2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBS

2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBS

BUSINESSES RUN ON DATA. To ensure that data is available to keep a business running, every small to medium sized business (SMB) needs to be prepared and think ahead. If an SMB waits until it is hit with a crashed computer, a security breach or a natural disaster, its data the lifeblood of its business may never be recovered. If an SMB s data backup system fails, so could the business. According to the U.S. Small Business Administration (SBA), approximately 40-60 percent of small businesses never reopen their doors after a disaster 1. In financial terms, reports place the cost of data loss for businesses at an average of more than $500,000 over the course of a year 2. This 2014 Report on the State of Data Backup for SMBs reveals key insights around data backup, security and recovery as a result of a survey conducted during the first quarter of 2014 by Carbonite, Inc. The survey compiled responses from 500 IT staff at companies in the U.S. with fewer than 100 employees, and includes highlights of current trends, observations, opinions and attitudes about the state of data backup from the small business IT pro s point of view. As a result of collected responses, five key themes have emerged priorities IT professionals should consider as they work to improve their data backup, security and recovery strategies in 2014 and beyond. Questions in Carbonite s Report on the State of Data Backup for SMBs focused around three data-centric areas: BACKUP SECURITY LOSS Frequency, Location, Automation Concerns, Encryption, Best Practices, Policies Damage, Preparedness and Experience Results from these questions revealed five key themes about data backup for SMBs: 1. DATA IS A SILENT KILLER TO THE BOTTOM LINE: Respondents recognize that the financial impact of data loss on their businesses has the potential to put them out of business. 2. THE NON-FINANCIAL IMPACT OF DATA LOSS: Most IT personnel have experienced data loss and have seen that its impact goes well beyond just profit-and-loss issues. 3. DATA SECURITY AMONG SMBS: Most small businesses are more concerned with internal security issues than they are with external ones. 4. DATA BACKUP IS UNDERUTILIZED: Failing to back up data every day poses a risk, yet most SMBs perform infrequent backups and do not trust employees to take the initiative of backing up their own files. 5. BACKING UP ONLINE AND TO THE CLOUD: Where data gets backed up varies greatly, but a majority of SMBs do seem to recognize the benefit of backing up to the cloud and online. 1 Beesley, Caron. 4 Ways to Safeguard and Protect Your Small Business Data. SBA.gov. January 10, 2013. http://www.sba.gov/community/blogs/4-ways-safeguard-and-protect-your-small-business-data. 2 Walker, Danielle. Study: IT leaders count the cost of breaches, data loss and downtime. SCMagazine.com. November 20, 2013. http://www.scmagazine.com/study-it-leaders-count-the-cost-of-breachesdata-loss-and-downtime/article/321782/ 2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBs I 1

BACKUP

THEME 1: DATA IS A SILENT KILLER TO THE BOTTOM LINE Respondents recognize that the financial impact of data loss on their businesses has the potential to put them out of business. When it comes to the impact of data loss on their companies, IT professionals at SMBs are realistic about the deep damage that can be caused. When asked, Approximately how much would it cost your company in lost revenue if it lost all of its data files? the largest number of respondents nearly a third (31 percent) said the cost would exceed $500,000. This number is not only consistent with reports of the average cost for data losses among businesses in the U.S. cited above, but also shows how the size of the business affects the size of the financial risk. Of those who predicted that a total loss of data would cost their companies more than $500,000 in lost revenue, nearly three-fourths (72 percent) were from companies with more than 50 employees. By contrast, of the 23 percent who placed their potential loss at $10,000 or less, a significant majority (59 percent) represented companies with fewer than 50 employees. Approximately how much would it cost your company in lost revenue if it lost all of its data files? 31% Over $500,000 23% $100,000 - $$499,999 23% $10,0000 - $99,000 23% Less than $10,0000 The respondents recognition of how much damage data loss could do to their companies was reflected in their preparedness. When asked, How prepared or unprepared would your company be if it experienced data loss? a vast majority (89 percent) claimed to be prepared at some level with only two percent feeling like they were very unprepared. Somewhat Unprepared 47% Somewhat Prepared How prepared or unprepared would your company be if it experienced data loss? 9% 2% Very Unprepared 42% Very prepared 2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBs I 2

