WHITE PAPER SPON. The Importance of Continuity in Office 365 Environments. Published April 2013 SPONSORED BY. An Osterman Research White Paper

Transcription

1 WHITE PAPER N The Importance of Continuity in An Osterman Research White Paper Published April 2013 SPONSORED BY sponsored by SPON sponsored by Osterman Research, Inc. P.O. Box 1058 Black Diamond, Washington USA Tel: Fax: info@ostermanresearch.com twitter.com/mosterman

2 EXECUTIVE SUMMARY While 99.9% uptime is acceptable in some situations, it simply is not good enough for many users and organizations. If you or your organization needs a higher level of uptime, please read on. is an essential tool for communications, collaboration and content sharing, and is employed more than all other tools combined to accomplish these tasks. Consequently, must remain available as close to 100% of the time as possible in order for information workers to remain productive. Unfortunately, downtime is a fact of life for virtually every organization and carries with it a variety of consequences that range from the annoying to the financially devastating. These consequences include: An often-dramatic decrease in productivity among those who rely on as a normal part of their workflow. An inability to process orders, customer inquiries or other transactions in a timely manner. s that are bounced back to the sender as undeliverable, which presents an unprofessional image to customers, partners, prospective customers and others. The potential for missing time-sensitive communications or failing to satisfy delivery deadlines. Users switching to personal accounts that will bypass corporate security, archiving and encryption capabilities, possibly in violation of corporate policies, regulatory requirements or legal obligations. THE GROWTH OF OFFICE 365 Office 365 Microsoft s cloud-based and productivity suite is an important offering by virtue of the fact that it is offered by the world s largest software company, and is among the most widely used cloud-based platforms currently available for organizations ranging from small businesses to large enterprises. However, like traditional, on-premise and cloud-based systems, Office 365 experiences periodic outages that can cause to be down for anywhere from a few minutes to several hours at a time. What Office 365-enabled organizations need, therefore, is a solution that will maintain continuity during service outages so that users can continue working as though the outage had not occurred. Office 365, like other leading cloud-based platforms, is quite reliable, but for organizations that have low or little tolerance for any downtime, an continuity solution is an important and necessary enhancement. downtime is a fact of life for virtually every organization and carries with it a variety of consequences that range from the annoying to the financially devastating. KEY TAKEAWAYS is employed by the typical user for approximately 2.5 hours per day, far more than the telephone, instant messaging and social media. All systems including Office 365 experience periods of downtime in which the service is unavailable. In addition to negatively impacting employee productivity, outages can create security, content management, regulatory, legal and other problems. Decision makers in organizations that use Office 365 should determine their true cost of downtime, including not only productivity costs, but also opportunity and other costs Osterman Research, Inc. 1

3 Organizations that use Office 365 and that have a low tolerance for any sort of disruption should implement a continuity solution that will enable users to continue working when the service is unavailable. ABOUT THIS WHITE PAPER This white paper discusses the important issues related to and Office 365 continuity and offers recommendations for decision makers to consider as they develop their continuity plans. The paper also provides a brief overview of Mimecast, the sponsor of this paper, as well as their relevant solutions. THE IMPORTANCE OF IS USED EXTENSIVELY Osterman Research conducted a survey in January 2013 to determine the importance and use of relative to a variety of other communications tools. We found that the typical corporate information worker employs for an average of 149 minutes on a normal workday, significantly more than any other mode of communication, as shown in the following figure. Communication Tools Used During a Typical Workday Minutes Used per Day is the primary filetransport mechanism used in most organizations, despite the growing presence of tools like SharePoint, Dropbox, YouSendIt and various enterprise filesharing and content management systems. Moreover, the typical user sends a median of 30 s per day and receives a median of 80. This means that during a typical 250-day workyear, each user will send and receive a total of 27,500 s, or an average of one sent or received every four minutes 22 seconds (assuming a typical eight-hour workday). It is also important to note that is the primary file-transport mechanism used in most organizations, despite the growing presence of tools like SharePoint, Dropbox, YouSendIt and various enterprise file-sharing and content management systems. s ubiquity, its ease of use, and the fact that it is based on industry standards means that it is a reliable method for sending information and files, at least when the corporate solution is working properly Osterman Research, Inc. 2

