Many Firms Are Overconfident In Their Disaster Recovery Ability

Transcription

1 A Custom Technology Adoption Profile Commissioned By Dell May 2014 Many Firms Are Overconfident In Their Disaster Recovery Ability

2 1 Introduction In today s world, workers expect 24x7 availability and IT services. IT administrators are increasingly tasked with making critical apps accessible at any time, from any place, and on any device, but they are often not given the resources that they require to meet these demands. Companies struggle to keep up with the influx of mobile devices and the changing landscape of employee and customer expectations. The result is that many organizations use a monolithic strategy to protect their entire environment, using the same tools and techniques for their most critical and least critical systems. The risk of this strategy is that it often leads to increased costs and complexity in the case of overprotection, or puts important business functions at risk in the case of underprotection. This Dell-commissioned profile of US and European IT security decision-makers evaluates current backup, protection, and recovery strategies in the face of growing business demands, as well as the increasing challenges of providing resilient IT services, based on Forrester s own market data and a custom study of the same audience.

3 2 Employees And Customers Demand Unprecedented IT Resiliency In our research report Develop Your Road Map For Business Technology Resiliency Tools, Forrester reported that due to poor planning and testing, the majority of companies aren t prepared for a disaster. For a range of reasons, many companies have not made the proper investment in mitigating their most common causes of downtime, which continue to be mundane events such as power failures, IT hardware failures, network failures, and human error. This effect is compounded by the increasing demands for 24x7x365 availability on a wide range of devices. Our study found that the top challenge in a modern IT protection and resiliency strategy is the growing number of connected devices and critical apps to support them (see Figure 1). Challenges in the lack of budgets and resources and the increased demand for 24x7 availability were not far behind. With this reliance on IT services and mobile tools, and the expectation that they can work from any location on any device at any time, members of the workforce no longer tolerate downtime in the case of a disaster. This expectation of constant availability is hugely problematic for IT departments, whose capabilities are frequently immature and poorly understood. Forrester reports that of those experiencing a disaster, the most common challenges faced in recovery have to do with meeting business expectations (see Figure 2). Furthermore, in a recent study of organizations that had experienced a disaster, when asked what had the greatest impact to their organization, the vast majority stated it was loss of employee productivity, followed by loss of employee morale. In light of this, IT is tasked more than ever with upgrading its disaster recovery and business continuity capabilities and a recent Forrester Forrsights survey found that 60% of firms consider this to be a high or critical priority. FIGURE 1 IT Security Decision-Makers Grapple With Providing IT Resiliency In The Face Of A Growing Number Of Devices And Critical Apps What are the biggest challenges that you have in your IT protection and resiliency strategy? Growing number of connected devices and critical apps to support them 57% Lack of budget/resources 50% Increasing demand for 24x7 availability 45% Difficulty determining which systems are critical and which are not critical Lack of focus/prioritization from top executives 26% 26% Other 1% Base: 148 IT security decision-makers. Multiple responses accepted. Source: A commissioned study conducted by Forrester Consulting on behalf of Dell, April 2014

4 3 FIGURE 2 Business Expectations Of Disaster Recovery Exceed IT Capabilities What was the cause(s) of your most significant disaster declaration(s) or major business disruption? Mismatched business expectations with IT capabilities Not knowing when to declare a disaster and execute a recovery Lack of communication between IT and the business Ranked 1 Ranked 2 Ranked 3 14% 12% 9% 17% 8% 3% 5% 9% 14% Plan not up to date with current environment 8% 5% 12% Insufficient planning for the specific scenario 8% 8% 9% Insufficient testing and overall preparedness 9% 9% 5% Service provider did not meet expectations 5% 12% 3% Lack of communication between recovery staff 15% 3% 2% Staff not available to execute recovery plans 8% 8% 3% Staff not knowing their roles during the recovery process 5% 8% 6% Lack of staff 5% 12% Plans not useful for actual recovery process 2% 5% 9% Limited budget/resources 5% 5% 5% Service provider was unresponsive 2% 6% 6% Base: 66 global disaster recovery decision-makers and influencers who have declared a disaster or had a major business disruption (multiple responses accepted) Source: Forrester/Disaster Recovery Journal Crisis Communication, Risk Management, And Business Continuity Survey, Q4 2013

5 4 Despite Increasing Demands, Resiliency Strategies Lack Maturity Forrester data shows that 71% of applications and data are considered to be either mission-critical or business-critical (see Figure 3). The first step in properly developing a business technology resiliency strategy is often to define recovery requirements for these various services or applications by placing them in different tiers. Within these various tiers, enterprises can assign standard recovery time objectives (RTOs), recovery point objectives (RPOs), and service-level agreements (SLAs) in order to optimize and standardize the disaster response and ensure business continuity given a limited set of IT tools. 1 However, due to lack of budget and prioritization as well as an inability to untangle the complexity of an environment, more than one-third of enterprises have not taken these steps, according to our study. Thirty-seven percent of the respondents we surveyed reported that they do not have different disaster recovery strategies for their various tiers of critical systems, and 34% do not have different strategies for backup (see Figure 4). What s more, only 31% of organizations test their plans more than once per year to verify they can resume operations according to stated SLAs (see Figure 5). This indicates an overall lack of maturity: Firms are either overprotecting their noncritical apps, which increases costs and complexity, or underprotecting their critical apps. In either scenario, they are putting the business at risk. FIGURE 3 Seventy-One Percent Of Applications And Data Are Considered Critical What percentage of your applications and data fall into the following tiers? Noncritical 28% Mission-critical 36% Business-critical 35% Base: 94 global disaster recovery decision-makers and influencers Source: Forrester/Disaster Recovery Journal Crisis Communication, Risk Management, And Business Continuity Survey, Q4 2013

