The Physical Side of DR_IR with Chris Loehr

Um, all right. Welcome everybody. Happy Monday. I know it is. Um, let's see. Tracy was sharing Thanksgiving in Canada and Columbus Day here, and there's a lot going on all over. I guess PAX eight or is going on, I don't know how many people are over there right now with that. Um, Tracy's been over in the, uh, over in, in Europe driving McLaren's, so it's good to have her back. Tracy, what was that like? Uh, to be fair, I didn't drive one this time, but I have driven one and they're stunning.

I highly recommend if you have more money than you know what to do with, you should consider, uh, an UR And that, and that's why we have Chris la on with us today. Right. Ooh, Just gonna walk away from that one, Chris, and let you, uh, consider that You just remember the joke about McLaren is you get to drive him for one month and then they're in the shop for one month, and then you get to drive em for one month and they're in the shop for one month. So that's how it goes with the clearance.

Good story. Um, alright. Um, I'll let some people, you know, give it ano another minute or two, and hopefully people, people will trickle in here as, as, like I said, it holiday, holiday days in multiple areas. But, um, I, I wanted to, while, while we're, uh, getting people coming on in, um, uh, talk a little bit about why we're doing today. Um, I was on the phone with Chris this weekend, and I shouldn't say Chris. We were more texting each other. That's Right. And you're in your condition.

Yeah, Yeah. Yeah. I, I didn't have power until late yesterday. Speaking of natural disasters, three feet of water, I had a chainsaw my way out the driveway, uh, from Hurricane Milton and, um, no power for I guess four or five days.

Um, so, uh, uh, you know, it's, um, this, you know, after having Kemper on last week, and you know, now what we went through just now and what he went through, or not even comparable, but it, when I started texting Chris, I'm like, Chris, you know, the natural disaster, the physical side of ir and Dr. Um, you know, my sense is a lot of the things that, you know, you wouldn't even think about get over, you know, these are overlooked items until it happens.

Like Kemper said last week, you know, we were pretty diligent in our tabletops and planning and everything, and we never thought we would, who would think we'd lose cell coverage? Um, and here he is not being able to speak to his team, not knowing if they're even alive for five to six days, let alone us typically thinking about a disaster, you know, some kind of natural disaster, like a hurricane. Oh, you know, it, you know, you're not thinking are they alive or, uh, dead?

Um, but, you know, how are they doing? So, um, I thought it was, it was, uh, a timely topic considering what has gone on, at least here in Florida and, and, and parts of the, the southeast region, if you will. Um, so, so Tracy, just, I'm gonna talk to her out loud. So, Tracy, what's weird is with Restream, unlike Crowdcast, if you want to talk to people in chat Yep. Um, you have to go to the YouTube like you're watching. I can't in two screens. Okay. Yeah.

But if you wanna tell me in private chat who to say something to, I'm happy. Well, hi, Dagley, it's good to see you again. Yeah, you can speak away here. Uh, we're amongst friends. Great to see everybody. Great to see you Dagley.

Um, so that's, that's really the premise of today in setting the stage is that I, you know, I really, and, and Chris, I a, you know, you guys, I think most of you know him, I'll let him introduce himself, but, you know, he has this background in banking for years, banking and finance. Um, and you know, you, you know, when, when the pandemic hit and I'm like, Chris was like, yeah, we, we had pandemic, you know, um, uh, policy and we, we certainly, we talked about pandemic. Like really.

So, so it was, having Chris on, I think gonna be, give us a really good perspective because the banking and financial systems have to take into account, obviously critical infrastructure, natural disasters. Um, we as MSPs, I think today get really myopically focused, um, and, and rightly so on cyber for IR and dr. Um, but, uh, this, like I said, this last few weeks has brought this topic up, which I thought was relevant.

So with that, let me just make one final announcement that thanks to folks like Tracy and Net and many vendors and MSPs, we have raised over $55,000 for Kemper and the 60 employees at electronic office. Um, I'll put the URL in still. Um, as you guys know, 60 people and 60 thou a little under $60,000. Unfortunately doesn't go too far today, but it will make a a really, really big difference. Alright, so with that, um, we've got two amazing co-hosts today with Gary and Phyllis being out.

So before we get to our main host, Tracy, uh, let you introduce yourself, go to net and then we'll go to Chris. But Tracy, thanks for filling in as a co-host today. Uh, for those that don't know you, please, uh, share a little about yourself. All right. So for anyone that doesn't know me, Tracy Risco, I'm currently, uh, I lead the community and sales development divisions over at Huntress.

The biggest goal that I have in the industry is to ensure growth on all levels, whether that is staff, MSPs, vendors, individuals. My goal is to make sure that everything we do does the boats and the tides and the raising waters thing that I never get. Right. So I'm here today making sure that I have the ability to help you guys with that. Yeah.

And uh, I was in full disclosure when Tracy was on last week, I reached out to Andrew Kaiser, who I've known since open DNS days, back before even Cisco owned, uh, open DNS like Kaiser. I'm like, Tracy is a natural, I gotta have her back. So thank you for coming back on, uh, Tracy net. Awesome to see you. Um, and, uh, tell us a little about yourself. So, hi everybody. Net Lynch, um, I'm the CISO at Crafting Kennedy. We're an MSP that focuses on the legal vertical.

And right now I'm focusing on internal security at Kraft Kennedy. And I've been in the client strategy space for the last 17 years since I opened an MSP 17 years ago. And, um, been in cybersecurity, I guess the last, uh, had to put a number on it, maybe 10 years when, you know, EDR started becoming, uh, something that we needed to offer to our clients. Um, and, uh, spent a lot of time as VCIO and vcso.

So I've spent a lot of time advising clients and understanding the perspective of clients, what's important to them, and what their obstacles are, uh, in the realm of IT infrastructure and cybersecurity. Very cool. Thanks for joining Nat. Thanks. Really appreciate you filling in as well. So, Chris, guest of the day, everybody knows you, but some may not. So just a quick intro. Yeah. Thanks Andrew. So, Chris Lair, solace security based in Austin. We are in A-M-M-S-S-P and incident response firm.

