Executive s Guide to Selecting a Mainframe Disaster Recovery Provider

Transcription

1 Executive s Guide to Selecting a Mainframe Disaster Recovery Provider What to Look for in a Disaster Recovery Services Provider Accelerate Outsourcing, Inc. 1

2 Improve the Chance of a Successful Recovery By Choosing the Right Provider. Your choice of a disaster recovery services provider is one of the most important business decisions you ll ever make. The very continuation of your enterprise could depend on it. But with providers making such varying claims about their offerings, capabilities, facilities and approaches, comparing providers and making an informed choice becomes more difficult. Having established your own recovery time and recovery point objectives, you know what recovery means to you. But what does it take in a provider to meet or exceed your requirements? Here are some of the key objective criteria to look for in choosing your disaster recovery provider. Location, Location, Location. A facility intended to help you recover from a disaster should be located to minimize the likelihood of disruption to its own operations. For maximum safety, a recovery facility should be away from dense urban areas, symbolic targets and high risk activities. Ask for documentation or certification that the site is in a seismically stable area (U.S. Geological Survey Zone 1 or 2), is rated Grade 2 or below on the Saffir-Simpson Hurricane Wind Scale and that both the site and major access routes to it are above the 100-year flood plain. To provide convenient access, a facility should be within a 1-hour drive of a major international airport and have ground transportation and lodging options nearby. But the facility doesn t have to be hundreds of miles from your production data center. Too much separation could hinder, rather than help, your recovery. The best facility is the one you can get to when you need it. Resiliency and Reliability by Design. An effective disaster recovery facility is itself designed to withstand disaster. Resiliency requires full redundancy throughout the mechanical and electrical infrastructure. Duplicate power transformers, UPS systems, chiller plant, environmental controls, Accelerate Outsourcing, Inc. 2

3 cabling to customer equipment and emergency diesel generators can all help to keep a facility operating, no matter what. This level of redundancy also makes the facility concurrently maintainable, assuring that your service will not be interrupted during scheduled maintenance or repair. Carrier Neutral Network. If you will be contracting for cloud-based disaster recovery services, you need the ability to transmit data via your existing carrier or carriers all the way to the provider s recovery facility. Even more important than carrier neutrality, the provider should manage the last mile to their site and offer diversely routed, direct network links into multiple points of presence, reducing the impact of any single point of network failure. Layers of Security. Look at the ways the provider secures the facility against intrusion or damage. For starters, the facility should be as anonymous and private as possible, with no signage, shared tenants or public access. The perimeter should be fenced with anti-ram vehicle access control. Exterior doors and interior lobbies should be designed with blast protection and locked at all times. Access should be monitored by programmable CCTV and electronic or biometric authentication. Building-wide fire sprinkler systems and lightning protection are also essential to the security of your equipment, employees and data. Ask about the provider s approaches to data protection and chain of custody. How many copies of your data does it store, and how are they secured? Who Says So? Ask for the Certifications. Don t just take the provider s word that they have adequate security and protections in place. Their facilities, processes, staff and internal controls should be regularly reviewed and certified for safety and reliability by third party auditors. Ask to see their most recent audit. A few of the top certifications to look for include: Uptime Institute Tier III or IV certification to prove concurrent maintainability of Accelerate Outsourcing, Inc. 3

4 electrical and mechanical infrastructure. Payment Card Industry Council Data Security Standard (PCI DSS) that validates security standards for the major debit, credit, prepaid, ATM and POS cards. SSAE16 Type II / SOC 2, the objective certification standard for IT service providers controls for security, availability, processing integrity, confidentiality and privacy. FISMA, the Federal Information Security Management Act of 2002 that ensures providers meet the high security standards for handling government data. Ability to Deliver. What will you experience when you need the provider s services? Will you be able to pre-schedule test dates for the duration of your contract? Is their support staff flexible and responsive? A customer-focused provider does everything possible to ease, not impede, recovery tests and actual declarations. Practice Makes Perfect. Testing is a crucial element to a successful DR program. A service provider should make this a priority and encourage you to test. They should also help you throughout the testing process. Make sure they have a process in place to help facilitate and optimize your test time. Do they have a documented client testing procedure? Make sure you are not rushed through the process and have plenty of testing time. Are they providing hours of testing times or do they provide days? What if Your Processing Needs Change? In business today, anything can change without notice. That includes your backup and recovery requirements. So look for a provider that allows you the flexibility to increase or decrease your storage requirements without penalty. There is no reason for you to make a long term commitment for a fixed number of physical servers on a traditional hot site contract. You should expect flexibility in usage fees and charges. Accelerate Outsourcing, Inc. 4

5 What About Long Term Contracts? There was a time when the industry standard was 5 and 7 year commitments, with no chance to make updates without exorbitant fees. Those days are over, the business world has changed. A service provider should provide short term contracts and reasonable fees. Will You Get What You Paid For? Recent weather events highlight the value of guaranteed recovery at your primary recovery center versus the general industry practice of moving customers to different states or regions during multiple declarations. If you ve designed a hybrid solution in which your recovery depends on the integration of dedicated hosted assets (such as replicated storage) at your primary recovery facility with shared assets to be available at the time of declaration, you must demand a guarantee of recovery at that location. Being re-routed to a secondary recovery location, or having data in one place and computers in another, can be a disaster in itself. See for Yourself. If you re close enough to the provider s facility, ask for a tour. If that s not feasible, ask for a complete description of their equipment and facilities especially in terms of security, resiliency and maintainability. Hidden fee increases. As a crucial business and financial commitment, make sure that your Disaster Recovery service contract doesn t contain hidden fees in the fine print. Negotiate with your service provider to remove or cap annual renewal fees. No auto-renew provision. If your DR provider includes an auto-renew provision in their standard agreement, then you should be wary of moving forward. Although this tactic has become less popular, many companies still try to incorporate it into their contracts. Accelerate Outsourcing, Inc. 5

6 What to Do Next? This guide has been developed by Accelerated Outsourcing, your trusted advisor in Disaster Recover Solutions. We hope that it will help you make informed and reasonable decisions regarding both the choice to pursue a DR provider and the best ways to realize the benefits you desire. If you are looking for disaster recovery support or considering changing DR vendors then you might be interested in our Disaster Recovery Price Solution. This proprietary process will benchmark your costs against current market pricing to make sure you are getting the most competitive pricing in the marketplace. Just us at DR@accelout.com to request your free audit. Thank you for taking the time to read this document. I hope that you found it helpful. Adrian Bannister President Accelerated Outsourcing, Inc. abannister@accelout.com Accelerate Outsourcing, Inc. 6