Just 1 DOD megacenter has an acceptable disaster plan
Connecting state and local government leaders
Should a disaster strike one of the Defense Department's data processing megacenters tomorrow, chances are good that its customers would suffer serious disruptions in computer service. The 16 megacenters, which process administrative applications such as payroll, accounting and logistics for all of DOD, are supposed to have disaster recovery plans, or DRPs, that ensure seamless continuity of service through backup facilities in the event of massive system failure.
Should a disaster strike one of the Defense Department's data
processing megacenters tomorrow, chances are good that its customers would suffer serious
disruptions in computer service.
The 16 megacenters, which process administrative applications such as payroll,
accounting and logistics for all of DOD, are supposed to have disaster recovery plans, or
DRPs, that ensure seamless continuity of service through backup facilities in the event of
massive system failure.
The Defense Information Systems Agency, which manages the Defense megacenters (DMCs),
conducted DRP evaluations at the centers in September. Documents from the evaluations,
sent anonymously to GCN, indicate that only one of the centers passed the readiness tests.
The documents show that most did not reach 50 percent of the desired disaster readiness.
"DISA's 16 DMCs have had over one year to get their DRPs created, updated to
include migrating legacy sites, and tested," read an unsigned memo accompanying the
documents. "Obviously, there is still some distance to go. DISA headquarters staff do
not appear to be concerned. Hopefully the DRPs will not be needed any time soon!"
DISA officials and the directors of several megacenters confirmed the authenticity of
the documents, which rate each megacenter's DRP against a nine-chapter evaluation guide
and assign an overall percentage score.
DISA officials "evaluated each megacenter based on the draft disaster recovery
plan they submitted," according to an agency statement responding to a reporter's
questions. "Based on these evaluations, DISA has initiated cross-leveling activities
and is looking at shared capacity, and is working closely with the megacenters as they
improve and refine their disaster recovery plans to meet DISA standards."
DISA officials also said they distributed a contingency management manual in June that
the centers "are using as a guide in improving their individual disaster recovery
plans."
According to the evaluation documents, the megacenter at Robins Air Force Base, Ga.,
was the only one to score above the 70 percentile minimum for an "acceptable,
executable DMC DRP." The Oklahoma City center had the next best score with 69
percent, followed by Rock Island, Ill. at 55 percent. Every other center scored under 40
percent.
Sources at several of the processing sites, all of whom declined to be identified, said
existing DRPs are a hodge-podge of dissimilar plans, parts of which were inherited from
the years before DISA consolidated hundreds of data processing centers run by the military
services into the 16 megacenters.
The plans include contracts with vendors that provide diaster recovery services and
also "reciprocal agreements" between two centers whereby each agrees to take on
a certain level of processing for the other in an emergency.
The problem with the exchange arrangements, the sources said, is that no one center has
the excess capacity necessary to take on more than a fraction of another's processing
load. So only the highest-priority processing would continue if a disaster halted a
center's operations.
Last June, DISA opened its Continuity of Operations and Test Facility in Slidell, La.,
which is supposed to be capable of taking on the entire processing load of any one center.
But sources said the Slidell facility has only limited functions up and running yet. Plus,
most centers still must integrate their DRPs with the new center.
"We haven't tested any of our plans with Slidell," one megacenter director
said."The first DMC was supposed to test its plans with Slidell this month, but it
wasn't us," he added.
The problem appears to concern Congress. In its report on the 1996 Defense
appropriations bill, the House Appropriations Committee pointed out that "the Defense
Information Systems Agency requested no funds for continuity of operations."
The committee consequently ordered DISA to spend $16.5 million on the problem in 1996.
That recommendation remained in the final version of the bill now awaiting passage by the
full Congress.
Asked why they had not requested funding for continuity of operations, agency officials
said that "DISA, as a matter of policy, does not discuss internal budget
issues."
Congressional interest in the matter might not be entirely altruistic, however. Slidell
happens to be in the home district of Rep. Bob Livingston (R-La.), chairman of the House
Appropriations Committee. In the same appropriations bill, Livingston's committee also
ordered the Navy to spend $18 million in unrequested funding on the Navy Standard
Integrated Personnel System under development in nearby New Orleans.
NEXT STORY: Web projects revive debate over data sales