Uh, been around for about 21 years. We used to have an MSP side of our business. Um, we divested that off about five years ago and we purely focus on security now. Uh, we actually are, um, owned by the same company who owns CFC, which is a large, um, insurance carrier, mainly focused on cyber, but they also do other policies, uh, as well. Uh, and happy to be here and talk about disaster recovery this time around versus incident response. Yeah. Awesome.

Uh, Chris, while we, while I hand it over to Nat to kick things off, you know, I know, just interesting, your last statement is there, is there areas that were, you know, d you know, natural disasters though, do cross over into ir, you know, because you have threat actors taking advantage of, you know, the situations? Well, it's, it's interesting.

I remember one of our earliest cases, we had a, uh, it was a law firm down in the New Orleans area, and this was, um, they had, this was a couple years after Katrina, but they had gone through all that with Katrina, right? And so, so they had a pretty robust disaster recovery plan in place. They had an offsite, everything was replicated and all that type of stuff. And they got hit with ransomware and they were completely down.

And this was the, you know, one of our first cases, so this was the early days of ransomware, but one of the things that, uh, happened was, I remember that during that situation, their, I, they had a third party IT provider and the guy's like, Hey, I'm gonna, I'm gonna drive over there, get your servers, put 'em on a plane and fly 'em over to New Orleans. And, uh, 'cause they were a couple of states over is where they had their DR site and the owner said, Nope, nope, nope.

Wait, wait, wait, wait. We don't wanna do that because that is our only copy of data at this point. Right? So it was, it was kind of an interesting deal where from an IT mentality, it was like, recover, recover, recover. But the owner's like, no, the last thing I wanna do is put the only copy of my data on an airplane and have something happen to it. You know? Hmm. For whatever reason, right? So they intersect in different ways. I mean, and you can't ignore one without the other.

So you can't do disaster recovery without thinking about security and instant response. 'cause we, that was one thing that was always an easy thing to pick on in disaster recovery tests. People would restore their systems, but they wouldn't necessarily go through the process of locking them down so they were wide open when they restored 'em at an offsite or whatever the case. 'cause they were just focused on getting systems up and, and not making sure they're secure.

Um, at the same time when there's a lot of things that you can take advantage of in instant response with a DR plan. So you don't have, you can reference parts of a DR plan and you can do things like that if you do need to recover and so on and so forth. So you don't need to duplicate and you wanna make sure they don't conflict a as well, so not spend too much time on it, but they are, they are related, uh, in their importance in, in everything of that nature.

But, um, a lot of it does come down to the risk, right? So where you're located, there's a huge risk of natural disaster, uh, versus someone that's inland. So, for example, the bank I worked at was located, headquartered in, in Laredo, Texas, and we had a tremendous amount of branches up and down the Texas coastline. And a, a lot of those branches, whether they were facing the water or enough, they were in the path of a hurricane, or at least the strongest part of a tropical storm.

Once it met land, usually once it got to, right before it got to San Antonio, it really just died off. Meaning it was still a storm, but it wasn't anything that was a threat. That's what I mean by what is the true risk. So that's where you gotta think about where you're located, especially in today's world where your remote people are located. I mean, things change, but you gotta, it's just not a universal thing.

You gotta be thinking about the risk to you and your organization to your people more so with disaster recovery than you do instant response. Got it. Alright, miss Nat, over to you. Yeah, so, um, it's interesting.

I've been thinking about this topic and, and having advised so many clients throughout the years and, um, before, um, ransomware really became a thing and we shifted to ir, I was primarily having conversations around DR and, you know, what if, you know, there was fire flood to your building, that kind of conversation. So at that point, having backups that were not only local, but in the cloud for a lot of clients that was new.

And being able to spin up your instance in the cloud, not having to download the whole thing, that became, you know, very important to a lot of clients who were thinking along those lines. And to Chris's point, the clients who were in zones that had a greater likelihood of, you know, flooding from natural disasters, et cetera, they loved that idea.

They loved, you know, even if, you know, something happens to all of our equipment here, our building our stuff is still in the cloud and we can spin it up. We don't have to wait for a new server to come in to do a bare metal restore.

Um, and then when ransomware came into the picture and we started shifting to IR plans, I think it was too much for a lot of clients to think DR and ir, I think it was just, I couldn't do one, like in their brains, I can align one, but doing two unless if it's required, unless it's regulated, unless if they're big enough and they have that operational maturity that they can do that most SMBs could do one or the other.

And, and IR just took, uh, um, priority just because it was so much more likely in their minds than fire, flood, hurricane, et cetera. So we, we made that shift and that's, you know, we went where the market was going, which was IR planning, and there's a little bit of DR that goes into IR planning, but it's definitely not to the same level. It doesn't include all the physical stuff. Um, but there are a lot of similar components to it. Very cool. Very cool.

So did you, um, by the way, Ned, do you have the, um, agenda? I'm sorry to put you on the spot here. I, I, uh, yeah. Okay. I just wanted, so you're just kind of level setting for us. Got it. Perfect. Okay. All right. Did you want me to cover something else? Sorry. Oh, yeah. So you are the, you're first up asking Chris questions, see where it says net dash, Chris? Yes. Gotcha. My bad. Um, Explaining That better. Sorry to put you there. No worries, no worries.

Um, can you give us some insights on why large financial, financial institutions plan for natural disasters, pandemic's catastrophic events that most organizations never consider in their DR plans for Chris? Yeah. So I would say that, yeah, I would say that, um, it's all financial institutions and, and first of all, they're required to do so, uh, regulatory wise. So that's, that's a big reason. Uh, but why is that?

It's because obviously they are considered critical from the fact that they have people's money. And, um, so it's interesting when, when, uh, when I work for a bank in Oklahoma City, we had 50 locations across the state. And I remember when we were planning out our DR scenario, our COO at the time was like, I want the scenario to be the entire state of Oklahoma freezes over. And I'm like, that's stupid, that's not gonna happen. And guess what? That winter it did happen.