4 IS BECOMING LESS IMPORTANT OVER TIME? HARDLY! Our research also discovered that is being used more over time. While there have been numerous articles and discussions theorizing the demise of in favor of tools like instant messaging, social media and the like, we found just the opposite to be true: 42% of those surveyed are using more now than they were 12 months ago, while only 10% are employing with less frequency. The balance of those surveyed indicated that their use of has remained largely unchanged over the past 12 months, indicating that for nine of 10 users, the importance of is either not diminishing or is becoming more important as a means of communication, collaboration and content transfer. THE CONSEQUENCES OF DOWNTIME reliability whether is managed using on-premise infrastructure or purchased as a cloud service is dependent on a variety of factors, only some of which are under the control of in-house IT. These include the reliability of the various servers on which server software runs, the underlying operating system and server software, Internet connections, the power grid, local construction activities, weather, the proficiency of those managing the local or cloud-based data center, the quality of various software vendors patches and updates, and a number of other factors. If any link in this chain breaks, systems can suffer downtime. An Osterman Research survey conducted during 2012 found that the typical system in mid-sized and large organizations experiences a mean of 43 minutes of downtime during a typical month, or eight hours 36 minutes of downtime per year. This translates to an uptime level of 99.9% not an unreasonable level of downtime in the context of the Service Level Agreements that many cloud-based providers offer, but still a substantial amount of downtime for an organization that relies heavily on . It is also important to note that many organizations experience substantially more downtime than the mean we uncovered in our research, as shown in the following figure. Downtime During a Typical Month Among Mid-Sized and Large Organizations reliability whether is managed using on-premise infrastructure or purchased as a cloud service is dependent on a variety of factors, only some of which are under the control of inhouse IT Osterman Research, Inc. 3

5 DOWNTIME IS EXPENSIVE AND IN A VARIETY OF WAYS Downtime in carries with it a variety of consequences that can vary widely in their short- and long-term impacts on an organization. For example: Reduced employee productivity If we assume that users are just 31% less productive during an downtime incident (based on use of for 149 minutes per day and a 480- minute workday), a very conservative figure of 30 minutes of unplanned downtime each month for users whose fully burdened salary is $70,000 per year will result in an annual productivity cost of downtime totaling $62.68 per user per year an organization of 500 users will, therefore, suffer productivity loss of $31,340 each year. Extended productivity loss However, productivity costs can be substantially greater if is unavailable for extended periods, as can occur during power outages or storms events that are outside the control of on-premise administrators and cloud providers alike. This might result in productivity loss of 100% if employees go home for the day, resulting in much greater productivity losses than in the example above. Osterman Research conducted a survey in late 2011 that asked users what they would do during outages of one hour and eight hours. We found that during a one-hour outage, 2% of employees would go home to continue working. However, during an eight-hour outage of the system, 10% of employees would go home. IT disruption Unplanned downtime incidents require IT staff to stop doing other work and instead focus on the emergency at hand, thereby delaying other work. A 2012 survey of mid-sized and large organizations conducted by Osterman Research found that a single, unplanned downtime incident will require a mean of 7.0 IT person-hours to resolve. This means that just one downtime incident per month will require the equivalent of 4% of an IT staff member s time simply for downtime resolution. The impact on mobile users It is also important to note in the context of downtime mobile users who typically are more sensitive to interruptions. This sensitivity to downtime and the economic consequences that accompany it are driven by the fact that mobile users often have no viable alternative means of communication if they cannot communicate via , they are often more pressed for time while traveling, and they have shorter windows in which to communicate (e.g., while on a layover at an airport). When the corporate system is unavailable, users will often look for alternate means to send time-sensitive or other critical content, including personal Webmail systems. Security and content management risks When the corporate system is unavailable, users will often look for alternate means to send time-sensitive or other critical content, including personal Webmail systems, Dropbox or various consumer-focused file-sharing tools. While these personally managed tools are useful and typically work as they are supposed to work, this also means that corporate data is sent without first being processed by the archiving, content filtering, security, encryption or other corporate systems that might be in place. This puts the organization at risk on a number of levels, particularly if the organization is in a heavily regulated industry like financial services, healthcare, pharma, energy or government. This cost is difficult to quantify, since it can result in consequences as diverse as leakage of sensitive corporate data all the way to charges of spoliation of evidence in a lawsuit. Other consequences There are several other consequences from downtime that are difficult to quantify, but no less real. These include loss of corporate reputation when 2013 Osterman Research, Inc. 4