Despite being confident in their preparedness, respondents were far less positive about how a major data loss would impact their companies. When asked, How likely or unlikely would your company be to go out of business if it permanently lost all of its data files? 41 percent placed the possibility of failure at either Very Likely or Somewhat Likely. While 40 percent of businesses with fewer than 50 employees and 39 percent of those with more than 50 employees felt there was at least some chance of their businesses failing, nearly a third of businesses with fewer than 50 employees (29 percent) felt failure was Not at all Likely as opposed to just 16 percent of businesses with more than 50 employees (16 percent). How likely or unlikely would your company be to go out of business if it permanently lost all of its data files? 18% Very Likely 22% Not Likely at all 37% Not Very Likely 23% Somewhat Likely THEME 2: THE NON-FINANCIAL IMPACT OF DATA LOSS Most IT personnel have experienced data loss and have seen that its impact goes well beyond just profit-and-loss issues. Data loss was familiar to most who took the survey. Nearly two-thirds (62 percent) of IT professionals surveyed had experienced some form of data loss in their careers. Those who had experienced data loss were asked what, if anything, resulted from the data loss (respondents were allowed to cite more than one result for this question).* Financial impact due to either profit loss or a missed business opportunity both were cited by a third of those surveyed (33 percent and 32 percent respectively). Additional results can be seen below. The survey found that data loss also negatively impacted employees with respondents citing some employee impacts even more often than loss of customers (20 percent). Negative impacts on employees included: work/life balance of employees suffered, office morale suffered, the IT department became micro-managed, employees were fired or laid-off, or employees quit. If you have ever experienced data loss at your company, which of the following, if any, were the results of your company s data loss? Profit loss Missed business opportunity 25% Work/life balance of employees suffered 24% Office morale suffered 21% IT department became micro-managed 20% Loss of current customers 33% 32% 15% Employees were fired or laid-off 11% Employees quit 1% Other 4% None of these I have never experienced data loss at my company 0% Don t know/refused 38% *Respondents were allowed to select more than one answer 2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBs I 3

SECURITY

THEME 3: DATA SECURITY AMONG SMBS Despite having data security policies and procedures in place for employees, most small businesses are still more concerned with internal security issues than they are with external ones. It is evident from the survey results that IT professionals at SMBs are not overly concerned with outside forces exploiting vulnerabilities in their systems to steal data. While 22 percent of those surveyed placed the likelihood of an outside threat at either very or somewhat likely, an overwhelming majority (78 percent) placed their concerns as either somewhat or very unlikely. 12% Very Likely 30% In the next 12 months, how likely or unlikely is it that your company will be hacked? Very Unlikely 11% Somewhat Likely 47% Somewhat Unikely When asked, Approximately what percentage of your company s backup data files is encrypted? Only slightly more than half (54 percent) said they encrypted more than half of their data and only 36 percent encrypt three-fourths or more of their backups. Though a much smaller number, the fact that 10 percent do not encrypt any of their backup data is surprising considering today s escalating risks. 16% 1% - 25% 18% 51% - 75% Approximately what percentage of your company s backup data files is encrypted? 10% 0% 36% 20% 26% - 50% 76% - 100% 2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBs I 4

