Selling Disaster Recovery as a Service

Transcription

1 Selling Disaster Recovery as a Service How you can make a lot of money by protecting your clients from disaster By Casey Morgan What would you do with some extra cash? You could expand your business, maybe buy your own data center. You can put your kids through college. Maybe you could finally buy that nice [insert expensive thing] you ve had your eye on. Don t feel guilty, we all want a little more cash. But how do you, as a managed service provider (MSP), ramp up your profits? Well, we ve got a secret, an easy way to make more money and we can sum it up like this: DRaaS. Disaster recovery as a service (or DRaaS) means simply taking care of all your client s data protection and disaster recovery needs for a monthly fee. In other words, you put yourself in a position to really take care of your clients and if you do it right, you ll find the extra money you re after. Don t worry. DRaaS isn t tough, but it may involve some rethinking about the services you re probably already selling. So, what exactly are you selling? Selling Answers to Problems The first thing you need to know is that DRaaS is not about selling simply backups. It s not even just about selling a way to recover. It s about selling a comprehensive service that solves downtime problems and saves money. StorageCraft partner Jimmy Georgiou, president of Solution Start, an MSP out of North Carolina, is using disaster recovery solutions to provide services to his clients. For him, the idea of disaster recovery as a service isn t so tricky. It s easy to talk about backup and disaster recovery with your clients when it s in the 1

2 proper format, he says. But, you can t just be in it for the cash: I find that when somebody is trying to sell a product or just trying to make money, that s when we run into problems. This advice might seem counterintuitive since the goal of this guide is to help you make more money, but Jimmy is right. You can t just have profit in mind when you re trying to sell backup and disaster recovery. There s more to it. This is all about showing value and minimizing risks, says Jimmy. Showing value and minimizing risk. So you re not selling products. Instead, you re using your products to solve your customers problems and to keep their businesses safe (both of which are truly valuable to them). So what about all that extra profit? If you keep them safe, and help them understand a few things about disaster recovery, the profit will come naturally. That means you re going to have to teach them a few things. Busting Myths about Backup and DRaaS By now, most businesses probably understand the need for backup (at least theoretically). The problem is that once they ve got their systems backed up, they assume they re golden. But this is an issue when you re selling DRaaS. If you re putting the value on the backups alone, then you re going to run into trouble later on when you try to convince them that they need more (which they do). Cliff Bean is the director of sales at Dynamic Quest, a fourteen-year-old MSP business out of Greensboro, North Carolina. Cliff doesn t sell backups because he knows that a simple backup isn t enough to protect a business. Instead, Cliff sells DRaaS and he makes a killing. Cliff says that the conversation should definitely focus on the whole disaster recovery process, rather than the backups, but he knows it s not always easy. The thing we ve fought against while training our sales team is getting them to talk about disaster recovery and not just backup. The tendency is to ask clients what they use for backup as a way in the door. Then they say we ve got a great solution, this is what it does. If a person is just focused on backup, then they can t see the value in a higher level of cost. If they look at it from a more complete disaster recovery standpoint, on the other hand meaning they ll be able to pull up a virtual server and keep things running and so forth then there s no contention. They see the value. DRaaS will cost your clients more than a simple backup because you re giving them more than a simple backup can give. As Cliff says, if you re not making it clear in your sales pitch that what you re offering is more valuable than backup, then your DRaaS efforts may not work out. We started out doing just backup, but we lost a lot of deals because of it. You re talking about either trying to sell clients a software license that s a $1,000 and takes a backup and that s it, or charging $500 a month for disaster recovery people don t always see the difference. But when you tell them you can spin up a server that s crashed or that s lost a hard drive or that has a warped motherboard and that they don t have to quit working because of it, their eyes really open. Backups have little value by themselves, but a full, quick recovery is indispensable. SolutionStart Founded in 2000, SolutionStart began as a network technology provider with an emphasis on customer support focusing on the North Carolina and Georgia area. Within a short time, the company identified a technology shortcoming in dental practices, so they strive to develop better network solutions for the dental industry. Due in part to their drive, SolutionStart has evolved into the Southeast s premier technology provider for the dental industry. 2