6 prospects, customers and business partners receive a bounceback when sending a prospective customer who sends an only to have it bounce back might never follow up later. An outage might prevent a timely response to a proposal, order or answer to a client inquiry and could lead to a significant loss of revenue in the long run. DOWNTIME IN OFFICE 365 MUST BE CONSIDERED Managing downtime is even more critical for organizations that rely on cloud-based , since they are wholly dependent on a third party to manage , maintain its reliability and ensure that runs as close to 100% of the time as possible. OFFICE 365 DOWNTIME OCCURS PERIODICALLY Office 365 represents the Microsoft s latest entry into the cloud-based messaging, collaboration and productivity market after Business Productivity Online Suite (BPOS) and hosted Exchange before that. While deciding on which of the many variants of Office 365 to deploy can be a bit daunting because of the many (and somewhat confusing) options available, it is clear that Microsoft has done quite a good job at creating a scalable and feature-rich platform that can satisfy the requirements of many organizations, including large enterprise environments. That said; and without any intention of denigrating the design, deployment or management of Office 365; the platform does not maintain 100% uptime. As shown in the following examples, Office 365 has experienced several outages in the recent past: February 1, 2013: many users experienced problems signing into their and calendar, as well as accessing identity services. The issue took one hour 27 minutes to resolve. January 30, 2013: some customers using vanity domains were unable to access SharePoint Online. The issue took four hours eight minutes to resolve. January 29, 2013: an outage in Exchange Online in one data center caused to queue as a result of DNS lookup problems and affected timely delivery of . The issue took one hour 31 minutes to resolve. January 25, 2013: some users were unable to access SharePoint Online, resulting in some users seeing a 404 error when accessing their SharePoint sites. The issue took 60 hours 34 minutes to resolve. Without any intention of denigrating the design, deployment or management of Office 365, the platform is not entirely reliable. Office 365 has experienced several outages in the recent past. January 10, 2013: administrators attempting to add a custom domain to Office 365 could not do so. The issue took one hour 11 minutes to resolve. In addition, Office 365 has experienced a number of other outages since its introduction in mid-2011 as indicated by the following examples: November 13, 2012 i : a failure that was the result of a combination of issues related to maintenance, network element failures, and increased load on the service ii. November 8, 2012 iii : a failure that was the result of viruses reaching Office 365 servers iv. September 19, 2012: intermittent errors were experienced in the Office 365 administration portal v Osterman Research, Inc. 5

7 January 24, 2012: a major outage affected Office 365 and other Microsoft services vi. September 8-9, 2011: two outages related to DNS issues vii. August 17, 2011: a major outage for North American customers related to failed network components viii. CASE STUDY: CORPORATE SYNERGIES GROUP This group employee benefits broker based in New Jersey migrated from onpremise Exchange to Office 365. Although the company had also evaluated a migration to Gmail, the fact that the company s users employed Outlook meant that the use of Office 365 would present fewer challenges. However, the IT decision makers within the company knew that Office 365 had connectivity issues, resulting in not being available 100% of the time a situation that the company s senior management deemed unacceptable. The company had three fundamental requirements when Office 365 went down: a) no level of downtime would be acceptable, b) the outside world could not know that was unavailable during downtime incidents, and c) users would need to seamlessly transition to a backup system very quickly. Corporate Synergies opted to use Mimecast Continuity, which went live for the company in May Although the company has not yet deployed the Outlook plug-in that will make the transition to the backup system completely seamless during Office 365 downtime incidents (a delay that the company attributes to themselves, not Mimecast), the fact that Active Directory is synchronized with backup has made the switchover simple and quick when required. Underscoring the ease with which backup capability can be used, users had received no training at the time of the first Office 365 downtime after Continuity had been implemented. However, they were able to click a link in Outlook they had received previously and switch over to the new system in short order. DOWNTIME MAY BE MORE SERIOUS IN OFFICE 365 ENVIRONMENTS THAN WITH ALONE While downtime is a serious issue in traditional environments, it is even more problematic in Office 365 and other cloud-based platforms because of the significant number of services available under the umbrella of the platform. For example, moving from Exchange Online hosted to the Small Business plan (P1) adds instant messaging, telephony services, video conferencing, file sharing and Web site publishing. Moving to the next level, Plan E1, adds SharePoint intranet services. The next level adds archiving and hosted voic . While downtime is a serious issue in traditional environments, it is even more problematic in Office 365 because of the significant number of services available under the umbrella of the platform. In short, Office 365 provides a wide range of services that impact a larger number of processes for the typical user. This means that as a customer migrates up the Office 365 ladder of services, downtime will impact a larger proportion of the capabilities that users require to perform their work. While this integration of services can make users more productive, it also increases the importance of the enhanced reliability of, and access to, these services Osterman Research, Inc. 6