But while external threats are not a tremendous concern for respondents, internal threats are a major issue. Those surveyed were asked, Which of the following, if any, would you rather have employees bring into the workplace compared to their personal cloud applications? Among the responses offered were things such as Last night s leftovers, Children, Pets and The flu. While humorous on the surface, the numbers were not so funny as 71 percent indicated they would rather have employees introduce some kind of significant distraction or interruption to the workplace than personal cloud applications. Only 29 percent said they would rather have employees introduce cloud applications from their personal devices into the workplace. Which of the following, if any, would you rather have employees bring into the workplace compared to their personal cloud applications Last night s leftovers Their children None of these Their pets The flu Their loudest speakers 1% Other 18% 19% 28% 29% 32% 40% As for whether SMB employees are going around IT policies and introducing their own applications to their companies networks an issue known as Rogue IT those surveyed were nearly evenly split. When asked, How strongly do you agree or disagree with the following statement: Rogue IT is an issue at my company, meaning, employees go around the IT department when making IT decisions, 49 percent agreed that employees were practicing Rogue IT, while 51 percent did not see this as an issue. How strongly do you agree or disagree with the following statement: Rogue IT is an issue at my company, meaning, employees go around the IT department when making IT decisions 18% 31% Agree strongly 20% Disagree strongly 31% Disagree Somewhat Agree somewhat 2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBs I 5

While only about half felt that Rogue IT was an issue, the majority of respondents said the practice is going on within the confines of their businesses. When asked, If you had to guess, approximately what percentage of the employees at your company are using their own personal cloud-based applications for work-related functions that you are completely unaware of? 76 percent said some employees were using their own personal cloud-based applications for work-related functions, but of those, only nine percent felt that number was more than half. If you had to guess, approximately what percentage of the employees at your company are using their own personal cloud-based applications for work-related functions that you are completely unaware of? 14% 11% - 20% 24% 0% 9% 51% - 100% 24% 21% - 50% 29% 1% - 10% It s surprising that Rogue IT seems to be taking place in spite of the fact that an overwhelming majority of respondents 83 percent said they have formal data security policies and procedures in place for employees to follow. What s more, when asked, What grade would you give the employees at your company on their understanding and implementation of data security practices? only seven percent of those surveyed placed their employees level of understanding of these policies as below average or terrible. It should be noted, though, that only one-fifth felt their employees understanding was perfect. What grade would you give the employees at your company on their understanding and implementation of data security practices? 20% A - Perfect 6% D - Below Average 24% C - Average 1% F - Terrible 49% B - Above average 2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBs I 6

LOSS

THEME 4: DATA BACKUP IS UNDERUTILIZED Failing to back up data every day poses a risk, yet most SMBs perform infrequent backups and do not trust employees to take the initiative of backing up their own files. The most important asset of any business is its data. Without it, businesses can t keep track of inventory, they can t invoice customers, they can t run payroll and they can t ensure that their goals are being met. Considering the importance of data to businesses and the large number that could fail because of data loss, it would stand to reason that backing it up to an off-site location would be a priority. Yet, this survey showed that many businesses fail to do this on a consistent, daily basis. When asked, When was the last time you backed up all of the documents and files for your business to a separate location? only about one-third (32 percent) said they had done such a backup that day. Nearly half (45 percent) said they had backed up all their documents and files within the past week and 15 percent said they performed a backup within the past month. One percent said they hadn t backed up to another location in over three years. When was the last time you backed up all of the documents and files for your business to a separate location? 15% In the last month 32% Today 45% In the last week 5% 2-6 months ago 1% 7-11 months ago 1% 1-2 years ago 1% More than 3 years ago Despite being an underutilized insurance policy, the IT professionals surveyed did show faith in their colleagues understanding of the importance of backing up their files. When asked, How much or how little do you trust employees at your company to regularly back up their data files? an impressive 86 percent said they trust them, including 33 percent who trusted employees completely. Of the remaining 14 percent, only a small number (four percent) said they did not trust them at all. I do not trust them very much 33% I trust them completely How much or how little do you trust employees at your company to regularly back up their data files? 10% 4% I do not trust them at all 53% I trust them most of the time 2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBs I 7

