Disaster planning and recovery—once thought of simply as “backing-up data”—has taken on new meaning in the post-9/11 world. Enterprises took notice that several large financial institutions and other World Trade Center customers were able to quickly resume operations following the terrorist attacks, thanks to having outsourced their IT needs. While backing-up data at alternate locations is still an integral part of any disaster-recovery (DR) plan, these organizations learned that, by having outsourced their DR functions, they could focus their energies after the attacks on their core competencies, and allow their outsourcing vendors to restore data and infrastructure destroyed by the disaster.

Another disaster once again focused attention on DR functions. The devastating toll of the tsunami in India and Southeast Asia at the end of last year shook the confidence of many companies outsourcing work to that part of the world. The city of Chennai, considered to be a safe location in India far removed from the Pakistani conflict and used by many of the large outsourcing vendors as a DR facility for their Mumbai and Bangalore operations, was, ironically, the only major offshore outsourcing center hit by the tsunami’s waves. Although reports from Chennai and the surrounding region show very minimal disruption of the operations of outsourcing companies located there, the seemingly close call only underscored the necessity for businesses that send work offshore to ensure that their offshore vendors have robust DR plans in place.

So, imagine a customer’s surprise when, after pulling its offshore outsourcing contract down from a shelf and blowing off the accumulated dust, it finds out that the contract contains no provisions relating to DR. What’s a customer to do? Rest assured, all is not lost. In fact, whether or not the customer knows it, its offshore vendor most likely has its own DR plan in place as part of its internal business-continuity plan (BCP), if for no better reason than to ensure that it doesn’t breach its contracts with its customers by not being able to deliver services. Therefore, the real issues for a customer with no DR provision in its offshore contract are whether its vendor’s DR plan is sufficient to protect the customer’s interest and how to amend the contract to obligate the vendor to provide DR services in the event of a disaster.

Assessing The Customer’s Needs

Before a customer is able to assess whether its interests are sufficiently protected by the offshore outsourcing vendor’s DR plan, and to the extent it already hasn’t done so, a customer must first examine exactly what is being outsourced and establish its own requirements for DR. The strengths of a DR plan will largely be established by assigning priorities to those outsourced business functions and processes into three categories: mission-critical, important, and less important. The planning process should entail:

In essence, any DR plan should include off-site backups and stopgap computer-operating capability. Off-site backup centers are usually categorized as either “cold” or “hot.” A cold site consists only of office space and furniture, where computer equipment can be brought in on short notice and operations can resume following a disaster. A hot site, which is more costly, is one where auxiliary computers are in place and an organization’s data and electronic assets are being replicated (or “mirrored”) and saved in real-time. This maximizes emergency preparedness and reduces potential interruptions in services during or following any disaster that disables or destroys the customer’s main offices. The hot site will be better suited for those outsourced business functions or processes in which no (or minimal) downtime can be tolerated. On the other hand, a cold site may be better suited for the functions and processes where a brief period of downtime can be tolerated without causing the organization significant losses.

Particularly important in offshore transactions is the consideration of the geographic location for placement of DR plans, which must necessarily contemplate the disaster risks associated with that location. For example, does India’s close proximity to central Asia and its longstanding conflict with Pakistan create a risk of terrorist activity against American interests there? Disasters—whether natural or man-made—are often unpredictable, but a careful risk analysis of particular markets can help steer an organization’s decision toward or away from a particular location for its DR vendor. After a final consideration of all pros and cons for a particular geographic location, a customer must determine whether the overseas infrastructure has the necessary resilience to cope with the kinds of disasters contemplated in its well-thought-out DR plan.

Negotiating DR Issues

Once a customer has established its own DR requirements, it must then open the channels with its offshore vendor and discuss an amendment to the contract to implement a DR plan. At this point, the most important issue will be to determine the extent to which the vendor’s DR plan differs from the DR plan established by the customer.

It is possible that the vendor’s DR plan may conflict with or frustrate the customer’s plans, either in form or in execution. Almost all vendors will be willing to sit down with their customers and discuss alternatives for implementing a binding DR plan, but in situations where the customer asks for deviations from a plan that the vendor has been following to date, the vendor’s implementation of such deviations may come at a cost to the customer, especially if such deviations require the acquisition of additional head count, technology, and/or facilities. In that instance, the customer must then weigh that cost against the risks such deviations are intended to mitigate and decide whether to move forward with their implementation. In situations where the customer is willing to accept the vendor’s current DR plan, the parties could agree that the vendor’s DR plan will become the customer’s de facto plan, with the condition that the customer receive ample notice of (and possible veto power over) any proposed changes to the vendor’s plans.

Regardless of the DR plan chosen, the parties will also need to tie the vendor’s compliance with the DR plan to the force majeure clause in the contract. Force majeure is generally defined as an event, unanticipated by and out of the control of the parties, which delays or prevents a party from performing its obligations under the contract. The types of events covered by a typical force majeure clause include acts of God (floods, earthquakes, fire) as well as the actions of third parties outside of the parties’ control (war, strikes, and riots). A party is typically excused (without liability to the other party) from the performance of those obligations that are delayed or prevented by a force majeure event. The effect of most force majeure clauses is to protect the vendor from the occurrence of a disaster since, in most circumstances, the only obligation the customer would have under the contract would be to pay for the services provided by the vendor.

The inclusion of a force majeure clause may seem counterintuitive in light of the overall purpose of a DR plan: While the DR plan is intended to impose certain obligations on the vendor in the event of a disaster, the force majeure clause is intended to relieve the vendor of its obligations if a disaster occurs. To avoid this contradiction, the force majeure clause must be amended so that, notwithstanding the occurrence of a force majeure event relieving a party of its obligations, the vendor will assume certain obligations when such force majeure event occurs (in this instance, requiring the vendor to initiate the DR plan). For example, if a customer’s Indian call center is knocked offline by a typhoon, a typical force majeure clause may categorically relieve the vendor of any liability for the customer’s business losses. However, an amended force majeure clause will specify that the vendor must execute the DR plan agreed upon by the parties and will not be relieved of such obligation if it does not so execute; the vendor must follow the plan to avoid liability.

Conclusion

There is no doubt that a DR plan is a critical part of any outsourcing contract, especially a contract that involves sending work offshore. However, not having appropriate DR provisions in place does not always mean that the customer is out of luck if a disaster occurs. Furthermore, with appropriate DR analysis and open discussions with the outsourcing vendor, the odds are good that a customer can negotiate an appropriate amendment to its contract to address DR in a manner that both parties find acceptable.

Steve Semerdjian is an attorney in the Outsourcing Practice Group at Brown Raysman Millstein Felder & Steiner LLP in New York. He can be reached at ssemerdjian@brownraysman.com.