3 The biggest value of DRaaS is that it allows you to get your clients systems up to par quickly and with as little lost data as possible. Remember, you re not selling products. You re selling answers to dozens of the biggest problems a business can encounter, and solutions to the costliest problems. You do this not by selling backup, but by selling a full disaster recovery solution that can demonstrably keep data safe, accessible, and recoverable at a moment s notice. Asking the Right Questions So you may need to refine your pitch. Backup and disaster recovery is a no-brainer for most businesses an insurance policy, really but many of their owners have never thought about the risks they face every day. When you re selling DRaaS, it s your job to help them think practically about the consequences of downtime and data loss. If you can t do that, you ll have a hard time illustrating the value of what you have to offer. Dana Gargano is the president and co-founder of Network Synergy, a Connecticut-based MSP that provides IT services to small and medium size businesses and from its inception has provided disaster recovery as a service for its clients. He puts it like this: Most clients know they need a backup and disaster recovery solution. They realize that there is a risk of having all of their data in one location and they need to replicate that data offsite. If a managed service provider is having a tough time selling, it probably has something to do with their marketing pitch and their solution. In other words, most of your clients are willing to answer yes. You ve just got to ask the right questions. Remember, you re not trying to scare them. You re trying to education them, to make them think. Your ultimate goal should be to find out exactly how much downtime can cost the prospective client. This is the key to showing him or her why a complete disaster recovery service is worth the price. Here are some sample questions you could try: What would you do if your most important equipment went down tomorrow? Would you be able to work without your most important server? Would employees? How much data can you afford to lose? How would you go about getting systems back on track if you had a failure? Do you know which systems are most important to your business? What are your recovery time objectives? What are your recovery point objectives? (see Appendix A: Recovery Objectives) All these questions should lead to the one question that really hits home: How much money are you losing while crucial equipment is down? Of course, the answer to this question differs greatly from business to business. Your clients may not even be prepared to determine an answer, so you need to be ready to help them. Chances are, you already have a downtime calculator of some kind, but if not, you need one. Appendix B: Cost of Downtime walks through the process of determining hourly downtime, so if you re not sure where to start, start there. Dynamic Quest Dynamic Quest is a Greensboro, North Carolina-based technology service provider that has serviced B2B businesses for fourteen years. Dynamic Quest is composed of teams that vary from software developers to IT administrators and work with clients from the US and Mexico all the way to the Asia. With data center, help desk, and business consulting options, Dynamic Quest has many specialized services to provide the right option for nearly any client. 3

4 Selling Disaster Recovery As a Service Once you ve identified how much their downtime will cost, it s time to have a frank discussion with prospective clients about what their current recovery abilities are. Specifically, you want them to think about how long it would take them to recover. Then, you re ready to discuss how you can help. Identifying Goals When you sit down to start talking solutions, keep in mind that your clients might not care about the nuts and bolts. As Jimmy says, recovery plan that they can see fits into the requirements they created (see Appendix A: Recovery Objectives). Business A, for instance, might be fairly tolerant to downtime and can afford to be down for a few hours, but business B might be a healthcare practice that can t be down for more than a few minutes they also probably have HIPAA requirements to contend with (see Appendix C: HIPAA and Compliance). By knowing this, you can tailor your solution to their individual needs and give them the confidence that you re protecting them and their businesses. As Jimmy puts it, A customer doesn t care about the granular details of what it takes to get back online. They just care about doing business. They don t care if they re using an existing server, if it s a loaner server, or if it s running from the cloud. All they want is to do business. The truth is that it s easy if you can deliver clients the value and show them the problems you re solving. You tell them you will deliver a solution that will take away sleepless nights and potentially lost data. So your clients might not care about the details, but you should, and in order to do that, you need to know about your client s budget and goals. If money were no object, every client would have top-of-the-line equipment with every recovery option imaginable. But obviously, money is an issue, so your services will always be some type of compromise between your customer s budgets and their goals. Using Service Agreements Sometimes you can do everything for the amount they re willing to pay. Other times you might not be able to meet their goals without them spending a little more money, so it s important that you understand what they really need and how much they re expecting to pay. For example, you should work with them to develop their recovery time objectives (RTOs) and recovery point objectives (RPOs) so you can develop a disaster 4 Most often, the way you communicate the products and services you have to offer is through a service agreement (often called a service level agreement or SLA). In essence, a service agreement is a contract between you and your client that outlines the results you re guaranteeing (i.e., how much uptime they can expect, what machines and software you re managing, how quickly they can expect you to resolve problems, etc.), as well as all of the business side of the deal (such as how much you charge and when they should pay). Service agreements benefit everyone involved because they clarify expectations on both sides, but they re especially useful to you when you re offering disaster recovery as a service. For one thing, when you re offering DRaaS, you re working with some of your Network Synergy Network Synergy has been serving the Trumbull, Connecticut area since 1988, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses. Their goal has always been to provide enterprise-level IT practices and solutions to the small business sector, with small business prices. Their experience has allowed them to build and develop the infrastructure needed to keep their prices affordable and their clients up and running.

