Disaster Avoidance and Disaster Recovery:

Disaster Avoidance and Disaster Recovery: May 2010 Dick Csaplar

Page 2 Executive Summary In May of 2010 Aberdeen surveyed over 100 organizations that had a formal Disaster Recovery (DR) program to learn of their experiences and processes for preventing IT issues from causing business interruptions. We found that formal planning, keeping the plan current, and reporting against that plan were the most important factors in preventing business disruption; more important than the size of the company, the length of time they have had a DR program in place, or the number of IT resources they have. This report outlines those findings and makes recommendations for how other organizations can benefit from the findings from Best-in-Class companies. Research Benchmark Aberdeen s Research Benchmarks provide an indepth and comprehensive look into process, procedure, methodologies, and technologies with best practice identification and actionable recommendations Best-in-Class Performance Aberdeen used the following three key performance criteria to distinguish Best-in-Class companies: Recorded fewer than one business interruption the last 12 months Required less than 1 hour to recover 90% of operational functionality after a business disruption Met 95% of their organization s data availability Service Level Agreements (SLAs) over the last 12 months Competitive Maturity Assessment Survey results show that the firms enjoying Best-in-Class performance shared several common characteristics, including: 94% have a senior manager responsible for DR performance 88% have formal documentation of their DR plan 73% track their DR performance and report against their plan 85% use Network Attached Storage (NAS) storage and 79% use Storage Area Networks (SAN) 71% use clustered applications or servers Required Actions In addition to the specific recommendations in Chapter Three of this report, to achieve Best-in-Class performance companies must ensure that a named senior manager is responsible for the DR program, regularly update the DR plan to account for changes to the infrastructure, and have a formal review and report after each DR event. Disaster avoidance and disaster recovery needs to be a formal process with backup processes defined and formal training for all involved. As reported by the survey respondents, it is only a matter of time before IT failure will occur - what keeps it from being a business interruption is good planning and prior testing. Using the right tools also makes a big difference. We practice what we preach: as DR consultants, we know what can go wrong and we couldn't expect much sympathy if anything did go wrong. But, sadly, some of our clients only call after a disaster. It can't happen to them? It just did! ~ Andrew Hiles, Kingswell International France

Page 3 Table of Contents Executive Summary...2 Best-in-Class Performance...2 Competitive Maturity Assessment...2 Required Actions...2 Chapter One: Benchmarking the Best-in-Class...4 Business Context...4 The Maturity Class Framework...5 The Best-in-Class PACE Model...5 Best-in-Class Strategies...6 Chapter Two: Benchmarking Requirements for Success...8 Competitive Assessment...8 Capabilities and Enablers...9 Chapter Three: Required Actions...15 Laggard Steps to Success...15 Industry Average Steps to Success...15 Best-in-Class Steps to Success...16 Appendix A: Research Methodology...17 Appendix B: Related Aberdeen Research...19 Figures Figure 1: Pressures to Implement a Disaster Recovery Plan...4 Figure 2: Best-in-Class Strategies...6 Figure 3: Best-in-Class Process Capabilities...10 Figure 4: Best-in-Class Organizational Capabilities...10 Figure 5: Best-in-Class Knowledge Management Practices...11 Figure 6: Best-in-Class Technology Enablers...12 Figure 7: Best-in-Class Performance Management...13 Tables Table 1: Top Performers Earn Best-in-Class Status...5 Table 2: The Best-in-Class PACE Framework...6 Table 3: The Competitive Framework...9 Table 4: The PACE Framework Key...18 Table 5: The Competitive Framework Key...18 Table 6: The Relationship Between PACE and the Competitive Framework...18