6 5 FIGURE 4 Many Companies Do Not Distinguish Between Tiers Of Critical Systems FIGURE 5 Many Companies Do Not Frequently Test Their Disaster Recovery Plans Do you use different backup and recovery strategies for different tiers of critical systems? No 34% Don t know 1% How many times per year do you a conduct a full test (a live or simulated failover of all infrastructure at a given site) of your disaster recovery plan? More than twice a year Twice a year 11% 20% 34% Once a year 39% Yes 64% Less than once a year We don t test our plan 12% 17% Base: 148 IT security decision-makers Source: A commissioned study conducted by Forrester Consulting on behalf of Dell, April 2014 Base: 93 global disaster recovery decision-makers and influencers (does not include those who answered don t know ) Source: Forrester/Disaster Recovery Journal Crisis Communication, Risk Management, And Business Continuity Survey, Q IT Is Overconfident About Its Backup And Recovery Capabilities Despite the fact that mismatched expectations and poor communication are the primary challenges faced in disaster situations (see Figure 2) and that many companies do not have different strategies in place for their various tiers of systems (see Figure 4), most are still confident in their ability to meet business expectations for recovery of their most critical systems (see Figure 6). This may be a false confidence, particularly as our study found that the most widely used protection strategies are local backups (81%), which do not protect against full site failures and have longer RPOs, and backup to tape (53%), which is errorprone and leads to extremely long RTOs. IT may need a wake-up call if it truly wants to meet business expectations for recovery, investing time and resources into understanding the difference between its systems and applying policy appropriately. The best practice is to work with business stakeholders to define tiers of criticality of systems and then identify which technologies and processes can help achieve the business recovery objectives (see Figure 7). By undergoing this exercise, firms can optimize their available tool sets and minimize the impact of a system outage.

7 6 FIGURE 6 IT May Be Overconfident About Its Ability To Meet Business Demands How confident are you that you can meet business expectations for recovery of your most critical systems with your current strategies and technologies? Very confident 27% Somewhat confident 56% Neutral 13% Somewhat unconfident 4% Very unconfident 0% Base: 148 IT security decision-makers Source: A commissioned study conducted by Forrester Consulting on behalf of Dell, April 2014 FIGURE 7 A Framework For IT Resiliency Service tier Description Technology requirement Availability rate Recovery objectives* Missioncritical IT systems vital to operations Local clustering PIT snapshots Hot standby Asynchronous storage replication 99.99% RTO < 2 hours RPO < 15 minutes Businesscritical IT systems critical to operations 99.90% RTO < 4 hours RPO < 2 hours Businessimportant IT systems important but not critical to operations VT/nearline application replication 99.50% RTO < 8 hours RPO < 8 hours Businesssupporting IT systems that support noncustomer-facing and nonrevenue-generating operations System and data restore from disk or tape 99.00% RTO < 16 hours RPO < 8 hours *Recovery objectives following a catastrophic event or major site failure Source: Develop Your Road Map For Business Technology Resiliency Tools, Forrester Research, Inc., June 14, 2011

8 7 Methodology This Technology Adoption Profile was commissioned by Dell. To create this profile, Forrester leveraged the Forrester/Disaster Recovery Journal Crisis Communication, Risk Management, And Business Continuity Survey, Q Forrester Consulting supplemented this data with custom survey questions asked of US enterprise IT security decisionmakers directly involved in decisions regarding backup and disaster recovery for their organizations. The auxiliary custom survey was conducted in April For more information on Forrester s data panel and Tech Industry Consulting services, visit Endnotes 1 The business impact assessment (BIA) is an essential, but often overlooked, step in the business technology (BT) resiliency life cycle. It helps business continuity (BC) and BT resiliency teams identify your organization s most critical business processes and the dependent resources (e.g., people, physical facilities, and technology services) required to maintain the availability of those processes. It also helps you: 1) determine appropriate recovery objectives (e.g., recovery time and recovery point) for each process, and 2) quantify the impact that a major disruption would have on revenue, productivity, and customer experience. Source: Execute The Five Key Processes Of The Business Technology Resiliency Life Cycle, Forrester Research, Inc., February 24, ABOUT FORRESTER CONSULTING Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester s Consulting services connect you directly with research analysts who apply expert insight to your specific business challenges. For more information, visit forrester.com/consulting. 2014, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to 1-P8FT8N.