5 client s most valuable assets, their data and the uptime of their systems. A good service agreement helps that client understand exactly what they re paying for by explaining everything you re doing to meet the RPOs, RTOs, and other goals you ve already discussed. But service agreements benefit you as well. They put you in control of your services and the way those services are perceived, so it s important that your agreements reflect your own business. For example, Cliff s agreements demonstrate one of the major values of DRaaS to his clients: Our service agreements offer a fixed cost for the client in most cases. We just adjust the cost for each client based on how much data they have. Customers like this because they know how much to budget each month. We ve been successful promoting a recurring cost model for backup and disaster recovery because it gets IT off our client s plate, it s fully managed, we generate reports for them, and they don t worry about anything. They can protect you as well. Jimmy, for example, won t sign a client unless that client agrees to do certain things. I refuse to onboard a client that isn t willing to, at a minimum, use our managed firewalls and backups if they can t or won t do it, I won t work with them, he says. It may sound harsh, but it s what Jimmy needs to do his job. As he puts it, I want to sleep well at night too. I m a business owner I m out shaking hands and signing agreements with clients that say I ll take care of them. How do I sleep at night with solutions in place that I can t guarantee and that put me at risk? When it comes to backups, you re talking about making sure your business can do business. So when you re thinking about service agreements, consider some advice Jimmy has. In today s world, things have changed. Doing business isn t just about an hourly rate it s about aligning business models. I m guaranteeing a certain level of service for my clients. I m not making money if I m not doing a good job and causing them a headache. The fewer headaches they have, the more profitable I am. If clients have headaches, I m unhappy, losing money, and wasting resources. We build and design our business to do things in the best possible way from the beginning. Delivering DRaaS So now it s time to talk solutions. As you re figuring out what exactly you want to sell (or how you re going to meet all the requirements in those service agreements), two criteria should be at the top of your mind: flexibility and reliability. We ve already pointed out that each client has different needs, so you ll want to use solutions that are flexible enough to support any kind of business. For example, when you re choosing vendors, ask yourself, how many of my clients will this vendor work for? If the answer is, only some, then it may not be the best investment for you. Arguably more important than flexibility, however, is reliability. Why? Because with DRaaS (as with all managed services), you make the most money when things are running smoothly. Indeed, the most profitable solutions are the ones that you spend the least amount of time tinkering with and worrying about. As Jimmy says, Service Agreements For more information on setting and using service agreements, check out the following articles on the StorageCraft Recovery Zone blog: Objectives, Requirements, and SLAs, Oh my! Service Agreements are Fundamental to Your Success: The Basics of a Good Client Relationship Right-Sizing Your Service Agreements: The Three Primary Types of Client Agreements Every MSP Needs 5