Page 4 Chapter One: Benchmarking the Best-in-Class Business Context Computer systems support processes such as order fulfillment, financial control, and customer relationships are critical to the performance of the organization. Automation has advanced to the extent that the loss of a single server or network device can bring an enterprise to a full stop. Even the loss of internal, traditionally less important systems such as email, web access, and desktop applications can result in the loss of employee productivity and lead to lower employee job satisfaction. Threats to the IT infrastructure range from the minor (hard disk failures, loss of a server power supply, accidental data deletion) to the catastrophic (major blackout, hacker or terrorist attack, or natural disaster). Companies have recognized this threat to their operations and have almost universally implemented some for of Disaster Recovery (DR) program. The program generally consists of a collection of procedures, IT assets, and recovery processes that can be deployed on very short notice. Business Pressures During April and May of 2010, Aberdeen surveyed over 100 end-user organizations on the subject of disaster recovery. Respondents reported that the risk of business interruption was the number one pressure for investing in disaster recovery. They reported that the cost of an hour of downtime can be as high as $1M to $3M per hour. Other important pressures cited by respondents included reducing the time it takes to recover business critical data and the time it takes to recover business process and tools. Fast Facts 93% of Best-in-Class companies use messaging to alert the DR team to an event Only 7% of companies describe their datacenter as having 99.999% or 100% uptime Figure 1: Pressures to Implement a Disaster Recovery Plan

Page 5 The Maturity Class Framework Aberdeen used three key performance criteria to distinguish the Best-in- Class from Industry Average and Laggard organizations: Few, if any business interruptions The ability to quickly recover from a disruption event A history of meeting the organization's data availability SLAs Companies with top performance earned Best-in-Class status (Table 1). Table 1: Top Performers Earn Best-in-Class Status Definition of Maturity Class Best-in-Class: Top 20% of aggregate performance scorers Industry Average: Middle 50% of aggregate performance scorers Laggard: Bottom 30% of aggregate performance scorers Mean Class Performance Recorded fewer than1 business interruption over the last 12 months Required less than 1 hour to recover 90% of operational functionality after a business disruption Met 95% of their organization s data availability SLA s over the last 12 months Recorded on average 2 business interruptions over the last 12 months On average required just under 4 hours to recover 90% of operational functionality after a business disruption On average met 65% of their organizations data availability SLA s over the last 12 months Recorded on average more than 2 business interruptions over the last 12 months Required just under 5 hours to recover 90% of operational functionality after a business disruption On average did not know or measure how well they meet their organizations data availability SLA s over the last 12 months The Best-in-Class PACE Model Defining and deploying a successful disaster recovery plan (comprised of components that provide disaster resilience, disaster avoidance and disaster recovery) to minimize business interruptions requires a combination of strategic actions, organizational capabilities, and enabling technologies. Table 2 summarizes the characteristics of those companies. Additional information about the Best-in-Class PACE Framework can be found in Appendix A.

Page 6 Table 2: The Best-in-Class PACE Framework Pressures Actions Capabilities Enablers Risk of business interruption Set back up and recovery strategy for each business critical element Replicate infrastructure in a remote location Include all key business processes in DR planning Best-in-Class Strategies Cross-functional disaster recovery team defined Formal documentation of DR plan Disaster Plan updated regularly Executive champion goaled to reduce downtime Best-in-Class organizations were clearly and positively differentiated from Industry Average and Laggard companies in the strategies they used to minimize the frequency and impact of business interruptions. Figure 2: Best-in-Class Strategies Use of battery backup devices (100% Best-in-Class Adoption) Tools/messaging to alert DR team to an event (93% Best-in-Class adoption) Disaster recovery scenarios tested regularly (71% Best-in-Class adoption) Clustered applications or servers (71% Best-in-Class adoption) External DR Consultant in place (36% Best-in-Class adoption) Cost of downtime calculated and used in making DR decisions (33% Best-in-Class adoption) Ninety-four percent (94%) of Best-in-Class organizations have a senior manager held accountable for DR performance. The survey showed that the individual's title was less important than the fact that there was a designated individual held responsible.

