For some SMB companies, outsourcing their disaster recovery service is a better choice than on-site disaster recovery. Robert Brantley, MIS director for the Miami-based Hyde Shipping Corp., learned that the hard way. After working for more than a decade at the 80-person container vessel company, Brantley discovered that when a large hurricane strikes the Miami area, on-site recovery isn't much help.
"Back in 1992, when Andrew hit, we lost power for several weeks and our backup generator that was running our critical computers died after a week. Then in 2005, Wilma hit. We were doing backups to tape at that time, but if a hole opens up in your roof and you get water in your server room, there's little you can do with tape," Brantley said.
For some SMBs, being down during a major disaster is acceptable, but not for Hyde Shipping. The company has to maintain constant email contact with its six ships carrying cargo throughout the Caribbean. "We rely on email for ship-to-ship and ship-to-shore communication more than faxing or calling because it's less expensive. Our vessels use email to tell us where they're at, when they're going to be in port, what kind of weather they are experiencing and if they are in distress," Brantley said.
So Brantley uses AppRiver's Digital Disaster Recovery (DDR) hosted service to keep that line of communication open, even if employees are forced to relocate during a disaster. With the service, all the company's email passes through AppRiver's data center first. Then, if Brantley knows a hurricane is approaching, he can shut down his servers and let AppRiver take over, or, AppRiver automatically detects when the on-site mail servers are experiencing trouble, such as outages. Either way, the service provides access to existing email and will send, receive and store messages until the servers are back online. "When the disaster is over, we bring our servers back up and AppRiver sends us all the stored email so we haven't lost anything," Brantley said. Employees can also access their email from AppRiver's site or have it forwarded to their cell phones.
The DDR email continuity program is free for 30 days for businesses facing imminent natural disaster until the danger passes and connectivity is restored, according to AppRiver CEO Michael Murdoch. He adds that companies can extend the service for a fee as needed. The typical SMB customer pays an average of $600 per year for the Digital Disaster Recovery Program (after the original free 30 days). However, the pricing can vary depending on the size of the customer.
Disaster recovery and data backup services for SMBs
Bob Laliberte, an analyst at Milford, Mass.-based Enterprise Strategy Group, said there is a growing spectrum of disaster recovery services that SMBs can subscribe to. Consumer-grade and low-end storage services include EMC Corp.'s Mozy, Carbonite Inc.'s online backup service and Symantec Corp.'s Online Backup Web service. SMBs can also subscribe to mid-tier offerings, which either directly reroute traffic to the provider's data center like AppRiver's service or feature an on-site appliance that backs up traffic to the data center such as Barracuda Networks' Barracuda Backup Service. Also, high-end server collocation and managed hosting are available from CDW Corp., IBM Corp., and SunGard Availability Services.
Pricing for low-end online backup and restoration services start as low as $5 per month for 2 GB of storage. Midrange pricing for backup and disaster recovery services is a bit higher. For example, Barracuda Backup Service starts at $50 per month for 100 GB, plus $999 for the midrange appliance. At the high-end side, hosted service pricing can be more costly and is dependent on whether you collocate servers, use the provider's servers, require space for personnel and the number of applications you expect to bring back online, Laliberte said.
In order to find out which service is right for you, you must take a close look at your recovery time objectives (RTOs), risk tolerance and budget. For instance, Laliberte said the consumer-grade services might seem appealing to your budget, but they are brutal on RTOs because data transfers are done over the Internet. "In a disaster, it's all about getting your data back when you need it. With these consumer-grade services, what you need to be a flow of data back to your server might actually be a trickle over many days, and that's not good if you need it right away," Laliberte said.
In fact, Laliberte said companies considering low-end services should make sure that their provider can ship them a DVD of their data in the event of a disaster to facilitate a faster RTO.
At the disaster recovery mid-tier, companies are signing on either the fully hosted approach where traffic is rerouted through the data center without the need for on-premise equipment such as AppRiver, or the appliance-based approach used by Barracuda. Both tend to feature techniques to speed data transfer such as data deduplication and compression so you can back up and restore it quickly. "As you scale to more data and more users, you need a centralized backup service that makes more sublime recovery situations such as a hard drive failure easier to address," said Guy Suter, director of product management for the Barracuda Backup Service.
In addition, the mid-tier services boast better security features such as advanced encryption and replication to multiple data centers. They also have more sophisticated tools to manage the backup and recovery process such as Web-based consoles and secure FTP tools.
Some SMBs that have high risk and demanding RTOs, such as banks or online retailers, sign on with high-end disaster recovery providers that offer server collocation, service-level agreements and other enterprise-class services. "According to the 2007 Best's Underwriting Guide, only 6% of companies that suffer catastrophic data loss survive, while 43% never re-open and 51% close within two years of the disaster," said Jim Olson, vice president of solutions engineering and training at SunGard Availability Services.
Another driver to the high end: compliance. "Compliance is forcing SMBs to have certified and tested disaster recovery plans, but they don't want to do it on their own," Olson said.
And while these services can be pricey, Olson said that companies can keep costs down by carefully planning exactly which applications and data has to be available and when. "For instance, chances are you won't need to have your company's cafeteria application up and running in the event of a disaster," he said. Therefore, companies should engage in application tiering to determine their top recovery priorities.
David Cottingham, senior director of hosting and managed services at CDW, agrees and said that most companies focus on their email, financial, Internet presence Web server, CRM and ERP applications as recovery targets.
"They need to think only in terms of 'what has to be up and running to keep the lights on in this business.' The companies that do this tend to be more successful," Cottingham said.
In conjunction with prioritization, companies must also consider application interdependencies and test for them. For example, you might need to recover several databases for your mission-critical financial reporting system to function properly. "If you don't test for these complexities and nuances, you'll fail at your recovery," Olson said.
Olson also advises clients to have the employees who will be using the applications test the disaster recovery plan alongside IT. For example, "If you're a small bank, make sure your tellers are involved in the recovery process," he said.
Cottingham said it is imperative that companies that choose to collocate servers test and monitor their configurations, patches and licenses closely. "You don't want to get to a disaster and find that you can't get everything up and running because the operating system patches are incompatible and the licenses are expired," he said, and added that this kind of oversight is a definite benefit provided by fully hosted service providers.
Finally, as Hyde Shipping's Brantley knows all too well, whatever disaster recovery plan you choose has to include geographic disbursement. "Having your service provider in a different location is a good thing. Since they now have remote management tools, they don't have to be right up the street," he said.
In fact, he said his AppRiver service, which also has backup data centers around the world, is hosted out of the Florida Panhandle. "The chances of us getting severely damaged at the same time as them are very slim," he said.
About this author: Sandra Gittlen is a freelance technology editor in the greater Boston area. She can be reached at firstname.lastname@example.org.