6 You need to be able to deliver something. If you re thinking short-term, you can think of all kinds of things to do to make money, but you ll end up paying for it. If you hope to have long-term business that has some substance to it which isn t always the case for some businesses you want to be seen as a reliable and trusted source for services. It s about reliability. You need to deliver something that s making money, is reliable, and fulfills all of the promises to clients. With that thought burning quietly in the background, let s look at how some of our most successful partners are packaging and delivering the services that fulfill promises and make them money. Onsite solutions Building your own BDR Unit Some MSPs make and sell their own disaster recovery hardware, commonly called BDR units. To some this may sound like a cheap, scabbed together machine, but no. These are carefully designed and even branded machines built to do disaster recovery work for various sizes of client. Remember Cliff? His company builds its own backup and disaster recovery appliances for clients. These can be simple to design, deliver, and profit from. He explains, We rollout a BDR device with our disaster recovery software installed. Our customers pay a setup charge and a monthly fee and we provide hardware standardization based on what the client needs as far as CPU, RAM, and disk space. The installed software is our main resource for creating backup images, creating restore points, and for replicating client backups back to our data center. The BDR unit uses redundant hardware, which can pull up the backup images and run them as virtual machines. This isn t just a backup, it s a true disaster recovery system. Some clients are larger and might require an additional BDR unit. Cliff says they ll put multiple BDR appliances out for larger clients, but really, you can do whatever it takes to fit their needs. Remember also, that while these provide great local recovery options, they re just step one. Step two is offsite backup, which can be used to supplement backup from BDR units. Setup fees and recurring revenue for MSP Excellent onsite backups with quick failover options May have options to replicate backups to secondary site Requires additional knowledge and effort BDR must be built and configured by MSP May or may not have secondary replication options (this is up to individual MSPs) Purchasing a BDR Unit If you want the power and flexibility of a BDR unit, you don t necessarily have to go it alone. Many storage and disaster recovery vendors offer pre-built, plug-n-play functionality that can be an easy foundation to your disaster recovery offering. In general, purchased BDRs function similarly to ones you might build, in many cases offering impressive features that make disaster recovery a snap. Replication, virtualization, and recovery are all within the realm of 6

7 possibility with a purchased BDR and using them is usually pretty straightforward. Cost may be an issue when you re buying a third-party BDR, but in return, you get ease of use and immediate implementation. The other real downside of third-party BDRs is that they don t always allow for the kind of customization you may want. Plug-n-play functionality Robust disaster recovery options Technical support Possible added cost Limited customization Using an existing server for DR Clients come in different sizes and they all have different types of equipment already set up in their network. There are situations where a client s existing server can be used as a BDR unit so the client doesn t have to purchase a new server and a new BDR device. Dana Gargano says that Network Synergy occasionally takes this route: Typically, if they have a server that s not very old that we re replacing, we can set up it up as a BDR. We usually couple this with a NAS device. If they don t have aging hardware, we make the case for them to buy an additional unit for BDR. Clients will usually see the value in that. Bear in mind that this can save a client money and give them the benefit of upgraded server hardware, but hardware failure is known to happen. When you re thinking of where your backups are going, you want it somewhere safe. Clients should be aware that new hardware is a better place for backups, but if they really can t foot the bill, using an older server does give them some protection. Makes use of aging equipment Saves clients money over purchasing new servers or BDR equipment Can be configured for offsite replication Less reliable than new hardware Doesn t always give MSPs the opportunity to sell new equipment Offsite solutions Some MSPs just back up locally and leave it at that, but as you know, you ve got objectives to meet and downtime to prevent. In order to really be resistant to disaster, you need to consider the redundancy only the cloud and other offsite backups can offer. It s easy to think of offsite backup as an extra, but MSPs like Dana, who successfully sell disaster recovery as a service, know that offsite replication is so important that they won t do onsite backups for a client without also supplementing them with offsite replication. As he says, For us, replication and backup are built into the same offering. It really doesn t make sense to do one without the other. Whether you sell cloud backup as an add-on or as something built-in to your standard agreement is up to 7

