No 4: Flirt with disaster

Many organizations think they have a disaster recovery plan in place, only to find out too late it's inadequate. Or they think that simply backing up their data is enough, with no way to keep the biz running -- and the revenue flowing -- while they attempt to recover.

"You'd be surprised how much downtime happens -- as well as lost goodwill from clients and vendors -- when you lose your data," notes Dimitri Miaoulis, vice president of Baroan Technologies, which provides 24/7 tech support for small businesses. "Every business needs a continuity plan that describes how it will continue to function, not only with technology but mail, fax, deliveries, phone calls, where people go, and what do they do."

But simply having a plan isn't enough -- it needs to make sense in real-world situations, says John Biglin, CEO of Interphase Systems, a management and technology consultancy.

"We had one client, a multi-billion-dollar HR services company, with a disaster recovery manual four inches thick," Biglin says. "On its Exchange Server Configuration page, there was one sentence: 'See company intranet for the latest information.' If the network at their corporate headquarters went down, they'd be completely hosed."

Blank backup sets, crumbling storage media, and recovery plans that haven't been updated since 9/11 -- all are recipes for an even bigger disaster. Large firms may have a comprehensive continuity plan but fail to update it regularly or do dry runs to see if they actually can recover and keep operating, says Biglin.

"Even customers who have a plan rarely take the time to validate that it works," he adds. "Unless you've tested it and can show that it truly works, you don't have a plan."

No 5: Capture old knowledge (before it disappears)

Odds are you have at least some of your key business data written in an ancient computer language, locked away on old iron, or buried inside the brains of aging coders. You need to capture that knowledge and bring it into the service-oriented century, or have a staff of semi-retired COBOL programmers on hand to draw from.

"The biggest thing IT isn't doing is capturing the 'corporate knowledge/culture' that their retiring IT staff has," says Robert Rosen, CIO of a US government agency. "It's all the stuff not captured that will come back to bite IT when something fails and they say, 'Joe always knew how to do that.'"

It's not just the graybeards, says Venkat S. Devraj, co-founder and CTO of datacenter automation firm Stratavia. Everyone's day-to-day tasks need to be documented so that business processes continue to flow. "Otherwise, when an employee is on vacation, gets sick, is promoted, or leaves the company, the IP [intellectual property] is not available to get the job done with the same level of quality and predictability," he says.

The bigger, more important step: Become less dependent on aging code, says McFarlane, whose Nexaweb Advance software explores aging code, documents the business logic and rules embedded within it, and transforms it into a modern Java application that can be delivered over the Web.

"Enterprises must learn how to be less dependent on the shrinking number of folks who are well versed in the applications running the business like COBOL, PowerBuilder, and Oracle Forms," McFarlane says. "Most CIOs won't admit it, but not only do many of them not know how these applications work, they don't know if these applications work. All they know is they've got 30 million lines of COBOL code and no COBOL programmers, institutional knowledge, or documentation. They need to go in and liberate their intellectual property from the bowels of legacy systems."