The entire state froze over. It was crazy. Uh, and so we had to do Dr uh, around that. When I moved down at, and that bank got acquired by the bank that I worked for, when I moved down a lot more than that, we were less concerned about freezing, and we were more concerned about the other types of weather events or that type of thing. And, and so it was really important to understand not only where our lo locations were, what our customer's needs were.

So, for example, because we were a border bank from that perspective, that that's a much more cash centric society to put it that way. Uh, people there go to the bank every day and deposit cash, and they do that type of thing. So having access to cash and being able to do those types of things was much different than what we had up, up in Oklahoma where they weren't so cash centric.

Uh, so I mean, there's some legitimate reasons why, uh, banks need to do it because you, most of the time people are first gonna worry about their health and life, and those things are incredibly important. The second thing is they're gonna worry about money, and the government knows that the banks are, are what's there to do that.

So for us, having our plan together and being able to respond and for example, get ATMs up and running as quick as possible, uh, even though there's not a lot of people around was, was incredibly paramount and important. Ned, can I pop in there real quick?

But Chris, obviously for banks, money's important, but you there, you know, one of the thing Kember mentioned is paying his people like, you know, that was a natural disaster, but like, you know, I, I'm, I'm curious your thoughts on that, Chris, but then net your thoughts on, you know, you know, translating, like, you know this with a customer, you know, how do you get them to care? How do you get them to spend money on increasing their po broadening policy, you know, table topping.

But that, that makes sense, Chris, like, you know, yeah, It does, it does make sense. So it's, it's interesting because in the banking world, we could not afford to not process at night, right? So that was like a, that was like something that was, could be incredibly financially punitive to your institution if you couldn't process items and do all the things that you need to do overnight.

You have to worry about customer's balances being incorrect because they made a deposit, but you didn't process and deposit didn't go through. I mean, there's a bunch of things that we could take two or three hours talking about banking to do, but one of those obviously is payroll, right? And so you have to process payroll, and that's, you know, either, and that's usually done through most of the time through aach h or wire. And so you gotta, you gotta be able to process that type of stuff.

And so when you're talk, you know, for customers, they need to know, Hey, we need to pay our people. Well, it's not like the old days where you could just have envelopes of cash ready to go. They could just come pick it up and take off. I mean, it's gotta be electronically transmitted in their account and accessible.

And so, like, if, if none of that stuff works, or if it's a hiccup even for a day, uh, a banking day, a banking evening, whatever you wanna call it, I mean, the ripple effect is, is terrible. Mm-hmm. So, I mean, and the bigger the bank you are, the worse it gets. So, um, you know, that's what I can kind of explain on that type of stuff.

So all of those functions are incredibly important and key, um, because when you come back from disaster, you don't wanna have to be dealing with all that stuff. You want that kind of the critical stuff that that can, can touch upon. You just want that to, to happen. And then all the other stuff is the stuff you get to worry about. And, and that, like, for the SMB, you know, it's like, like Gary says, he's like, you know, cybersecurity is not important until it is, right?

It is same with paying your people, right? So how do you, I don't know, how do you, you know, thread that needle to say, look, you know, you are in a, you're in an area that's inclined to natural, like, you know, you're in Carolina, right? That, you know, so there is chance of storms and, you know, taking people offline and stuff, but how do, how do you weave that? So it, um, first I'm gonna tell you what not to do, Probably what I just did. No, no, no, no, no.

And, and I say this because I've heard quite a few, um, MSPs do it this way. And they use fud, fear, uncertainty, and doubt, and they create that fear. What if you can't pay your people? And in that moment, your client would respond, but when they walk away after the meeting is over, it gives them an icky feeling. So they don't wanna come back to that conversation. They don't wanna continue talking about this because they didn't feel good about that conversation.

Hmm, it works, but only in the moment, and it could damage your relationship. Don't use fud. Instead, storytelling. Instead tell them, um, a story about an organization that's similar to theirs and what they went through. And you tell them, I'm, I wanna tell you this story so that I can educate you on what a similar organization went through, and maybe we can pick up some pieces that they left behind that put them in not a great situation. So let's learn from their mistakes. Got it.

And clients generally respond to that Really good stuff. Yeah. I'm, I'm all for keeping the FUD out of it, so, absolutely. All right. Na, back to you. All right, Chris, when you think of natural disasters, whether it's hurricanes, earthquakes, wildfires, what's the first thing business owners need to consider about protecting their critical infrastructure? Yeah, I think in today's world, that's a great question.

So in today's world around critical infrastructure, and you, you touched upon it earlier with cloud backups, we're kind of, you know, early in, in the, in the thought, but today's world, it's much more easy, easy to distribute your critical infrastructure. So it's not all sitting in one place. And I think that's the most important thing, is to understand what those moving pieces are.

And if there is just this central point of, uh, of weakness that a natural disaster could totally, um, you know, wreck it. And so that, that was, that was always key, you know, in the banking world with so much integration and so many systems and, and, and we hosted everything.

And so for us, that was a different story back then because we, we had everything in one place as far as the primary, and we had to make sure from a critical piece, everything else was in a secondary location, and it was kind of out of the deal.

I mean, one of the, a good example that I would bring about this back to this risk thing is I remember years ago, uh, in Austin, and uh, they probably still do this, but Dell would bring in, you know, CIOs, CTOs or whatever to, for a few days in Austin, and then they would take you to the campus and meet, have you meet with different groups just to see what happens behind the scenes at Dell.

And they used to describe their disaster recovery and what they would do, and they would flip over from one side to another midway through the year, and then flip back and flipping back was always the hardest part. But one of the things that they had brought up is everybody always thinks about, Hey, you need to be, you know, 200 miles away, it was all this kind of thing.

Well, of course they had the, the resources to do this, but they ran their own risk analysis and found out that it was no difference being 30 miles away than it was 200 miles away from a risk perspective. So they were able to take that data, provide that data to their insurance carriers improved, and then so they could have a disaster recovery center a lot closer, but they had to do the risk analysis to do that.