8 you, but it s best to have local backups and secondary backups elsewhere because you never know what local disasters can affect your clients. The options for offsite we ve listed here vary from simple to more complex. Hot-swapping Having only one onsite backup isn t really disaster recovery. Whatever it takes, your clients are safest with secondary backups somewhere offsite. The simplest way is for your clients to take a copy of the backups home with them. Jimmy explains that he s got a number of clients who choose this option. For those that don t want to spend the money on the disaster recovery piece in the cloud there are small businesses that just don t have the money they can use local hard drives that store backups and take those home with them. This is their version of a replicated backup. The data can be encrypted to meet the NSIT standards and it s still HIPAA compliant [see Appendix C: HIPAA and Compliance]. It allows them to create backups for clients who don t want to or can t spend the money. Remember however, that this option is limiting. As Jimmy says, It s a hassle and it can take a lot longer to bring systems back online. Plus, this might not bring you any recurring revenue. Jimmy, for example, doesn t charge a monthly fee for this because it isn t technically DRaaS. Once set up, clients will be responsible for taking the backups offsite, essentially managing part of the process themselves. The money to be made here might be limited to any hardware you can sell (if you re a reseller) and any setup fees involved, but it still does offer limited protection, which is important for your clients, even the ones with smaller budgets. Potential profits from sale of hardware Basic secondary backups Least expensive option for offsite backups No instant recovery options; recovery can take many hours if onsite backups are lost Backups must be taken offsite by the client daily No recurring revenue for MSP Replicating from one BDR to another The options for offsite replication are many, but when it comes down to it, more control might be better if you can afford it. Keep in mind that some vendors have BDR devices that can replicate to one another, a handy way to keep backups both onsite and at an alternative location. This is also a route you can take if you ve built your own BDR devices. It can be costly, though it is an extremely simple and effective way to have backups onsite that are automatically replicated offsite, and often with virtualized recovery options. Recurring revenue for MSP Easy setup and delivery Easy offsite replication No cloud or data center required Requires two BDR units May not have instant recovery options 8

9 Replicating to general-purpose cloud The option that really opens the doors of flexibility is offsite cloud replication. This step is not only profitable to you as a provider, but it also offers the most protection and value to clients. There are lots of places you can store backups like Amazon Web Services or Windows Azure. Really, anywhere that can store data can store your backups. Just remember that these vendors usually don t provide quick recovery options, and as Dana notes, working with some of them might affect your ability to meet your service agreements, A lot of MSPs will rely on a third party, but it s tough to meet aggressive SLAs when you re dependent on another party to do it, he says. Geographically diverse off-site backup Usually inexpensive Recurring revenue for MSP May compromise your service agreements Loss of control, especially in a disaster Replicating to a purpose-built cloud Recovering from general clouds often takes too much time to be effective for all clients, but purpose-built recovery clouds (like StorageCraft Cloud Services ) are designed to meet aggressive service agreements. For clients who require offsite storage and recovery options, going with one of these purpose-driven clouds is a fantastic choice. Replicating backups to a purpose-driven cloud is simple, and once images are in the cloud, any of them can be spun up as a virtual machine in a matter of minutes, on demand. This is a true disaster recovery cloud with amazing recovery options that s something you won t find with most third parties and something you may find challenging to match with your own data center. Quick recovery from an offsite location Geographically diverse backup Recurring revenue for MSP May give up some control Replicating to your own data center While you can use a third party like Amazon Web Services, Windows Azure, or StorageCraft Cloud Services, some of the most profitable MSPs build their own data centers and see it as a valuable investment and revenue-generating tactic. It allows them to set their own pricing and meet their objectives on their own terms. They can use it for basic storage, disaster recovery, or even hosting virtual systems in some cases. But is it worth the cost of entry? Dana and Network Synergy built their own certified data center when they realized they had the client base to support it and use it profitably. When it comes to disaster recovery, our pricing is based on our own data center we ve eliminated the middle man so the pricing is up to us. If you re replicating backups, a data center can make sense, but a 9