Page 7 The next two strategies held by Best-in-Class companies are complimentary. The definition of a cross-functional DR team and the formal training of DR policies were cited as critical strategies for Best-in-Class performance. Employees need to know they have a role in a DR event and be trained in what to do. Finally, regular testing of the DR process and tools ensure they are properly set up and ready for a potential business disruption. Only through regular testing can a company know how well they are protected from a negative IT event. Testing should include not just failover but also rolling production back to the original equipment. Aberdeen Insights Strategy The Aberdeen research methodology looks for common denominators that differentiate a Best-in-Class company from others. We look at the size of company, length of experience with disaster recovery programs, number of IT resources, geographic location and industry. Internal factors such as organization, technologies deployed and training are also considered. From all these factors we find the qualities that set the best apart from the rest. Clearly and convincingly, the top factor that sets the Best-in-Class companies apart from the others is their approach to DR planning and reporting. Factors such as how often the DR plan is updated, how often it is tested, how widely the plan is distributed to the employees and the seriousness of reporting interruption events are common among companies that have achieved the lowest number of business interruptions (the gold metric for disaster recovery) and recovering from them quickly. The approach to planning and reporting as described above also demonstrates a continuing and on-going focus on business uptime. DR is not a "once and done" project; it is a process and way of life for those who have been rated the best. This focus runs through the entire organization, from senior management down to those who have been formally trained for a role on the DR response team. It is this focus and attention that allows these Best-in-Class companies to report having fewer than one business interruption over the last 12 months. "Testing in real life is the key. Testing is also a very good awareness campaign." ~ Jaan Priisalu, Head of IT Security Incident Management, Swedbank, Estonia In the next chapter, we will see what the top performers are doing to achieve these gains.

Page 8 Chapter Two: Benchmarking Requirements for Success The importance of DR planning and testing are highlighted in this report from S&T. Case Study Successful DR Implementation A leading Eastern European IT integrator, S&T, implemented a disaster recovery program in its datacenter. The number of DR events declined significantly after implementation. The following provides advice from Stanko Cerin, S&T's Principal BCM Consultant. How do you and how often do you keep your DR plan up to date? "Our Business Continuity policy says that plans have to be updated at least annually. However, more importantly is alignment with change management procedures in the organization so every significant change in business process will trigger a plan update." How do you and how often do you test your DR plans? "To successfully test DR plans you need redundant hardware and in some cases this is not possible, so plans are tested part by part. This way of testing doesn t ensure that when we will need to run the entire plan everything will work smoothly. The other problem with testing is that if you want to test everything together you need to stop production and this causes business damage. We have found restore testing most important and are trying to test restoring one system every month. You can say we have monthly small DR tests and annually a big test." What lessons learned have you gained from this experience? "Define realistic goals (RTO and RPO) based on business requirements. This will result in scoping the project correctly and produces significant savings. What is most important is to define what will be executed in what planned time, so management will have a realistic picture of their ability to recover. Conduct awareness programs so people will know their roles and jobs. Get management to your side and make them promote DR. Regularly update the plans - test, test, test" Fast Facts 7% of responding companies reported having more than eight hours of downtime per month 59% of respondents reported that understanding the scope and complexity of the DR solution was their biggest challenge Competitive Assessment Aberdeen Group analyzed the aggregated metrics of surveyed companies to determine whether their performance ranked as Best-in-Class, Industry Average, or Laggard. In addition to having common performance levels, each class also shared characteristics in five key categories: (1) Process (the approaches they take to execute daily operations); (2) Organization (corporate focus and collaboration among stakeholders); (3) Knowledge management (contextualizing data and exposing it to key stakeholders); (4) Technology (the selection of the appropriate tools and the effective deployment of those tools); and (5) Performance management (the

