So, I read a post on social media where a gentleman was asking if there was a risk management document out there that could be submitted to application owners, business owners and system admins who after a consultation decide not to purchase DR plans or backups? My first thought was, why yes there is! The courts call that document an Order for a Psychological Evaluation.
But all joking aside, I got to thinking that this guy had a good reason to ask. I’m going to guess that he was probably a hired consultant and advised his client that what they were currently using for their backup & disaster recovery wasn’t sufficient. But, after paying for and listening to his advice and after getting pricing from 3 different vendors, his client probably still decided to do nothing. Most likely leaving the business vulnerable to scams and ransomware attacks, with the possibility of holding the consultant accountable for the damage done. Yes! Please sign here now!
I can’t tell you how many times when we talk about options for backup & disaster recovery with prospective clients how many people never make the decision to purchase. Not from us. Not from our competitors. They simply decide that doing nothing is much better than making a huge mistake of possibly selecting the wrong solution or the wrong vendor or maybe paying too much. It’s FEAR at its best! And it’s not just in the technology industry. It’s human nature.
So how do you convince someone to do the right thing for their business or employer? Have you ever heard the old saying, “knowledge is power”? Well, it’s not really. Not for those who have it and don’t take action. Knowledge alone is fine but the only way to have power from that knowledge is to do something actionable with it.
So, suppose we had a formal document (like our consultant asked for) acknowledging that the client is not willing to do anything and is willing to accept the risk. Would it cause them possibly change their mind? Here’s an example:
Thank you for the opportunity for ABC Company to help XYZ Company find a solution to address your concern over your current disaster recovery strategy. We’ve found these vulnerabilities (list them) regarding your current backup & disaster recovery solution. The solution which we’ve recommended and outlined in page 1,2 & 3 would prevent you from losing your data, allow you to recover your data both locally or in the cloud & provide bi-coastal redundancy. That the proposed solution would minimize the damage from a disaster that could be catastrophic, to simply becoming a small hiccup in your day. We have both agreed that a solution like this would solve your problem however, you’ve decided not to move forward with a new solution. You acknowledge that by not doing this, that you are in danger of losing your data forever, and according to your stated recovery time and recovery point objectives, by not implementing a solution that your business could be forced to close its doors. You’re acknowledging that you’ve declined all options and will not hold ABC Company responsible for any and all data loss should you experience a disaster, whether from human error, malware, ransomware or natural disaster. You also acknowledge that once your data is gone, ABC company cannot assist in getting your data back.
Do you think maybe seeing it in writing (like the above example) would jolt people out of their fear & indecisiveness and compel them to take action? Would it make sense to do this even when you’re not being paid for your consultation? There are so many businesses who already, through compliance & regulatory regulations are forced to “do something” because not doing something usually comes with a stiff fine or a penalty. But for the companies who have been given the knowledge but are not forced to take action? What’s the penalty? Wouldn’t you believe that they could see that losing all of their data would be paying the ultimate penalty?
Knowledge alone is not power. Knowledge is power when you decide to take action. How would you convince someone to take action?
I’d love to hear your thoughts on this.