So the same thing with business owners today is you gotta understand your critical infrastructure, where it's at, what's needed, what, what, what are the dependencies, which we talked a few weeks ago about bis and how all that stuff is structured in A BIA and documented in A BIA and then figuring out where all that stuff is so you can, you can plan accordingly and kind of understand the risk associated with that critical infrastructure.

Chris, I'm glad you said that three letter word, um, because that is that, you know, aside from stories, is that kind of the crux of how you're driving like their, their, the, the business side of this whole thing? Because that, again, the business owner can't tie the, really can't correlate what our, we, we correlate zeros and ones most business owners don't.

So that, that is, that is that kind of your rock coming back to, you know, what, what it means to their business applications, their revenue, um, you know, SLAs, contracts, things like that. Absolutely. So the stories are to get that, get their buy-in. Once you have their buy-in, then you need to, um, build out, um, what your plan is gonna be. Your BIA, you know, you need to have an inventory, all the typical things that we always talk about.

But yes, absolutely you have to talk about business outcomes. If you're talking about tech, you're gonna lose them. Mm-hmm. Yeah. You had all their buy-in and it's yours to lose. You start talking tech, they're gone, they're gonna glaze over, they're not interested in tech, they want you to solve business problems. Their business problem is what do I do in a disaster situation? Yep. And how is it gonna impact my business, my clients reputation, whatever, whatever, whatever SLAs.

So you can, Right. And also you have to keep in mind what are your clients' obligations to their clients? How are you going to keep their business running so they can maintain what they've, uh, promised to their clients? So it's not just between you, the SP and the client, when you're thinking about from a business perspective, you have to think like that business owner put their head on your head, not just their hat, their entire head. That, that everything.

That's why I thought what Brian Blakely said about looking at their contract, you know, your contract with them, like their specific language in there of why they said you need to do this. 'cause they're thinking about their biggest clients, right. And that they're like their contractual obligations. Absolutely. And you have you as their strategic advisor, whatever your title is, if you're giving them any type of advice you need to understand their business inside and out. Yeah.

You need to understand everything that would keep up, um, that keep them up at night. Yep, absolutely. And they might not even know what that is yet. That's what you got. Exactly. That's why you facilitate that ask open-end questions. I mean, it's very similar to anything else you're trying to learn about the client. Sometimes they have to discover things about themselves as well through that process that you're gonna facilitate for them. Absolutely.

I say this all the time, you know, many people start a business because they're passionate about something or they're good at something and then they start running the business and they're like, oh crap, I need to learn accounting and marketing and sales, and I don't, you know, all this stuff. So it's the same thing, you know, we need to understand where they're strong in all of those areas and where they're weak in all of those areas. Because to your point, Chris, they may not know.

They don't know what they don't know. And that's part of what we do as their partner is to help them guide them through that, that situation. Yeah. Awesome. Alright, Ned, Ned, I think you just described my business in a nutshell. Passionate, interested, did a thing, had to learn all the stuff afterwards. Yes. I think about most of us who have opened businesses at one point or another, we've all lived through that. Yes.

It's the cla well, again, the book, the e myth, if you, if you haven't read it, read it, it's probably the, i I think arguably one of the best books ever written for business, because that is the most business owners in our space. Right. Revisited by Michael Gerber. Do you wanna pop that in the chat, Andrew? Sure. Probably a great way for us to maybe pick a peek if we haven't read it yet. Yeah, absolutely. I'll put it in.

Uh, and by the way, um, Tim, this is not a, uh, phishing URL, just so you know from that. I was Gonna go there next. You've just ruined it for Me. Uh, okay. Alright, next question. Chris, how does a natural disaster typically disrupt a business's access to critical applications and data? And why is it such a challenge to get it back up and running quickly? I think access is the key right there.

We, we all assume that people are gonna just be, you know, a lot of people, hey, I've seen a lot of times where systems are available and the people aren't. And so that's what a lot of people miss out on. And in our world of security where we're like, Hey, you know, lease common, or I mean, lease access is really important, right? So then we find out natural disasters that we may have to make some changes with who has access to what at, at certain times and those types of things.

And people learn that dark way. So I think the biggest thing is how are we gonna access these systems and are all the moving parts in these systems available for us? And do we have the people that know what to do in those particular situations?

So, you know, earlier it was brought up payroll, and I think payroll is the best and probably most fundamental example is, you know, in your organization you may have one, two, maybe three people that know how to process payroll or pieces of payroll, but you know, how well do they know that? And how well does that work in a situation where they don't have access? And I just know with, with having access to different bank accounts with different banks, MFA is different.

How, how you authorize transactions, all that stuff changes, all those types of things. You can just, if you just took payroll and started to decompose it into the, its little pieces and kind of understand it, that's like the easiest example to use to say, oh wow, I didn't really realize that.

You know, even though it's somewhat of a simple process in a natural disaster situation, it could be broke because this person's not available, or they might be partially available or the primary person's available, but the person who needs to do the secondary authorization is not available. So those are the things you gotta be thinking about in today's world because most people's in critical infrastructure is in the cloud for the most part.

And for those that are, are on prem, I still don't think everything's on-prem. Uh, but the same kind of process and same thought, I think the people is, is really kind of the, the part where people need to focus on the most Good stuff. What are some of the most common misconceptions business owners have about their DR plans and what are three blind spots that most people miss? I think one of the primary misconceptions about DR plans is that you can, you know, you can come up very quickly.

Sometimes that may be the case and sometimes it might not be. I mean, it's just that I think some people, no matter what you do and what you try and how much you rehearse, there's usually a wrinkle or a surprise in there. So people think, Hey, I'm, uh, you know, I'm gonna be able to be back up and running again, back on this issue with systems might be back up and running, but your people aren't back up and running. And so they, they miss that part.