Page 9 ability of the organization to measure its results to improve its business). These characteristics (identified in Table 3) serve as a guideline for best practices, and correlate directly with Best-in-Class performance across the key metrics. Table 3: The Competitive Framework Process Organization Knowledge Technology Performance Best-in-Class Average Laggards Formal documentation of disaster recovery plan 88% 73% 41% Disaster plan updated regularly 88% 65% 35% Formal review and report on each downtime event 75% 68% 27% Executive champion goaled to reduce downtime 63% 37% 19% Cost of downtime measured and used in DR decisions 33% 25% 8% Messaging to alert DR Team to downtime event 93% 67% 46% Mirroring or failover of critical systems enabled 75% 60% 38% Replication of critical systems at remote location 61% 48% 24% Formal review and report on each downtime event 75% 68% 27% DR performance tracked and reported against plan 73% 44% 22% Capabilities and Enablers Aberdeen's analysis reveals the most important factors for reducing and shortening business interruptions. Process Formal documentation of the disaster recovery plan is a key component of 88% of the Best-in-Class DR programs surveyed by Aberdeen. A well-designed plan covers all aspects of a company's operations, not just the computer infrastructure. This plan defines the roles and responsibilities of employees for dealing with all potential events. Communication of the plan and formal training need to be implemented to ensure the plan is followed correctly. A DR plan will quickly age to uselessness if not updated on a regular and consistent basis. Organizations change, employees turn over, new "We use an outside IT company and they are a valuable resource as we do not have the internal knowledge. We check the results of the tests to ensure that our data is correct. The checking suppresses our anxiety knowing our consultants have done their technical tasks correctly." ~ CFO, Mid-Sized Company in Calgary, Canada

Page 10 technologies are added, and applications are upgraded. Disaster recovery plans should be updated regularly - at least annually - and after any change to the infrastructure or staff. Figure 3: Best-in-Class Process Capabilities Organization An important way to ensure that everyone follows a DR plan and performs their role is if they know that the cause and response to each event will be analyzed by management. A formal review and report on each downtime event should be published to senior management. Figure 4: Best-in-Class Organizational Capabilities

Page 11 There is a sharp disparity between Best-in-Class companies and all other companies (including Industry Average and Laggards) in the use of an executive champion that is committed to reducing downtime. Sixty-three percent (63%) of Best-in-Class organizations use this technique compared to 28% of all others. An executive that is tasked with making a difference will bring a consistent effort and approach to the DR process. Knowledge Management Messaging to alert the DR team that an event is occurring is critical for a quick response. Only with the knowledge that an event has occurred can the DR team begin to implement the get well plan. Pagers, cell phones, email, and text messages are all appropriate for getting a quick response to a business interruption. Ninety-three percent (93%) of Best-in-Class companies reported that this was part of their DR Strategy. Measuring the cost of downtime is critical to defining the right size and scope of DR solutions. Purchasing new hardware to back up a seldom utilized application server may not make economic sense. However that redundant server could pay for itself in shortening a single business interruption by an hour. The only way to know this is to understand what it costs the company per hour of downtime and then to scale the DR plan appropriately. While 33% of Best-in-Class companies employed this enabler, only 19% of the rest of the companies did this. Figure 5: Best-in-Class Knowledge Management Practices Technology Many issues can disable a server. The loss of an un-raided hard drive, the loss of a power supply, an electrical failure, or software bug can cause a server and its software to hang or go down. Cluster software (used by 71% of Best-in-Class companies versus 46% of all others) allows for the mirroring or failover of critical systems to another piece of hardware.

Page 12 Failover can be configured to happen automatically and can take just minutes to complete. Using this class of DR software is one of the clearest examples of how an organization can keep a negative IT event from causing a major business interruption. While unlikely, major disasters can and do occur. Tornadoes, hurricanes, earthquakes, and major floods can disable an entire datacenter. Replication of critical systems at a remote location is required to recover from this class of disruption. Over half of Best-in-Class companies report having this capability. Sixty-one percent (61%) of Best-in-Class enterprises have systems in a remote location while only 52% of other companies report having this capability. Figure 6: Best-in-Class Technology Enablers Performance Management A formal review and report on each downtime event ensures that an organization stays focused on eliminating business downtime. Only through review and reporting can trends be identified. With the identification of trends, priorities can be set for which DR causes to be addressed and in what order. This is a cost-free step that can be taken by the 54% of the non-best-in-class companies to improve their DR performance.