8 PLANNING FOR VERY HIGH AVAILABILITY THE IMPORTANCE OF ESTABLISHING DOWNTIME METRICS A key contributor to the length of unplanned downtime incidents is that native continuity capabilities are often inadequate. The length of time to detect, diagnose and remediate downtime is often excessive, leading to downtime incidents that are longer than they should be. Exacerbating the problem is that quite often end users are the first to notice an outage, not IT. This adds to the length of time required to resolve downtime incidents, since IT diagnosis and remediation efforts often do not commence until at least 10 minutes after the system has gone down. In the case of a cloud-based service like Office 365, remediation would consist of contacting Microsoft technical support via telephone or the Web to determine the anticipated length of the downtime and its cause. SLA, RTO AND RPO In developing the requirements for continuity, decision makers must determine the level of continuity that is necessary to meet the needs of individual users and the organization overall. This means that decision makers must focus on three critical issues on which to focus in the context of continuity: Service Level Agreements (SLA) An SLA is a formally defined level of service that will be provided for an system. For example, an SLA of 99.9% means that an system will be down no more than 43 minutes per month. Recovery Time Objectives (RTO) An RTO focuses on how much time between the commencement of an outage and recovery is acceptable. Recovery Point Objectives (RPO) An RPO focuses on the amount of data that can acceptably be lost following an outage. An organization may determine that it can accept losing a certain number of s per user following an outage, and so can afford to establish an RPO that follows the outage by a substantial length of time. However, most organizations will likely find it unacceptable to lose a substantial amount of , and so will want to establish an RPO that extends only to shortly after the outage begins. While RPO and RTO often are typically focused more on backup technologies than continuity, many consider them to be important considerations for a recovery capability, as well. Critical factors in determining the RPO and RTO for an organization are the benefits of reducing or eliminating data loss, as well as determining the benefits of speeding up the restoration of service following an outage. The SLA, RPO and RTO will be based on several factors, including: downtime can create gaps in the content archiving process, causing significant problems for organizations that must preserve for ediscovery and other litigation-related purposes. Specific employee productivity requirements Organizations whose employees rely heavily on to do their work will normally be intolerant of downtime, and so SLAs, RPOs and RTOs must be carefully defined. Legal requirements downtime can create gaps in the content archiving process, causing significant problems for organizations that must preserve for ediscovery and other litigation-related purposes. Missing s can easily lead to charges of evidence spoliation, a damaging problem for any organization involved in a legal action Osterman Research, Inc. 7