And I think the other piece is, is, um, you know, there may be some, what I tell people is usually with natural disasters, people are more sympathetic. Right. You know, I mean, no one's gonna get mad at Andrew because he doesn't have power. I mean, that's just, that is what it is. I mean, you were Pretty mad at me this weekend, huh? Yeah, I know. Yeah. It was actually break. It was a break for all of us.

But anyway, the point, yeah, the point is, is that, um, is that a lot of people that, but you may have some customers, clients that have regulatory requirements because something doesn't happen or something doesn't get processed, or you yourself may have some of that too. So a lot of people don't realize that there could be some regulatory wrinkles or some legal wrinkles in there that they might have to deal with for, for being down.

But, um, I think it's, um, people just have a false sense of how quickly things can recover and how people can, when people can return to return to work, I think that's where they get things wrong. Chris, Just to throw something in there, you know, we, we think about, you know, getting our clients back up and running, but, um, if the Ms. P, you know, and, and we've done it, I have to say, you know, kudos to MSPs on the margin. We've done a really good job. I think in the last few years.

There hasn't been as many buffalo jumps, meaning RMMs getting taken over. But the, to that point, Chris, about bringing people up quickly, um, you know, Ryan Weeks in the first write of boom, did, and you were there, did a, a phenomenal, uh, session on, you know, Dr at scale and went through all these calculations.

And I can, if you guys are interested, I can send you the session, but went through, if you were an MSP and you were, your RMM was compromised and you know, you now your clients were, what does DR. Look like to get, you know, 10 clients, 20 clients, 30 clients? And he kind of extrapolated it out of the amount of time it would take and the fact that, you know, you go back and he's like, and now look at your contracts with your customers.

And when you say you could get them back up and running and they're virtually it, it's virtually impossible. So I, not to go down a whole rabbit hole about this, but it's, it's interesting that you use that first as a point about how quick we can get people up and running. And you probably see that though, on the IR side too, Chris, especially when people, uh, don't have, have not done a BIA and don't know what they wanna bring up first of all, first. No, that's right.

And you have to also have to worry about like how much of that person is available to you, right? So in IR and Dr, both you, I mean, people have x amount of time that they can give you. Um, so in dr it's even more so because in, in dr you're gonna have more, it's, it's more complex in my opinion. You, you people are gonna have more.

Just like we saw with the pandemic, we had people that had to deal with childcare or lack of childcare, we had to deal with school, remote school, all those types of things. You know, I had to deal with, um, maybe they had parents that they had to figure out, Hey, I do I need to bring them to the, to my house versus let them stay where they're at and all those types of things.

And so I can tell you, you know, the last, you know, I think the last year or so when I was at the bank, we spent a lot of time on this. I mean, we spent a lot of time on understanding our people who had kids who didn't have kids, how old their kids were, all those types of things kind of played a part in us figuring out, say, Hey, this person, the likelihood of them being available in this, these types of scenarios is low, medium, and high versus these other people.

And it made us really rethink things. And I think in the, the MSP world where the luxury of having 3,500 people, we have 10, 15, 20, 30 maybe up, you know, in the a hundred. But of that, there's that core group of people and understanding who can do what and for how much.

'cause you, you, in that example I share with you where the state froze over, I remember that what was cool about that was is we were calling the shots like the executives at that time were just watching and they were just letting us say, this is gonna be up, down, all this kind of stuff. And, and they listened. And my guys were, they thought they could outlast me, but they couldn't. But they, but but, but you, you had to be thinking about that.

And I can tell you no one was thinking about that at that time. I mean, people were just working, working, working, working, and people were just, you don't want 'em, you need 'em to come back to work the next day. So you can't work 'em to death either. So there's just so many things in a, in a natural disaster or a disaster recovery situation that you have to worry about from a people perspective.

You still gotta worry about from an ir, but d dr is much more involved and you gotta think about it in, in many different layers than you would ir It probably, and Tracy over to you. But it probably inform, probably if you did a good job on that, Dr. Chris, it would also inform some of your IR stuff because mm-hmm.

Like if you had a critical person, like you just mentioned, let's just say the person that's most critical, you know, running your ir you know, you all oftentimes Chris talk about what's the emotional capacity of that person, is that the right person? But then take it a step further, like, well, how many kids, like maybe you should start to think about how many kids do they have? Are they on site or offsite? Right? There's probably this, this can inform some of those decisions. No.

Was that for me? Sorry. Yes. Yeah. Oh, I was too busy paying attention to YouTube. Sorry. That's okay. Um, ask the question again real quick. Sorry. Yeah, I was just Saying that That was my, I Saying that your Dr some of these, you know, 'cause you were mentioning about the people Yep. Right. Can inform what your IR looks like. You know, the people that you thought should maybe run your IR and then you start looking at what their, you know, family situations like, et cetera. Yeah.

It's, it's interesting too because I think from an IR situation, emotions are different than dr. Um, it, it is just a weird deal. Like IR people, you need people that have some ability to contain their emotions, to think clearly. You know, they gotta be careful what they say a lot more than they in a, in a disaster situation, right? You get hit with ir, we've heard it a thousand times. An incident doesn't mean a breach, right? Don't use that term yet. A disaster's a disaster.

I mean, you get hit by a hurricane and get hit by a hurricane, there's nothing you can, there's nothing really you can say wrong besides, Hey, we got hit by a hurricane, our offices are down. So those types of things differ, right? You still need to be able to communicate in a hurricane situation. Uh, but there may be more, there's gonna be more communication around, just like you said earlier, where people are, are they able to check in? Are they alive?

You know, when will they be able to return to work? If they are able to return to work, will they have internet access? Will they have secure internet access? All those types of things play a part. One thing I think that the pandemic did for people was, and I know this for sure from smaller banks, is smaller banks rethought on who got laptops. So before the pandemic happened, they were pretty restrictive on who could have laptops. Mm-hmm.

Once the pandemic happened, they said, heck, we're all gonna outfit everybody with laptops 'cause we, one of those things hits, we don't have a problem. So the same kind of thing has to happen, but on the, on the natural disaster side, there's just similar, similar processes take place, but they just take place in different ways. Yeah. Like, again, just like the emotion communication, how you communicate who you communicate to ir it's gonna be super legal, heavy, dr not so much.