Page 13 Figure 7: Best-in-Class Performance Management Every disaster recovery plan needs to include key metrics. Recovery Time Objectives (RTO), Recovery Point Objectives (RPO), and the number and length of business interruptions must be defined as part of the plan. These metrics set management expectations as to how fast the organization will recover from any negative event. The actual DR performance must be tracked and reported against plan so improvements can be made and processes improved. This performance management enables has a wide difference in implementation between Best-in-Class Enterprises at 73% vs. others at 36%. Aberdeen Insights Technology Of all the technologies Aberdeen surveyed in the DR study, one stood out as having a much higher utilization rate by Best-in-Class companies - Storage Area Networks (SAN) and/or Network Attached Storage (NAS). SAN and NAS are centralized data storage devices consolidating information from multiple servers into a single location. SAN devices were used by 79% of the Best-in-Class companies compared to 60% of all others and NAS use was 85% Best-in-Class compared to 53% others. Although SAN and NAS technologies are different, they both benefit disaster recovery programs in two ways: 1. They centralize an organization's data into a single location. It is far easier to manage data replication from a single source than having to track and manage data stored on multiple disks on disparate servers. continued

Page 14 Aberdeen Insights Technology 2. SAN and NAS manufacturers also provide easy-to-use and reliable data protection and replication software. Data back-up, snapshot (journaling - saving only changed data), and remote replication can be scheduled to happen automatically and when it makes the most business sense. Centralizing data makes preserving information far easier, not just for disaster recovery purposes but for normal business processing.

Page 15 Chapter Three: Required Actions Whether a company is trying to move its performance in disaster recovery from Laggard to Industry Average, or Industry Average to Best-in-Class, the following actions will help spur the necessary performance improvements: Laggard Steps to Success Calculate the cost of downtime in your organization. Until the organization understands the size and scope of any potential impact it can not define an appropriate DR plan. Investing 10's of thousands of dollars in a DR program may make sense if the cost of a business interruption is measured in the 100's of thousands of dollars but not if the cost is measured in 100's of dollars. Understanding the cost allows scoping of the DR solution correctly. Identify an executive champion. The importance and approach to DR planning is set at the top of the organization. This individual must have the power to define the recovery objectives, approve the DR strategy and authorize the purchase of required technologies to ensure business interruptions are kept to an absolute minimum. Test, test, test. Only 27% of Laggard companies report they regularly test their DR programs. A downtime event is not the time to discover a forgotten application or critical server. This is the most important thing an organization can do to reduce the severity of a downtime event. Fast Facts 65% of respondents reported using tape or Virtual Tape (VTL) for data backup 70% of companies that responded indicated that they backup their data on a daily basis Industry Average Steps to Success Track and report DR performance against plan. Seventythree percent (73%) of Best-in-Class organizations track and report their DR performance. Every downtime event can produce a set of findings that, if applied correctly, can ensure it is not repeated. The saying, "what gets measured gets done" applies completely in this case. Deal with the issues as they arise and the threat of a repeat incident is removed. Define a cross-functional disaster recovery team. Business interruptions can be caused by many factors - servers, networks, telecommunications, facility issues, viruses, etc. Different organizations have responsibilities for these areas and need to be included in any DR plan. Seventy-eight percent (78%) of Best-in- Class organizations have a cross-functional DR team. Train the staff on DR policies. The DR plan is only as good as the people expected to execute it. Formal training is required to ensure everyone can do what it is they are expected to do. For 73% of Best-in-Class organizations continuing education and performance reviews are a part of this process.

