AT&T’s Business
Continuity Survey: 2009
Introduction
For the eighth consecutive year, AT&T has completed a survey of over
500 Information Technology (IT) executives in the U.S., representing 18
major industry areas and five U.S. market geographies. The goal was to
learn what these executives were doing about business continuity, and
how it figured in their overall IT strategy.
Also note that while previous years’ surveys were conducted by
telephone, this year the survey was administered online. The study was
conducted by e-Rewards Market Research, a top online market research
organization, and utilized a “by-invitation only” approach to target
high-level decision makers by industry, company size and functional
role. Companies targeted had total revenues of more than $25 million.
Surveys were obtained between February 9 and February 14, 2009.
The survey involved 100 or more interviews in each of five areas: Houston,
Detroit, Southern California, Florida and the Baltimore/Washington, D.C.
area. Of the 502 participating executives, 43% were Vice Presidents,
Managers/Directors of IT or IS, and all had primary responsibility for
business continuity planning.
General Findings
Overall, business continuity planning was seen as a priority by three
out of four (76%) IT executives, a 5% increase from 2008. Almost half
(48%) indicated it had always been a priority for their business, and
more than a quarter (28%) indicated it has become a priority in recent
years because of heightened awareness of natural disasters, security
and terrorist threats. That positive finding is somewhat offset by the
fact that one quarter of the survey group (23%) said business
continuity planning was “not a priority.”
Eight out of ten (83%) executives indicated their companies had a
business continuity plan, and only one out of ten (10%) said they did
not. Less than one out of ten (7%) were unsure if their company’s plan
was in place. One third (32%) of the respondents indicated that the
responsibility for continuity planning belonged to the IT department,
and two-thirds (68%) said they implemented specific protection actions
when the state or federal government issued a disaster alert.
The survey also found that companies were more diligent about testing
their plans than in past years, with 58% fully testing their plans during the
past year. Only a few indicated their plans had never been tested (5%).
Nationally, more than one-third (36%) of the companies have had
occasion to invoke their business continuity plan. These companies
were most likely to have invoked their business continuity plan because
of extreme weather (25%) or power outages (19%).
General Preparedness
While business continuity planning is important to most companies, a
sizable number do not view it as important and may be unprepared to
deal with an emergency, either natural or man-made. One-fifth (22%)
indicated business continuity planning was not a priority at their
company. However, roughly one-quarter (28%) indicated that the
perceived importance of business continuity planning had increased in
recent years due to natural disasters, security and terrorist threats.
Three out of four (74%) executives indicated that their company has
prioritized and set target recovery times for each key business process.
Companies that have formal business continuity plans are significantly
more likely to have undertaken this process-level assessment and
analysis (80% compared to 63%, respectively).
Plan Inclusions
More than one third (35%) of the companies required their key vendors
to have their own business continuity plans, while four out of ten (42%)
did not. Companies in Florida and Detroit were most likely to require
this (44% and 42%, respectively, compared to 35%, nationally). When
asked about the use of managed or outsourced capabilities, six out of
ten (61%) indicated such services were part of their continuity plans.
A similar percentage of companies (67%) included wireless network
capabilities in their business continuity plans.
The use of mobile devices that are maintained by a company’s internal
IT departments was spread fairly evenly: 26% indicated that 75% to
100% of their workforce utilized these devices, 18% indicated a 50% to
74% utilization and 22% indicated a 20% to 49% utilization. More than
four out of ten (46%) stated that mobile devices played a major part in
the company’s plan.
AT&T’s Business Continuity Survey: 2009 ______________________________________________________________________________________________________ 2

Recent history affects preparedness: exposure to extreme
weather can be seen in the similar metrics for Houston
and Florida. They are the regions:
• Most likely to have fully-tested plans
(68% and 62%, respectively)
• Most likely to implement protective actions in response
to government disaster warnings (73%, for both regions)
• Most likely to have invoked disaster plans
(52% and 51%, respectively)
• Most likely to have set priorities and target recovery
times (77% and 85%, respectively)
Conclusions
The good news from this year’s survey is that the importance of
business continuity planning is understood by a steadily increasing
proportion of the survey groups. That trend has continued since 2005.
However, there are still many companies that may be unprepared for
coping with a disaster, either natural or man-made. These companies
may be at risk of business failure due to unforeseen events.
Which of the following statements best describes your
business’s approach to business continuity planning?
100
80
60