10 lot of MSPs might not go for the investment. You need SANs, other storage devices, and VMware clusters to build a robust network. As long as you ve got the clients to support the data center, it s probably worth the investment. When we started, we had about five hundred active clients we knew we could sell offsite backups to, so we did it this was even before a lot of cloud providers were doing it. We can tell our clients that their data isn t being shipped off to another location, we have clients who worry about security, but we can tell them we ve got an SAE 70 certified data center and that all the controls have been tested and audited. It s a costly investment, but it can pay out serious dividends in the long run. Another option MSPs may consider is co-location, which may allow them to have much of the control they seek, without the cost of actually investing in all the hardware. Full control over systems Full control over pricing Local storage of client data Availability of additional revenue options like archiving, basic storage, hosting, etc. Hefty initial investment of money Hefty initial investment of time Requires excellent knowledge of networking Requires additional staff and maintenance time Places more responsibility on the MSP Archiving Archiving and disaster recovery are different things, but that s not to say archiving isn t a useful service to offer. Remember that for backup and disaster recovery, the goal is to reduce downtime. Archiving is for data that s not likely to be accessed frequently, and won t need to be accessed at a moment s notice. As Cliff says, Data archival is another solution we d put offsite, so data that s not frequently accessed, or stuff that needs to be stored for a long time, ends up in a storage facility. This means they don t have to use local resources to store it, but they still have access if they need it. Data protection and management really involves a variety of solutions that can either be bundled or sold singularly. Archiving can be as simple as taking a full backup of a client s machines and storing them in your data center, or a third party archival service like Amazon Glacier. Once again, and we can t stress this enough: archiving is not disaster recovery. Your clients need to understand that archiving is for data they don t need to access immediately. Think old records, old tax info, etc. Archiving is for things they won t need to do business tomorrow. Disaster recovery is for everything they need access to if they want to keep doing business. Inexpensive, long term storage Per GB storage profits for MSP Saves money on storage of backups No quick recovery options Not a true disaster recovery solution 10

11 Testing and proving value Once you ve got backup solutions set up, it s easy to think you re ready to rest on your pile of money. But the next step is actually the most crucial. Your clients might not see the continued value of your services if you can t show them that you ve been actively trying to keep their systems safe and recoverable. As Jimmy puts it, There s nothing better than showing recovery to your clients. You just say, look, if things go down, this is exactly what happens, then you run the test and show them a recovery. This builds credibility and shows that what you re saying is actually what you can do. There s a lot of value there. Not only that, but you certainly can t meet your service agreements if you can t recover your clients data when a failure or disaster comes their way. Testing is great for your clients peace of mind and it s the only way you can verify that you can live up to your agreements, so it s great for your bottom line too. As Jimmy explains, People often have backups, but they don t know if they work and just have to believe their IT provider is being truthful. You ve got to show them how this stuff works so they understand why they made the investment. The first thing to talk about is how you can make sure your clients know their data is safe. One way is by sending them backup reports. These show them which backups kicked off, that they were successful, and verified. Depending on your software vendor, you can often automatically these updates to you or directly to clients so the whole process is simple and automated. Notifications can be set up to tell you when a backup failed, when your attention is needed on a certain backup operation, when storage space is running low, and so on. Regardless of the method you use, the most valuable tests are, as Jimmy says, the ones that allow you to actually demonstrate a recovery. With StorageCraft Recover-Ability, for example, you can mount backup images as NTFS letter drives so your clients can browse through their files and folder as if the backup were simply another attached hard disk. Similarly, with StorageCraft, you can virtualize a backup image, so you can demonstrate that in an actual disaster, the system can be up and running in minutes. A true disaster test Bear in mind that spinning up a backup as a virtual machine (VM) is a good way to test a backup, but it s not a good way to test a disaster recovery plan. In an actual disaster, even if it s not very big, there are many things that can go wrong. It s important to think about how you ll handle various disasters your clients can have. There s more to that kind of recovery than spinning up a VM, so be sure to set aside a day on a weekend or afterhours to test a full disaster recovery plan with your clients. This is crucial for any type of business, but for those with sensitive medical records, annual testing is the law (see Appendix C: HIPAA and Compliance). For more on disaster recovery planning and testing, see our Making Disaster Recovery Easy Profit-Ability Guide. Refining the process We ve gone over a lot of things in this guide and sure, it s a lot to remember. Just know that as with any process, it takes time to get it down pat, so don t get discouraged as you re refining your sales approach. You ll find that some approaches work better than others and that educating current or new clients about the importance 11