Um, but you may still have some legal issues to deal with there, just from a personnel perspective, you may have to start worrying about insurance and some other things that you didn't have to deal with in an IR situation. Different types of insurance and DR than you do with ir. So yeah, so you can't really, you may have different people playing different roles in DR than you do IR for those very reasons. Got it. So trace, as we go over you, I'm just gonna ask people to throw something in chat.

Have the, have these recent has a natural disaster. These recent ones made you rethink like just getting starlink and having some redundancy. I'm just, just curious, throw in chat a why for Yes and for no, it can be that simple. Uh, but Tracy, over to you. Absolutely. I love being on the second half of the cyber call, Andrew, because most of the time the chat questions have already come up to cover most of what I wanted to talk about.

So if you wanna scroll back through chat, we're gonna address some of the things like ley, you talked a little bit about not forgetting business continuity. And we've talked a lot five years ago, I don't think I could have told you the difference between disaster recovery and incident response, right? A lot of acronyms being thrown around and net. You talked about not talking tech. One of the things that I am really grateful about is that I actually can barely work my laptop or my iPhone.

For me talking business need is really valuable because I don't understand how to talk tech anyways. And so it, it leaves people a little bit disarmed when they chat with me. But Chris, it's, you talked a lot about on-prem versus, uh, cloud infrastructure. Do you think today in the incident of uh, like could business actually survive without cloud infrastructure? Could they survive in a business continuity sense with only on-prem? Is that real anymore?

Um, well I think if they did the old classic hot side or warm side or whatever they could, um, I, you know, it's kind of funny to even to try to put my brain around, wrap my brain around that because somebody asked me what's it cost to do that In today's terms, I wouldn't know, like what does it cost to have a a hot site or warm site?

I, I know they exist, but I mean, there is, there are companies out there that still have a lot of on-prem critical infrastructure legacy stuff that can't be put in the cloud. So yes, it could be done, but from a small to medium sized perspective, I'm like, seems kind of kind of crazy. But I would still think it, yes, it could be, but it's gonna be expensive in my opinion. Okay. I'd be interested in, uh, in that theory in the chat too. Drop something in there and give us your thoughts.

Could you survive with only a, uh, without cloud infrastructure in that scenario? Uh, we talked a little bit last week about Scoville hot Scale and I think that Gary, who's not here this week laughed at me for throwing in the hotness scale of things.

But when you think about, when I think about the way we prioritize and my team, we talk a lot about like what's critical first, first, second, third, and so on that idea of, uh, priority scale, how do businesses prioritize which applications and data they have to go to first in a disaster situation? How do you determine what weights? Yeah. If you're trying to determine what weights when the disaster happens, you're in trouble. Um, that's learning things the hard way.

Um, that's definitely where you have to, you know, we talked about the BIA and that type of stuff, and one of the things you gotta be thinking about is the time of day, time of year. Like I go back to the example of Dell, obviously the, you know, fourth quarter when all their holiday sales and all that kind of stuff. That was super critical.

And so that's, you know, things were different in that period of time than they were saying, you know, in and when school is over and it's early summer, right? So, you know, that's the other thing you gotta be thinking about for you and your clients is when you're talking to 'em about these things on what weights and what doesn't wait, what can something at the first of the month could be different than in the middle of the month or one time of the year versus the other year.

I mean, none of us have to, we all know what CPAs are like and, and what CPA in those times of year that CPAs are like incredibly frantic. And so you, you gotta have those conversations too because there is just not one universal thing that can help you or apply to you 365 days outta the year. It sounds like a lot of planning for a lot of different things and uh, some days I'm grateful I don't run my own business anymore for that very reason.

Um, we talked a lot so far in the first half about people versus technology. Do you think the businesses are relying too heavily on the technology side of disaster recovery and not really factoring in people in that scenario right now? Man, that's a great question. So I think, again, kind of coming back, I don't want to give the pandemic too much credit, but I think the pandemic taught a lot of people those lessons, but I think as time goes on, people are gonna forget those lessons.

They're not gonna stick, uh, like they should. Uh, so I, I do think we're, we're better at that, but at the same time, and we, you know, obviously on the incident response side, we see where there's just one key person and a lot of times that key person could be the MSP, I mean, just not to get too much, but to pull in some example. We have some examples lately where we've had, um, victims of ransomware and they have very, very, very small MSPs. I'm talking about one to three people max.

And so when this thing happens that that MSP is clearly not equipped to handle the situation whatsoever, however, that company is completely dependent upon that MSP because they hold all the keys to the castle. And so the same thing happens in disaster recovery. We do see too many times where they, you know, whether it's access to bank accounts or access to systems or whatever the case may be, they haven't thought that out very well.

And when that person or persons are not available, they're really in a bind and there's nothing they can really do. There's no, there's no back doors, there's no end arounds, there's nothing like that. You just gotta have to figure that out. And a lot of times it's just waiting. Okay. We've talked a lot about all of the different types of planning that might need to happen.

How realistic do you think it is for SMBs these days to create comprehensive disaster recovery plans without breaking the bank? Yeah, I think, I think adequate planning and focusing on those critical pieces that need to keep the business running is, is not that expensive. I think there is time involved and I think there's some effort, but that's one of the things that the MSP can definitely help with.

Um, so I think that's important just to scope it out and make sure you're focusing on, you know, the, the 80 20 rule. Uh, most of the time if you focus on the critical 20%, you can let the 80% kind of happen. Uh, and especially in disaster recovery. 'cause again, more people are gonna be understanding of you. So you just need to focus on those key points.

And if you can identify those, go through the dependencies, understand what's what, what happens first, second, third, who's, who are we dependent upon? And focus on planning around that you're gonna be in good shape. And I feel that it's not gonna be a huge amount of money. Now, again, come back to where you're located in the risk. So we all need to worry about fires and tornadoes and that type of stuff.