40
Security and Communications
20
Three out of ten (30%) IT executives felt that “hacking” was the biggest
security risk, with internal accidents following second with a little more 0
1 2 3 4 5
than one out of ten. Other concerns include internal sabotage and
customer/partner/vendor access.
2009 2008 2007 2006 2005
1. Always been a priority 48% 43% 40% 38% 34%
Over the past year, mobile devices have become an increasingly
2. Been a priority in recent years 28% 28% 29% 32% 26%
important part of the infrastructure for many businesses, since they are 3. Important but not a high priority 22% 22% 26% 24% 35%
an explicit component of their disaster recovery plans. Social networking 4. Not important 1% 6% 4% 4% 4%
tools have also increased in popularity, and are being adopted for 5. Don’t know/None of these 1% 1% 2% 1% 1%

business purposes. These two emergent trends are worrisome for many
IT executives. A majority of the survey group (73%) voiced concern
about the spread of social networking as well as mobile networks and
devices, and their potential impact on corporate security. Does your organization have a business continuity plan?
A large majority (85%) has instituted special arrangements for
communicating with key executives during a natural disaster. A similar 100
proportion (87%) have e-mail or text messaging capabilities in order to
80
reach employees outside of work, and three-fourths (76%) have systems
in place that enable most employees to work from home or at remote 60
locations. More than half the companies now have automated calling
40
systems designed to reach employees by telephone or cell phone,
compared to the 39% reporting such capabilities in 2008. 20

Looking Forward 0
Yes No Don’t know
In regard to 2009 IT budgets and new technologies, four out of ten
(40%) indicated that their company’s IT budgets would be lower than Don’t
Yes No Know
in the previous two years, 32% indicated their budgets would be the 2009 83% 10% 7%
same and 24% indicated their budgets would grow. Two-thirds (65%) 2008 80% 18% 1%
indicated that their company planned on investing in new technologies. 2007 72% 26% 3%

While the types of new technology varied, the investments tended to 2006 73% 24% 4%
2005 67% 31% 2%
focus on new equipment and a variety of software and security upgrades.
AT&T’s Business Continuity Survey: 2009 ______________________________________________________________________________________________________ 3

Has your company prioritized and set target recovery In the event of a natural disaster, do you have:
times for each of your key business processes?
100 * *

100 80

80 60

60 40

40 20

20 0
2009 2008 2009 2008 2009 2008 2009 2008
1 2 3 4
0
* Indicates Less than one-half
1 2 3 of one percent (don’t know)
Yes No Don’t Know
1. Special arrangements for communicating with 2009 85% 10% 5%
key executives, such as the CEO, CFO, etc.? 2008 79% 19% 1%
2009 2008 2. E-mail or text messaging capabilities to reach 2009 87% 11% 2%
employees outside of work? 2008 80% 19% *
1. Yes 74% 67%
3. Systems in place that enable most employees 2009 76% 21% 2%
2. No 19% 32% to work from home or remote locations? 2008 66% 34% *
3. Don’t know 7% 2% 4. Automated calling systems to reach employees 2009 52% 45% 3%
by telephone or cell phone outside of work? 2008 39% 60% 1%

How would you characterize your IT budget

Are you investing in any new technologies in 2009?
for 2009?
100
100
80
80
60
60
40
40
20
20
0
0

Budget higher than previous two years 24%

Yes 65%
Budget lower than previous two years 40%
No 28%
Budget remained the same 32%
Don’t know 7%
Don’t know 3%
AT&T’s Business Continuity Survey: 2009 ______________________________________________________________________________________________________ 4

How concerned are you about the increasing usage How concerned are you about the increasing usage
of social networking capabilities and its impact of mobile network and devices and their impact
on security threats? on security threats?

100 100

80 80

60 60

40 40

20 20

0 0

Very concerned 24% Very concerned 23%

Somewhat concerned 49% Somewhat concerned 50%
Not very concerned 20% Not very concerned 22%
Not at all concerned 4% Not at all concerned 4%
Don’t know 3% Don’t know 2%

Survey Methodology
The 2009 results are based on 502 online surveys among Information
Technology (IT) executives in companies with over $25 million in
annual revenue.
• The 2008 results are based on 500 telephone interviews among
Information Technology (IT) executives at companies with over $25
million in annual revenue.
• Results for 2005, 2006 and 2007 are based on 1,000 telephone
interviews among Information Technology (IT) executives at
companies with over $10 million in annual revenue.
The sample for 2009 consists of online surveys in five selected market
areas: Baltimore/Washington D.C. (101), Detroit (100), Houston (100),
Florida (Miami/Orlando/Tampa; 101), and Southern California (Los
Angeles/Orange County/San Diego; 100).

For more information contact your AT&T Representative or visit us at www.att.com/business.

05/19/09 AB-1605
© 2009 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property.