Page 16 Best-in-Class Steps to Success Make the DR plan a living document. While 78% of Best-in- Class organizations reported that they update their DR plan at least annually, only 6% reported that it is updated after a business interruption event. When the event has just occurred is the best time to update the plan as everything is fresh in everyone's mind. Calculate the cost of downtime. Only 33% of Best-in-Class companies reported that they calculate their hourly cost of downtime. This metric is important to scope the right level of investment and response to business interruptions. This figure sets the right priority to dealing with downtime events. Disaster recovery consultant. Thirty-six percent (36%) of Bestin-Class organizations indicated that they utilize an external DR consultant. Defining a DR plan can be an overwhelming job, especially for smaller organizations. A consultant would be able to offer an experienced view of DR plus an understanding of strategies and tactics that have worked for companies similar to yours. Aberdeen Insights Summary "DR is an evolving process that will take several test iterations before an organization is confident it can recover applications in time required by the business." ~ Robert Reinckens, Partner, IT Consulting Firm, Danbury, Ct. A new computing style is emerging in IT - cloud computing. This style allows enterprises to run all or some of their IT infrastructure on devices located at the remote facilities of service providers. Enterprises can "rent" IT servers and storage capacity rather than buy, manage, upgrade, and service the assets themselves. An Aberdeen survey in September 2009 found that 46% of organizations have already begun a Cloud initiative. Companies are beginning to use cloud-based resources as part of their DR plan. Enterprises can do one or all of the following: Use the infrastructure of cloud vendors as the alternate location for backup systems. Several cloud vendors offer remote servers and storage that can be on standby waiting for a DR event for just a fraction of what owning those assets outright would cost. Employ the remote storage devices of a cloud vendor for data backup and archiving. High speed networking means backup and recovery functions can happen very quickly and in the event of an issue. Software as a Service (SaaS) allows organizations to run critical applications in the cloud without having to manage the servers, storage or applications. The SaaS provider does the data backup. Aberdeen will be surveying companies on their use of the cloud architecture for disaster recovery purposes in an upcoming report.

Page 17 Appendix A: Research Methodology In May 2010, Aberdeen examined the use, the experiences, and the intentions of more than 100 enterprises deploying a DR strategy in a diverse set of industries. Aberdeen supplemented this online survey effort with interviews with select survey respondents, gathering additional information on DR strategies, experiences, and results. Responding enterprises included the following: Job title: The research sample included respondents with the following job titles: CEO / President (13%); EVP / SVP / VP (19%); Director (13%); Manager (28%); Consultant (13%); Staff (11%); and other (3%). Department / function: The research sample included respondents from the following departments or functions: Information Technology (45%); Corporate Management (22%); Logistics/Supply Chain (9%); Operations (7%); Finance (6%) and other (11%). Industry: The research sample included respondents from the following industries: IT Consulting Services (20%); Financial Services (14%); Government (6%); Manufacturing (6%); Software (6%); Aerospace and Defense (5%); Education (5%); Telecommunications (5%); Food and Beverage (5%); Automotive (4%); and others (24%). Geography: The majority of respondents (56%) were from North America. Remaining respondents were from the Asia-Pacific region (14%), South America (2%) and Europe/Middle East/Africa (28%). Company size: Twenty-six percent (26%) of respondents were from large enterprises (annual revenues above US $1 billion); 35% were from midsize enterprises (annual revenues between $50 million and $1 billion); and 39% of respondents were from small businesses (annual revenues of $50 million or less). Headcount: Thirty-six percent (36%) of respondents were from large enterprises (headcount greater than 1,000 employees); 35% were from midsize enterprises (headcount between 100 and 999 employees); and 29% of respondents were from small businesses (headcount between 1 and 99 employees). Study Focus Responding executives completed an online survey that included questions designed to determine the following: The uptime of their datacenters How happy their end-users are in their ability to meet the organization's uptime need The percentage of the overall IT budget spent on DR The estimated cost per hour of downtime The study aimed to identify best practices for disaster recovery and to provide a framework by which readers could assess their own DR capabilities.