Um, but in certain areas of the country, you have to think about things more so than others. And so, um, so you're, how much time and energy you spend on it should be related to how much risk you have of one of the, of, of a disaster or disasters. All right. So I'm hearing we can't afford it isn't a valuable or valid excuse to use when it comes to disaster recovery planning. We talk all the time about things that we can't afford to do today. This probably isn't one of them.

If you can't afford to do it today, you certainly will won't be able to, uh, to afford the recovery afterwards. Yeah, that's right. I mean the, the, another good example I was thinking when you were talking about this is not a lot of people have kept their most critical documents in fireproof file cabinets. Uh, and those only, those only help you in certain situations, but people put all their, they just think it's all good and they make no copies or anything of that nature.

It's kind of the same thing, right? You, you gotta think about those different scenarios, the risks that you have, and then planning around that. And, and again, you're not, you're not going out and, and spending money on an offsite or a hot site or that type of thing. It's not like you're going out and hiring double the staff. So you have depth during the disaster. Yeah.

What you are doing is you're, you're trying to figure, you're trying to level set the expectations with yourself as a business owner so you have a better understanding of what's gonna happen if something was to occur. Okay. Uh, Eric Beck and chat maybe 20 minutes ago brought the concept of work from home up. Especially, we saw this just recently with, with, uh, Helena Milton. Like, you don't know what's in your control or what's gonna be out of your control.

Are your employees going to be able to critically respond to a national disaster? Are they evacuating? I think I had four people on my team that evacuated throughout the course of this last week, and some of them come back home and are okay. And others of them have come home to disasters in their own homes or their neighborhoods. How do we determine maybe what is our responsibility as employer to make sure, like things like, uh, Gary, you popped in chat earlier. Tell us about starlink.

Do we think we should or shouldn't have that? What is, what is it that we need to be doing as employees to ensure critical coverage is accessible for those people? I mean, if you're leaving your house and you've got no wifi staff still today, have no wifi, and we're, you know, four or five days post incident, what do we do in those scenarios? How do we build that in? Yeah, I mean, Andrew's living it firsthand, right?

He's, he's gonna have, he's going around finding internet access and you know, he is been successful at that. I mean, there's one, there's a couple things. Number one is they have internet access, but do they have an, they may have a pretty, they're not gonna be able to jump on teams calls 'cause the quality's terrible, but they may be able to do minimum stuff, right? So those are the things you can think about. A lot of people say, Hey, you can tether off your phones.

Well, you know, how reasonable is that? I know, you know, Andrew mentioned, you know, like, like last week they mentioned no cell phone service. I've been in those situations where down on the coast with hurricanes where, where the cell phone coverage is not, it's not that it's down, it's that FEMA has taken it all over for themselves. And so those, those things happen. And so Chris, Can you just, so is that, that's one of the big reasons why, like, for example, we lost cell coverage here.

Mm-hmm. Is that what happens? FEMA basically absconds everything. Yeah. Yeah. Now emergency services will take over everything they have. I mean, it's been a while since I, 'cause I learned this through the banks, it's been a while. But yeah, they kinda have like, uh, the ability to basically say, Hey, give it all to us for whatever we need and turn it off for everybody else. Oh, wow.

The same thing goes with like, and, and I learned this also was we had contracts for emergency diesel for our generators. So we had generators in our critical buildings. Well, even though we had those contracts with those companies with SLAs, FEMA could say, Nope, we're redirecting all the diesel to us. And so those are the things. So then we're like, Hey, what are we gonna do? Well, we're gonna have to start storing diesel on our own land somewhere else, in case case of stuff like that.

So you can assume that those services will be up and running. Uh, and a lot of teams and well, and with cell towers too, they're terrestrial circuits that connect to those cell towers. So there's all sorts of things. You, you can't really assume things.

So that's where, that's a tough thing to figure out is to say, look, I'm gonna have to, I'm gonna have to plan for the fact that they, that, that a portion of them, it's highly unlikely a hundred percent of them, but a portion of them are not going to be able to work online like they normally would. So I need to figure out what the minimum amount of work that needs to be done by my staff and plan around that. So, so Tracy, um, just curious, you know, you got a big staff. I do.

Can I just ask you like, what do you, what you did because it, you know, it's real, this is real time. So you, you got staff maybe you can't get ahold of staff that can't work. Like was there planning ahead of time for this and, and how did you guys, how do you, you know, 'cause of the size and scope you guys are now, how do you, how do you look at that kind of stuff and what can the MSPs take away?

It doesn't matter that it's your, you know, providing services to us as, as MSPs, but I think there's some things they can take away from what you did and how you did it. So for us, we have, uh, we have a policy around inclement weather. So we built back, uh, a couple poll, maybe almost three years ago when we were maybe 200 employees. We built an inclement weather policy that said, the minute that you think something's gonna go wrong, say something.

And so the staff came to us early, they came to us often, and we checked in with them daily as we went along. As the storms were beginning to brew, we have, uh, specific Slack channels dedicated to make sure that the team knows where they can go and talk. We talk about, uh, which staff will take in other staff. We have a very community focused, uh, internal process. And then when someone goes offline unexpectedly, we have a sort of back channel who knows who.

So not everybody talks openly, but everybody talks to each other. So we have, uh, team Florida, team Tampa team, Jacksonville team, uh, Orlando, and they're all talking to each other behind the scenes. And it's important that when it happens, we have a plan to readjust. So I run the sales development team, someone's gotta deal with the inbound traffic.

We have a process that's already lined up that says the minute someone shows offline start redistributing, making sure that our customers, our partners, all get looked after in a scenario like that to the best of our capacity. And if we get above capacity, I actually start calling people myself. Got it. I Start managing that from the top And that kind of stuff. Chris and or Nat, let me ask you, we gotta think about that on, uh, support. Correct?

