Business Continuity and Disaster Recovery Plans
Solution 1:
This type of consulting work is hard to evaluate. Building recommendations is a very, very political process as the consultant has to work across competing demands from different departments, and still stay within a budget. Or if it's the type of engagement where "money is no object," balancing just how high the sky can go before the client is likely to scream, or worse, ignore the final report. It is very personality dependent, and therefore exceedingly hard to pick a firm from a pack of them.
Things you really need to have a solid grasp on before getting quotes from companies:
- A good grasp on which business processes are critical for your business.
- To every department, their services/data are critical to the running of the company and will ask it be in the BC system.
- With few exceptions, you can't afford to have everything in the BC system.
- Nebulous targets ("all email must be available") can be useful for consultants, just as specifics ("The main web page must not be down for more than 30 minutes").
- A good grasp on how long you can be without certain types of service.
- Everything needs to be in the DR system, but how long it takes to recover that service changes the cost.
- Most departments will ask for immediate or 4 hour recovery, chances are good you can't afford that for everyone.
- An idea about how much you're willing to invest.
- The sky can quite literally be the limit when it comes to these costs. Geographically redundant datacenters linked with differing-path datalinks and fully replicated services (and so on) gets expensive.
A good consultancy will be able to guide you through some of these negotiations, but having a grasp on the basics before they arrive will simplify their task. At some point the horse-trading of departmental needs vs budget will come into play, and there isn't a whole lot a consultant can do for that other than voice their opinion when asked.
Once decisions about criticality, acceptable business outages, and cost have been settled, getting down to the brass tacks of exactly how to do it all can come into play. This is where the technical merits of a consultant can really shine. Once things get to this stage, changing the plans (someone convinces a Power That Is that their service really is critical and needs to be in the top tier BC systems) can be excruciatingly expensive in terms of change orders and knock-on effect.
This is the kind of engagement that's likely to involve talking to every manager in the company, everything from the C-level decision-makers to line-managers with five direct-reports. If you don't have a good grasp on your business processes, they'll have to do it for you. Have that, and they'll undoubtedly help you refine it along the way (which is a lot cheaper than making it out of whole cloth!).
You need someone who is skilled in talking to upper management as well as familiar with the challenges that BC/DR system face in organizations your size. How well your business management gets along (for it is business management not technical management that defines what gets in the BC systems) will determine just how skilled the consultant you hire needs to be. This is a very hard thing to judge, so look at past clients and industry peers.
Solution 2:
BC\DR plans need to start with the why, not the what. Have you determined the business requirements yet? If not, then my suggestion would be to start there first.