An empirical assessment of IT disaster risk

Disasters have historically been associated with catastrophic events such as floods,fires, hurricanes, or earthquakes, but recent computer failures, such as the air trafficsystem failure at Washington Center, have broadened the definition of disaster—asany event causing significant disruption to operations, thereby threatening businesssurvival [9] With the incentives of cost-efficiency and competition driving businessto place more critical information assets into automated systems and networks [4],the loss or denial of assets required for normal operations can have a catastrophicimpact on a firm’s bottom line [2]. Such disasters may involve the loss of integrity orreliability in a critical dataset or in the means by which data are transported, manip-ulated, or presented. As firms grow more dependent on uninterrupted information system function-ing, disaster recovery (DR) is receiving increasing attention, and a growing numberof organizations are beginning to engage in DR planning. In addition to cold sites,reciprocal agreements, and other services, DR vendors market a service known as “hotsites,” designed to provide standby computer resources in the event that one or moresubscribers require an alternative computer center to process critical applications.Companies pay steep monthly subscription fees for hot-site facilities, into whichcompany departments can move, literally overnight, if required [6]. This requirementis usually prompted by an actual or perceived event that could render the subscriber’scomputer systems inoperable. The activation of hot site service is initiated throughthe formal declaration of a disaster. The definition of disaster varies by client, withhot site providers generally allowing a broad interpretation of the term. For example,some vendor clients declare disasters in order to provide backup data processing capa-bility during a planned relocation of their data center.Despite the vital necessity of uninterrupted IT capability for most of today’sorganizations, few empirical studies provide practitioners and academicians with a