Small businesses see DRaaS as a way to finally afford a broader BC/DR solution.
"DRaaS can minimize or even completely eliminate the requirement for company capital in order to implement a DR solution," says Jerry Irvine, CIO, Prescient Solutions and member of the National Cyber Security Task Force. Since DRaaS is a cloud solution, businesses can order it at most any capacity, making it a more cost-effective fit for smaller production environments. Of the 8,000 DRaaS production instances that Gartner estimates exist today, 85- to 90- percent are smaller instances of three to six production applications, Morency says. The VM scope of these companies is between five and sixty VMs and the associated production storage is no more than two to five TB, Morency adds.
Businesses hit with increasingly severe weather catastrophes are very interested in DRaaS.
"When you look at the aftermath of events like the Tsunami in Japan, there is a lot more awareness and a lot more pressure from the board level to do disaster recovery," says Morency. This pressure and the affordability of DRaaS can tip the scales for many a small business.
Proceed with caution
Enterprises and small businesses considering DRaaS face a lot of due diligence before choosing a solution and a lot of work afterwards.
"It's not like you just upload all the work to the service provider," says Richard P. Tracy, CSO, Telos Corporation. If the enterprise requires replication to a cloud environment supported exclusively by SAS70 data centers, then the DRaaS provider better be able to demonstrate that it has SAS 70 data centers and agree to keep data in the cloud only in those facilities.
Depending on the industry, the customer must confirm that the DRaaS provider meets operational standards for HIPAA, GLBA, PCI-DSS, or some of the ISO standards as needed.
"You don't want to trust that they do just because it says so on their website," says Tracy.
Due to the nature of the cloud, DRaaS can offer innate data replication and redundancy for reliable backup and recovery. But unless specified otherwise, DRaaS could include only replication to failover core systems and backup may not be included.
"Many organizations define their backup systems or data repositories as critical solutions for the DR facilities to replicate," says Irvine. This provides for replication of core systems and data backup to DRaaS.
And once the enterprise's data successfully fails over to the DRaaS service, at some point the enterprise and the service have to roll it back to the enterprise infrastructure.
"You have to make sure that the DRaaS service will support you in that process," says Tracy. There are processes, procedures, and metrics related to exit strategies for outsourcing that the customer must define during the disaster recovery planning process. These will depend on the organization. These procedures set the timing for how soon data restoration to the primary location takes place and how soon the company switches the systems back on.
Sign up for CIO Asia eNewsletters.