Like it's one thing, like Tracy was saying, inbound sales, like, and you can understand guys 'cause they have a huge machine where there could be inbound, but MSPs have to think about the same way, right? All of a sudden, you know, you have, let's just say Kraft Kennedy today has, uh, make it up 20 of their help desk is are remote and they're all in Tampa, Florida. Uh, big issue, right? Where you all of a sudden have to take into account what are we gonna do with X amount of calls coming in?

Yeah. And, and I think an important aspect is just like we were talking about before, putting the head of your client on not just their hat, but their whole head. Same thing in this situation. And, and it's hard to do as an MSP owner because you're so close to it, you're so in the weeds and you're so focused on providing that support from the client perspective. I mean, they can be compassionate, but at the end of the day they don't care. They want their problem solved.

They don't care what internal issues we're having. However, if there is a disaster, it's always good one to communicate ahead of time. As soon as you know, you're going to have slowness in response or something is going to change. Communicate with your clients, communicate internally. Make sure that everybody knows and that you have a plan for coverage, even if it's gonna be slower, we're still here. Please work with us. Please give us your patience through this time, et cetera.

And then internally, if you have staff that can take calls who have that experience and background and they're just moved to a different position in their career, you can have them cover the phones, cover tickets, et cetera. Um, and, and that's probably one of the easiest departments to cover in an MSP because so many of us have been, have sat on the help desk at one time or another in our lives. Well, and, and, and you know, I love what Tracy said. I learned a bunch today and I did too.

Like Chris, I mean, just going back, I'll come back to this whole thing, you know, based on the size and scope of your MSP and if you have people in disaster, hurricane again, let's role play. You're in Tampa. Uh, you have, you have people in Tampa, you have people in hurricane areas, you have people in tornado areas, whatever it may be.

You, you really need to think, Hey, a FEMA shows up, Chris, maybe we, maybe we do spend a, you know, a few grand a year and have a star link or a few star links in waiting. 'cause if I know FEMA's gonna abscond all cell service, we're essentially SOL, um, in terms of if we need some type of cell support, right? Hey, I really need these people to do something for me or some kind of, I really need to get to these people.

Um, yeah, I mean I think starling's great because you can enable it and disable it when and when, when necessary, right? It's not like you gotta sign up for a three year deal with starlink. You're investing in the hardware and you can throw that hardware up and, and pretty much anywhere. And depending on what type of starlink configuration you get, you get like a mobile unit or whatever. It's stupid easy. And again, you can pay as you need it as you use it.

So I think that's incredibly flexible and more flexible than anything we've had in the past. And, um, it's kind of free of interference from, from anybody else. I think that's a, the other thing I was gonna mention, you know, before time is up is I've known other MSPs to partner with other MSPs.

So they're like, Hey look, they've, you know, MSPs had great relationships and they're like, Hey look, if something bad does happen, hey, I'm gonna, you know, in some kind of vault or whatever, can you basically fill in the gap your stacks similar to my stack? That type of thing. And so I've known that to happen. I mean, being in, being involved in the evolve peer groups, I've known MSPs specifically do that.

So that's another, that's another option you have as an mss p especially in our great community, there's no shortage of MSPs that are willing to do that. So you find, you're on the east coast, you find somebody on the west coast and vice versa, whatever, and you kind of pair up that way and then you can have some, some stability that way as well.

So, um, obviously you wanna do it with somebody you can trust, but MSPs we're all smart enough to know technically how to secure all that stuff and, and give access to it. So that's another option. MSPs is the lean upon one another in these types of situations. And that's not a bad thing to even document in a DR plan. No one's gonna argue with that, with that plan either. And it's, it's, it's, you know, it's coming back to the whole business conversation.

Tracy, not a bad one to even to maybe talk to like, you know, CPAs or, or you know, other, you know, peer friendly if you have a client, Hey, you know, what, if this, you know, have you, do you guys have a peer group you talk to? Do you have, you know, how do you guys work, you know, to support one another in the event of national disasters? Have you ever like conversation?

It just, you know, I think it, it, it'd be interesting that, you know, you know, broach those kind because it, it makes it more human. It's not just, sir, Great conversations for things like QS allowing you to have that personalized discussion on what's going to help move them forward.

We look at QS sometimes on the sales side of the house as what's in it for us and if we start looking at QS and how do we ensure that our clients are partners are safer on their end and building in things that are value added to them, helping them understand where they might go for resources in a disaster, I think is a very valuable piece of, uh, discussion that we should be doing.

And not, not that I'm sitting here as a proponent of for or against pe but it does certainly show how, you know, why size and scale can help. Like if you're a nationally based MSP now, boy that, that certainly gives you, you know, I can roll, you know, in many different directions, right? And I see you shaking your head again, this isn't a, a commercial that hey, go get acquired. It's just, it's just came into my head that that does give them a leg up in that area. Fair. Absolutely. Yeah.

So, um, I know we're at the top of the hour, um, really, uh, fascinating and, and I like I'll echo again, Tracy. Great, great. I learned a ton, Chris, thanks really for sharing. Earn, um, you know, your days, uh, outside of MSP because these are things I I think a lot of us don't necessarily think about, but banks have to think about. Um, like I said, I'll, I'll like, I I'll remember it was like a yesterday when the pandemic hit and you're like, oh yeah, we had pandemic policies.

I'm like, you did. Um, and None of 'em were ready for that. Yeah, yeah, yeah. It's Kinda like the North Carolina stuff. I mean, you have disaster. No one was prepared for that. Pandemic was, was way worse. But yeah, we had been doing, I mean, pandemic tests for 15 years prior to the actual pandemic happening then. Yeah. You know, they all failed. But anyway, that's Different. Alright, well Chris, thanks for being our guest. Tracy, thanks a million for coming on again.

You are awesome, net amazing as always, given the MSP perspective and everybody out there, thanks so much for joining us. Uh, we'll look forward to seeing you next Monday. If you're in Canada, happy Thanksgiving to you today. If you're in the US and you're celebrating Columbus, uh, happy Columbus Day to you. And if you don't have power, my heart is out to you and I hope you get it back very soon. So.