing: Exercising Your Contingency Plan and publisher of The Rothstein Catalog on Disaster Recovery, the industry’s principal resource for books, videos, and software tools. He was elected Fellow, Business Continuity Institute in 1994 in recognition of his substantial contributions to the business continuity industry.