Page 18 Table 4: The PACE Framework Key Overview Aberdeen applies a methodology to benchmark research that evaluates the business pressures, actions, capabilities, and enablers (PACE) that indicate corporate behavior in specific business processes. These terms are defined as follows: Pressures external forces that impact an organization s market position, competitiveness, or business operations (e.g., economic, political and regulatory, technology, changing customer preferences, competitive) Actions the strategic approaches that an organization takes in response to industry pressures (e.g., align the corporate business model to leverage industry opportunities, such as product / service strategy, target markets, financial strategy, go-to-market, and sales strategy) Capabilities the business process competencies required to execute corporate strategy (e.g., skilled people, brand, market positioning, viable products / services, ecosystem partners, financing) Enablers the key functionality of technology solutions required to support the organization s enabling business practices (e.g., development platform, applications, network connectivity, user interface, training and support, partner interfaces, data cleansing, and management) Table 5: The Competitive Framework Key Overview The Aberdeen Competitive Framework defines enterprises as falling into one of the following three levels of practices and performance: Best-in-Class (20%) Practices that are the best currently being employed and are significantly superior to the Industry Average, and result in the top industry performance. Industry Average (50%) Practices that represent the average or norm, and result in average industry performance. Laggards (30%) Practices that are significantly behind the average of the industry, and result in below average performance. In the following categories: Process What is the scope of process standardization? What is the efficiency and effectiveness of this process? Organization How is your company currently organized to manage and optimize this particular process? Knowledge What visibility do you have into key data and intelligence required to manage this process? Technology What level of automation have you used to support this process? How is this automation integrated and aligned? Performance What do you measure? How frequently? What s your actual performance? Table 6: The Relationship Between PACE and the Competitive Framework PACE and the Competitive Framework How They Interact Aberdeen research indicates that companies that identify the most influential pressures and take the most transformational and effective actions are most likely to achieve superior performance. The level of competitive performance that a company achieves is strongly determined by the PACE choices that they make and how well they execute those decisions.

Page 19 Appendix B: Related Aberdeen Research Related Aberdeen research that forms a companion or reference to this report includes: Business Continuity: Implementing Disaster Recovery Strategies and Technologies; March 2008 Are You Protected? Virtualization and Business Continuity; September 2007 The Importance of High Availability: Continuous Applications and Data Recovery; March 2007 Information on these and any other Aberdeen publications can be found at www.aberdeen.com. Author: Dick Csaplar, Senior Research Analyst, Virtualization and Storage (richard.csaplar@aberdeen.com) Since 1988, Aberdeen's research has been helping corporations worldwide become Best-in-Class. Having benchmarked the performance of more than 644,000 companies, Aberdeen is uniquely positioned to provide organizations with the facts that matter the facts that enable companies to get ahead and drive results. That's why our research is relied on by more than 2.2 million readers in over 40 countries, 90% of the Fortune 1,000, and 93% of the Technology 500. As a Harte-Hanks Company, Aberdeen plays a key role of putting content in context for the global direct and targeted marketing company. Aberdeen's analytical and independent view of the "customer optimization" process of Harte- Hanks (Information Opportunity Insight Engagement Interaction) extends the client value and accentuates the strategic role Harte-Hanks brings to the market. For additional information, visit Aberdeen http://www.aberdeen.com or call (617) 723-7890, or to learn more about Harte-Hanks, call (800) 456-9748 or go to http://www.harte-hanks.com. This document is the result of primary research performed by Aberdeen Group. Aberdeen Group's methodologies provide for objective fact-based research and represent the best analysis available at the time of publication. Unless otherwise noted, the entire contents of this publication are copyrighted by Aberdeen Group, Inc. and may not be reproduced, distributed, archived, or transmitted in any form or by any means without prior written consent by Aberdeen Group, Inc.