9 The processes and systems that rely on as a transport mechanism Supply chain workflows, revenue-generating operations, call center transactions, and other important processes that rely on to transport content will require an SLA, RPO and RTO that is quite different than for an organization in which is used only for person-to-person communication. Regulatory obligations Heavily regulated organizations must archive all relevant business records missing s can create serious problems for these organizations. Minimizing downtime in these cases may have less to do with bringing communications back online than ensuring that critical business records in are retained appropriately. CASE STUDY: PHARMACEUTICALS COMPANY A European pharma company with offices in Europe and the United States has been using Mimecast Continuity since Spring The company was an early adopter of Office 365 and was concerned about the reliability of Microsoft s new offering. As it turns out, Microsoft did not deliver on its promised uptime, necessitating the use of Mimecast s solution on several different occasions during For example, one such incident in December 2012 resulted in Office 365 being unavailable for a period of 10 hours. The company has employed the Outlook plug-in available with Mimecast Continuity for its 70% of users that employ Windows XP Mac users simply access a Web site and enter their username and password to access backup . The company is very pleased with the solution: users can transition to backup within about 20 seconds of discovering an Office 365 downtime, and there has not be an instance in which users could not find older on Mimecast s servers. Organizations that rely heavily on for communications but not for content preservation will require stringent SLA and RTO, but will have less strict requirements for RPO. Conversely, at the other extreme will be organizations for which as a communications tool is not highly critical, but the content in is extremely important: these organizations will want to focus heavily on RPO and can focus less on SLA and RTO. It is imperative that decision makers understand just how much Office 365 downtime truly costs their organization. The bottom line is that organizations that are highly dependent on communications and use as a key repository of business records a growing proportion of industries across virtually all industries must focus seriously on the continuity of . FOUR RECOMMENDATIONS Osterman Research recommends that organizations undertake four steps in determining their need for high availability in Office 365 environments: 1. Understand the full cost of Office 365 downtime It is imperative that decision makers understand just how much Office 365 downtime truly costs their organization. For example, in the example noted above, a 500-user organization will lose in excess of $31,000 annually in employee productivity using the conservative estimates noted. However, organizations with more highly paid staff, such as attorneys, doctors, a high proportion of senior executives, etc., will experience much higher employee productivity losses from downtime Osterman Research, Inc. 8

10 Moreover, there are a variety of other consequences beyond productivity losses that must be considered, including missed deadlines that include financial penalties, lost orders, missed customer inquiries and overall loss of goodwill that result from Office 365 downtime. These costs can dwarf employee productivity losses and must be considered as part of the overall analysis of downtimerelated costs. 2. Understand what the Office 365 SLA actually means While decision makers may be satisfied with the fact that Microsoft offers an SLA for Office 365 ix, it is important to note that the SLA may be more limited than some Office 365 customers consider to be acceptable in terms of the protection that it affords them: The SLA does not apply to factors outside Microsoft s reasonable control, that resulted from Customer s or third-party hardware or software, during scheduled downtime, or during beta and trial services (as determined by Microsoft). Service Credits are Customer s sole and exclusive financial remedy for any violation of [the Office 365] SLA. The Service Credits awarded in any calendar month shall not, under any circumstance, exceed Customer s monthly service fees. The service credits equal 25% of the service fee only if monthly uptime drops below 99.9% (43 minutes per month), 50% if monthly uptime drops below 99% (seven hours 12 minutes per month), and 100% if monthly uptime drops below 95% (36 hours per month). However, the way that Microsoft calculates monthly uptime means that very high levels of downtime might be experienced by some Office 365 users without triggering the payment of Service Credits. For example, consider the case of a 500-user organization with 400 users in North America and 100 users in Great Britain. If the latter experienced three hours of unplanned downtime in one month and 30 minutes of downtime resulting from scheduled maintenance, but the North American users did not experience any downtime, Microsoft would calculate total uptime for that month at 99.92%. This means that although the British users experienced uptime of only 99.51% during that month, no Service Credits would be paid. 3. Establish a return-on-investment (ROI) for continuity Decision makers should conduct an ROI analysis for their Office 365 continuity requirements. For example, if we assume that for a 500-user organization a cloud-based continuity solution is priced at $4.00 per user per month, the solution will save the organization $100 per user per year, and will enable generation of an additional $25,000 per year because opportunities will not be missed during periods of Office 365 downtime, the ROI will be 213%, calculated as follows: Decision makers should implement an Office 365 continuity solution that will enable users to continue working with access to live and an archive of their recent . (Benefits Investment) Investment = ROI ($75,000 in benefits - $24,000 invested) $24,000 = 213% It is also important to note that it may not be necessary to conduct a complete ROI analysis in every situation. For example, is absolutely critical to most users and organizations, and so qualitatively defining the benefits of maximizing uptime may be sufficient for some decision makers to justify deployment of an continuity solution. 4. Implement the appropriate solution Finally, decision makers should implement an Office 365 continuity solution that 2013 Osterman Research, Inc. 9

