Another thing to look at is security. The bigger the organization, the more you are going to be concerned with things like access control lists, role-based authentication and role-based access to systems. For instance, let's say you're a company of 20 people and everyone is using this service, maybe you don't want everyone to have the equivalent of root level access to do resource. Be sure that if you need encryption, that part of the service offering is available. Also if you're doing encryption of data at rest on your side, understand how that impacts the effective amount of storage on the service provider end, and how that affects your contract.
Be sure that you have some visibility into what's actually happening, how much capacity you are using, what the performance looks like on a daily or weekly basis. How much storage is used, how storage is used, how much is backed up, what is used and when and what are the backup window times for the service.
Look for proof of infrastructure. Are the datacenters running the server owned or are they co-owned datacenters? Does the service provider have multiple datacenters, as in, if they have a disaster is your data gone indefinitely or has it been replicated to another site for disaster recovery? These are things that you would normally not think about since your data is moving offsite, yet if you're doing this for the long haul and putting your critical data assets in the hands of a service provider then it does matter.
Look for evidence of a company in technology stability. When you call, up does the CEO answer the phone or do you get a true support person? Also, where is that support person located? Then also look to see if they have 24/7 support. Even if you don't need or don't want to pay for it, whether or not that exists in a company is a huge indicator of company maturity. And lastly, if you need application awareness in the backup and restore process, such as application awareness of Exchange data stores or SQL, things that are very common in SMBs or remote sites, make sure that that application awareness is fully understood by the storage provider, so you have potential for restore consistency.
Check out the entire Backup as a Service FAQ.
This was first published in April 2008