Sometimes it takes a worst case scenario for a business to realize where their weakest points are. I understand why GetSmart did not want employees downloading and saving confidential info onto CD's and flash drives. By allowing employees to back up info onto external drives, the company could be at risk for placing confidential material in unwanted hands. The company is also placing their system at rick for unwanted viruses by using all the external drives. I believe the company needs to come up with other alternatives to save and backup their information.
I would suggest keeping the system and policies they are currently using in place only expanding them. The current servers are large enough and can handle all the information. They had an internal backup plan in place, it just failed due to the lightning. The company needs to ensure backup power is available in case of power outages to keep the servers and the system running at the present location. The company needs to contract out with a company such as IBM to backup and store their information off site. This will allow the company to continue operations if the current building is lost. IBM would backup the files every night and in have all the data stored at a site other than the company office.
GetSmart was on the right track of storing their data and eliminating the threats of viruses and stolen information. They lacked an off site data storage location. Yes the off site data storage location will be costly, but look at the expenses and lost customers due to GetSmart's negligence.