11 will enable users to continue working with access to live and an archive of their recent . Decision makers will want to determine if this access should be through the thick Outlook client and/or through a Webmail client. The continuity solution should also impose only a minimal burden on in-house IT staff for initial provisioning and ongoing administration. ABOUT MIMECAST Mimecast Unified Management for Microsoft Office 365 is a Cloud-based management solution designed specifically to augment the benefit of Microsoft Office 365 with additional layers of enhanced security, an independent archive and backed up by a 100% service availability SLA, continuity. All enhance the value Microsoft Office 365 or Microsoft Exchange Online delivers to your business. Mimecast provides a highly secure and resilient independent offsite archive which augments Office 365 across all mid-size and enterprise E plans, and Exchange Online plans 1 and 2. The Mimecast Archive for Office 365 delivers enhanced ediscovery and compliance archive tools as well as an end user orientated Outlook integration to provide end user security and a real time archive search functionality directly from their desktop. MIMECAST GATEWAY SERVICES FOR OFFICE 365 A rich set of security and gateway features that empower end-users, reduce administration overhead & complexity, and address compliance needs natively: Specialist AV/AS detection and prevention, supported by our global security taskforce Configurable and customizable DLP technology enabling simple and complex options, as well as management workflows Multi-party secure conversations without additional HW/SW Attachment and document management features for users and administrators Disclaimer management and stationery Large file sending and receipt management MIMECAST CONTINUITY SERVICES FOR OFFICE 365 A 100% uptime guarantee to mitigate the risks of data & productivity loss during downtime: Rolling 58 day archive to assist in outage scenarios Fully populated inbox for end users available in browser, web, Outlook, SmartPhone, tablet Automatic failover to continuity mode users don t know they have an outage Automated notifications to administrators in the event of an outage Text notifications can be sent to users in the event of an outage MIMECAST ARCHIVE SERVICES FOR OFFICE 365 An immutable archive which natively addresses compliance and ediscovery needs, as well as empowers end-users with a bottomless archive, searchable from a browser, desktop, the SmartPhone and tablet devices: An immutable, perpetual archive for all of current and historic employees Natively supports compliance, ediscovery and legal hold Empowers end-user productivity with personal archive searches through browser, SmartPhones, Outlook and tablet devices Pay only for current employees, not historic ones too, and no payment for DL s Can be easily added to Mimecast file archiving to create a compliant archive of all unstructured data 2013 Osterman Research, Inc. 10

12 HOW TO CONTACT MIMECAST UNITED KINGDOM AND EUROPE City Point One Ropemaker Street Moorgate London EC2Y 9AW 3 Old Street St. Helier Jersey Channel Islands JE2 3RG +44 (0) (0) info@mimecast.com info@mimecast-offshore.com NORTH AMERICA 203 Crescent Street 301 Howard Street Suite 303 Suite 1300 Waltham, MA San Francisco, CA USA USA (toll-free) info@waltham.mimecast.com SOUTH AFRICA Upper Grayston Office Park Ground Floor, Old Warehouse Building Phase 1 Black River Park South 150 Linden Road Fir Street Observatory Strathavon 2031 Cape Town +27 (0) (toll-free) info@mimecast.co.za 2013 Osterman Research, Inc. 11

13 2013 Osterman Research, Inc. All rights reserved. No part of this document may be reproduced in any form by any means, nor may it be distributed without the permission of Osterman Research, Inc., nor may it be resold or distributed by any entity other than Osterman Research, Inc., without prior written authorization of Osterman Research, Inc. Osterman Research, Inc. does not provide legal advice. Nothing in this document constitutes legal advice, nor shall this document or any software product or other offering referenced herein serve as a substitute for the reader s compliance with any laws (including but not limited to any act, statue, regulation, rule, directive, administrative order, executive order, etc. (collectively, Laws )) referenced in this document. If necessary, the reader should consult with competent legal counsel regarding any Laws referenced herein. Osterman Research, Inc. makes no representation or warranty regarding the completeness or accuracy of the information contained in this document. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND. ALL EXPRESS OR IMPLIED REPRESENTATIONS, CONDITIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE DETERMINED TO BE ILLEGAL. i ii iii iv v vi vii viii ix bad-week-cloud-microsoft-google-suffer-outages Microsoft Exchange Online Dedicated Plans Versions Service Level Agreement (SLA), October Osterman Research, Inc. 12