12 of DRaaS could involve something simple like a oneon-one conversation with a decision maker, all the way to having a robust presentation with stats and graphs. Whatever the method of delivery, your pitch will always be best if you focus on the value your services have to clients. Remember also that you should always be improving, and not just your sales pitch. Consider new issues in the disaster recovery space that your clients might have and stay up on the latest storage and backup technologies. Since compliance is always an issue, it s wise to stay on top of the latest requirements for data security, whether it s for HIPAA in the healthcare industry or Sarbanes- Oxley in the financial industry. There are always new and rising concerns for any business segment and understanding them is a big part of refining your services to provide more value, and as we know, value more than anything else is your path to profit. So what are you waiting for? 12

13 Appendix A: Recovery Objectives When you re trying to understand your clients tolerance to downtime, there are two things you ll really want to know: How long can they be without a certain piece of equipment? How much data can they afford to lose? The answer to these two questions will help determine the two most important numbers for backup and disaster recovery planning: recovery time objectives and recovery point objectives. A recovery time objective, or RTO, is most useful in helping you understand the kind of recovery strategies and technologies you need in place to successfully recover from a disaster. Put simply, RTO is a measurement of your client s tolerance for downtime. Once you know what that tolerance is, you re in a better position to plan the recovery. Note that RTO is not really useful in helping you recover data or set up backup schedules. Instead, it prepares you to get your systems up and running before clients start hemorrhaging money, reputation, and so on. For a more detailed guide on determining RTOs with clients, read What is RTO?. A recovery point objective, or RPO, is the other metric you need to discuss with clients. RPO is a useful tool when it comes to planning and executing backups. At its most basic, an RPO is a measurement of tolerance for data loss and it can help you and your clients decide how often they need to be backing up, as well as what sort of infrastructure you need in place in order to support those backups. Keep in mind that, despite its name, an RPO has less to do with the actual execution of a recovery than it does with helping you lay the groundwork, so when you do have to recover, you ll recover everything you need. For more information on RPOs and how to determine them, read What is RPO?. 13

14 Appendix B: Cost of Downtime Here is a formula to give you an idea about what downtime will cost your clients. First, you need the labor cost per hour. Fill in these columns: To get your revenue lost per hour, use this formula: ((Column E / Column F) / Column G) = Column H, the total revenue lost per hour: H Total revenue lost per hour: A B C Number of employees Average employee wage per hour Average % of lost productivity (percentage of workforce affected by downtime) From this you can determine how much an hour of downtime costs this business, using this formula: Column D + Column H = Column I, the total cost of downtime per hour I Total hourly downtime cost: To get your total labor cost per hour, use this formula: (Column A * Column B) * Column C = Column D, total labor cost per hour Next, think about how long a downtime event would likely last: D Total labor cost per hour: J Duration of downtime (hours): Once you ve got that, you need the amount of revenue you lose per hour. Fill out these columns: Now, in order to determine how much one downtime event will cost, use this formula: E Gross annual revenue Column I * Column J = Column K, the total cost of one downtime event F Day per year open for business K Total downtime cost: G Hours per day open for business 14

15 Appendix C: HIPAA and Compliance Many industries are regulated either by their local or federal governments, or by other governing organizations. In the United States, for example, many businesses must comply with the Health Insurance Portability and Accountability Act (HIPAA). HIPAA is a federal regulation in the United States that requires medical and dental practices to maintain certain compliance standards with a special focus on the protection of digital health records. It s important to understand the regulations that guide the businesses you re working with, not only so you can help them comply but because it can help your business. For example, an MSP in the U.S. can be a HIPAA consultant for their clients, at least where technology is concerned. Since non-compliance can mean hundreds of thousands of dollars in fines, any business in the healthcare industry needs to think carefully about HIPAA, and you can help. Jimmy Georgiou is the perfect example of how this can work. His business focuses strictly on dental practices and he even speaks nationally on HIPAA technologies and the future of dental offices. As he explains, technology is a huge part of HIPAA. One piece of HIPAA is risk management and the other is disaster recovery it s critical when it comes to HIPAA, he says. Being compliant means data is carefully protected, and an MSP needs the right solution to provide to clients with sensitive records. Of course, downtime is a big concern for medical practices as well, Practices can t have downtime, says Jimmy, It creates an incident and an incident needs to be documented and audited a lot of red tape comes in. Jimmy also explained that the cloud becomes extremely valuable to clients with HIPAA concerns because it allows them to spin up virtual machines, and keeps all of their data safe and encrypted. Their data is protected in a number of ways and their recovery options are plenty, which helps them overcome their particular recovery objectives. Clients with HIPAA and other compliance needs (such as Sarbanes-Oxley, another U.S. regulation) should be made aware of the risks they face if they don t take proper measures. Your job as an MSP is to help them understand the risks of fines and provide them with the solutions they need to overcome downtime and keep medical records safe. This is a huge value to your clients and a can be a big bump in profits to you. Don t forget to discuss HIPAA compliance as you re making your pitch to clients old and new. 15