THEME 5: BACKING UP ONLINE AND TO THE CLOUD Where data gets backed up varies greatly, but a majority of SMBs recognize the benefit of backing up to the cloud and online. When it comes to backing up data electronically, there still seems to be a difference of opinion as to how this should be done, but one area that does seem to be gaining in traction is the cloud. When asked Which of the following places, if any, does your company back up data electronically? a majority of those surveyed (56 percent) indicated that they have embraced the cloud as a destination of choice for off-site data backup (respondents were allowed to name more than one destination for backup on this question).* While this still lags behind the numbers who back up to an external device, such as an external hard drive, NAS device or server (70 percent), cloud use was more popular than off-site servers (37 percent) and flash drives (30 percent). However, 30 percent of those surveyed said their organizations continue to back up data on employee computers or by some other means, and a few (1 percent) do not back up electronically. Which of the following places, if any, does your company back up data electronically? On an external device, such as an external hard drive, NAS device, or server In the cloud 37% At an off-site location 30% On a flash drive 29% On employee computers 1% Other 1% None of these 56% 70% Not surprisingly, the survey showed that those who do back up electronically take full advantage of the technology. Nearly two-thirds (63 percent) said they back up anywhere from three-fourths to all of their documents and files and another 22 percent back up half to three-fourths. Only 15 percent of those who use electronic backup said they do so for less than half of their documents and files. Approximately what percentage of your business data is backed up electronically? For example, payroll, purchase orders, billing, email, documents and other communications. 9% 26% - 50% 22% 51% - 75% 6% 1% - 25% 63% 76% - 100% *Respondents were allowed to select more than one answer 2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBs I 8

CONCLUSION As this survey shows, there is little question about the importance of data backup for SMBs. This is underscored in statistics from the SBA, which show that a significant majority of small business owners do back up their information 3. However, this survey also shows that while the negative impacts of data loss both financial and non-financial are evident to SMBs, not all are taking full advantage of the electronic, off-site backup options available to them today. The results also show there is still a great deal of employee education that needs to take place around security measures and policies. Based on the results of this survey, SMBs looking to enhance their data backup and recovery plans should consider the following: Automate Backups: Backing up data is something that a business cannot afford to forget to do, so to avoid the backup not getting done, an automated backup system is a must. Build in Redundancy: In addition to backing up to a local hard drive or server, businesses should also consider backing up to a third-party or off-site service such as the cloud. This local/cloud hybrid backup approach will allow fast recovery if the data loss is a local and minor one such as a crashed hard drive but will also ensure that data is retrievable if the business property (and onsite storage) is destroyed in a disaster. Adding a cloud service to the backup configuration is particularly beneficial for SMBs, which may not have an in-house IT team to help them manage and administer server backups. Have a Disaster Recovery Plan: Approximately 40-60 percent of small businesses never reopen their doors after a disaster. Creating a plan of action that includes secure data backup of information that can be easily accessed following a disaster will decrease downtime and make it more likely the business does reopen. A hybrid cloud backup solution for small business could make the difference between survival and becoming a mere statistic. Before something happens, SMBs need to ask themselves if they are ready to recover from a major data loss. The 2014 Report on the State of Data Backup For SMBs is yours to help you make your own assessment and improvements. Think of it as your workout buddy. Just remember when sharing, to follow the gym rules below. Terms of Use: Carbonite encourages readers to share data/insights from the 2014 Report on the State of Data Backup For SMBs. The Carbonite 2014 Report on the State of Data Backup For SMBs and survey data are available for public use under Creative Commons, CC-BY- NC or Attribution-Noncommercial license. For information on proper usage and sharing of the Report on the State of Data Backup For SMBs, visit http://creativecommons.org/licenses/ Beesley, Caron. 4 Ways to Safeguard and Protect Your Small Business Data. SBA.gov. January 10, 2013. http://www.sba.gov/community/blogs/4-ways-safeguard-and-protect-your-small-business-data. 2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBs I 9