16 Authors Casey Morgan is the marketing content specialist at StorageCraft. A University of Utah graduate and lover of words, his experience lies in construction and writing, but his approach to both is the same: start with a firm foundation, build a quality structure, and then throw in some style. If he s not arguing about comma usage or reading, you ll likely find him and his Labrador hiking, biking, or playing outdoors he s even known to strum a few chords by the campfire. 16

17 About StorageCraft At StorageCraft, the goal of complete disaster recovery drives everything we do. Our StorageCraft RecoverAbility solution is an end-to-end, best-in-class backup and disaster recovery solution that is both fast and reliable. StorageCraft Recover-Ability It starts with a good backup. Our award-winning StorageCraft ShadowProtect takes complete, pristine images of your machines, including all your operating systems, applications, services, and settings. It then records changes at the sector level, so you always have an up-to-date copy of every machine in your IT environment, whether it s a critical server or an employee laptop, physical or virtual. We even work with specialized database servers, like SQL, SharePoint, or Exchange. You can get granular recovery in Exchange with ShadowProtect Granular Recovery for Exchange. You have complete control over the frequency of your backups and you can set rules for consolidation and retention to manage your precious storage space using StorageCraft ImageManager. Plus, with StorageCraft ShadowControl CMD you can monitor the machines in your backup environment from a single interface and get alerts when a machine is running out of space, when a backup doesn t happen, or when any of a variety of conditions you specify is met. We also give you tools to test your backups using StorageCraft VirtualBoot and StorageCraft ImageReady technologies, which gives you confidence that your data is safe and that a disaster won t shut you down or hold you up. Then we make it easy to replicate your backup images with StorageCraft Cloud Services or to our cloud or to your own offsite location so you can always have your data close when you need it and at a good safe distance when a disaster comes. When it does, you can launch your backups as virtual machines with VirtualBoot or mount them as drives for complete, granular access to your data. Or you can pre-stage the recovery of a backup image in a virtual machine with our patented StorageCraft Contact Us StorageCraft Technology Corporation S. Election Road, Ste. 100 Draper, Utah USA Phone: Fax: contactus@storagecraft.com HeadStart Restore technology, so if your main server blows up, you can be up and running in minutes. You can even virtualize your data in our cloud so even Mother Nature can t keep you down. Then, you can rebuild your infrastructure and recover to all kinds of machines, physical or virtual, using our StorageCraft Hardware Independent Restore technology or ShadowProtect IT Edition. You can t be sure what kind of disaster will strike you next, but with the StorageCraft Recover-Ability solution, you can be sure it doesn t matter. You ll be just fine. Copyright 2014 StorageCraft Technology Corporation. All rights reserved. This publication is for informational purposes only. STORAGECRAFT MAKES NO WARRANTIES, EXPRESSED OR IMPLIED, IN THIS PUBLICATION. StorageCraft, ShadowProtect, ShadowControl, intelligentftp, ShadowStream, ShadowCloud, and HeadStart Restore names and logos are registered trademarks and ImageReady, CMD, VirtualBoot, Hardware Independent Restore, Recover-Ability, ImageManager, and Cloud Services names and logos are trademarks of StorageCraft Technology Corporation. All other brands and product names are trademarks or registered trademarks of their respective owners.