Manage Learn to apply best practices and optimize your operations.

The Big Hand-Off: Options for Outsourcing Data Backup

Increasingly, midmarket companies are outsourcing data backup. Here's a look at the options and how CIOs are managing the increased bandwidth requirements.

Midmarket companies are outsourcing data backup to take advantage of fast and efficient services. Just don't forget to upsize your network in kind.

Editor's Note
To view our complete multimedia package, visit our data backup and recovery supercast.

Backing up data at Manatt's Inc., a privately owned general construction company in Brooklyn, Iowa, used to be quite an adventure. First, IT Manager Nate Hopwood copied all of the company's most critical files to digital tapes from IBM. Next -- usually hours later -- Hopwood took the tapes, placed them carefully in his truck and drove them home. Finally, he carried the tapes inside, storing them in a desk drawer in his home office overnight.

Hopwood re-enacted this ritual every night for almost four years. Then, in late 2005, at the behest of his chief financial officer and the company's accounting task force, he admitted that in the event of a natural disaster like a tornado, even this method wouldn't provide the company with adequate data recovery.

And so Manatt's set out to develop a new disaster recovery plan. As part of its strategy, Manatt's opted to outsource data backup to a company called Iron Mountain Inc. Under the new approach, a server attached to the network automatically backs up terabytes of files intermittently throughout the day. Hopwood hasn't driven home with backup tapes since.

"For us, outsourcing backup is like an insurance policy," he says, breathing a sigh of relief. "The old way was so antiquated; now we don't even have to worry about it, and we can rest assured our data is there if we lose it and need it down the road."

As the volume of data expands and storage costs continue to decrease, a growing number of midsized businesses like Manatt's are tackling the backup process with outside help. Outsourcing data backup isn't new, but as the range of approaches grows, CIOs have more options from which to choose. And all those interviewed for this story remain bullish, even when outsourcing costs them more than doing it themselves.


The process still usually revolves around trusted third-party vendors that specialize in keeping the information safe. The goal: to make the data hand-off and backup process automatic. The reasons to go this route are compelling; a 2006 report by Gartner Inc. indicates that 60% to 65% of all data recovery efforts involving tape backups fail, mainly because of tape malfunctions or corrupt files. SSPs usually back up to disk, which is easier and faster to restore.

There are three distinct flavors to data backup today:

  1. On-site backup. CIOs facilitate scheduled backups with on-site, standalone storage servers that are attached to the network and automatically back up files over a local area or wide area network. Companies that offer solutions to facilitate the first approach include Iron Mountain, SunGard and Seagate Technology, which recently acquired the longtime backup juggernaut EVault.

  2. Software as a Service (SaaS)-based backup. CIOs sign up with storage service providers (SSPs), which use software delivered over the Internet to encrypt the data and transmit it to a secure server off site. Those that sell on-demand backup software include Asigra Inc., Carbonite Inc., SOS Online Backup, IBackup and Berkeley Data Systems Inc., makers of the consumer-friendly software Mozy.

  3. Full-service backup. A third group of vendors, companies such as PlumChoice Online PC Services and Adexis (now a division of Cranel Inc.), bundle SaaS products and network-attached devices for a "full service" approach.

Though research firms don't generate figures on the number of midsized companies that outsource data backup, Lauren Whitehouse, an analyst at Milford, Mass.-based consulting firm Enterprise Strategy Group, says the strategy has become increasingly popular because many CIOs lack the budget and wherewithal to invest in elaborate backup plans.

"When you don't have the resources to build out an elaborate and bleeding-edge backup strategy, this is a great alternative," she says. "It's affordable, it's safe, it's trustworthy and, most importantly, it works."

Still, outsourcing data backup is not perfect. Like any solution, it has benefits and downsides, pros and cons. Before you decide that outsourcing your backup is the way to go, there are some important issues to consider.

Evaluating SSPs
Storage service providers (SSPs) are nothing new. They have been around in one form or another for the past few decades. Back in the days when storage was one of several services these companies offered, they were known as managed service providers (MSPs). As the need for data backup increased, however, a number of MSPs branched out and developed specialties in providing storage.

When evaluating SSPs, there are several factors to consider. In a 2006 report titled "Storage Service Providers Rise From the Ashes," Stephanie Balaouras, a senior analyst at Forrester Research Inc., provided a few:

Stability and financial viability. Make sure your SSP will be around for a while. The cost of migrating data to another provider can be immense, especially if you have to re-absorb a large data archive.

Core expertise. Select an SSP that has experience with companies in your industry using computing environments similar to yours. This will mitigate support issues that are specific to your industry down the road.

Geographic reach. For companies with more than one location, be sure your SSP can provide the local and regional service you require for all your remote offices.

Technology fit. Make sure the SSP's technology is best of breed for your computing environment; some backup applications have deeper integration with certain databases and business applications.

Service portfolio. Your need for additional services may change over time. Select an SSP that offers backup, storage management and archiving.

Performance guarantees. Ensure that you're receiving appropriate and specific service-level guarantees; all SSPs should guarantee a certain recovery point and recovery-time objective.

-- M.V.


The Upside to Outsourcing

Any company will see some benefits from outsourcing data backup:

  • Though prices vary, in most cases outsourcing your backup allows you to take advantage of state-of-the-art technology without breaking the bank on it.
  • Most contracts include 24/7 monitoring and management.
  • By default, standalone storage solutions and SSPs offer built-in disaster recovery plans, since in most cases they store customer data offsite.

In addition to these obvious pluses, technologists say three other bonuses are speed, the prospect of automating a traditionally manual process and, of course, improved security.

Speed is one of the most tangible benefits. Traditional backups to external devices such as tape or disk take hours -- first to delete old files, then to rewrite new ones. Over the years, some companies have had to hire full-time employees to do nothing but conduct backups every day. Other companies have gotten so frustrated that they back up data only once a week.

Outsourcing the process eliminates these frustrations. After a CIO signs up, the technology runs an initial backup, a process that can take anywhere from days to weeks (depending on the volume of data). From that point forward, Ted Werth, president of PlumChoice Online PC Services, an SSP in Billerica, Mass., says the system rewrites only those files that have been altered.

"The solution is transparent to the user," says Werth, whose company resells a SaaS product that incorporates technology from Carbonite. "Once installed, the backups just operate on their own."

This automated approach removes the tactical burdens of tape handling, scheduling, monitoring, troubleshooting errors and maintenance. Seen another way, the process obviates the need for manual intervention of any kind, freeing human resources to do what they do best: programming, administering networks and so on.

Of course, the last benefit to outsourcing backup is improved security.

First, by eliminating physical tape backups, CIOs who use standalone storage servers or SSPs also eliminate the risk of losing tape backups. Second, since most backup technologies implement 256-key encryption before backing up, even if a hacker or evildoer gets the data, there's virtually no way he can access it.

For companies in industries such as health care, financial services and government -- sectors that must comply with federal regulations such as the Sarbanes-Oxley and Gramm-Leach-Bliley acts -- an added bonus of this security is a host of reporting capabilities that provide CIOs with the information they need to prove that customer data is safe.

Richard Heitmann, vice president of product management at EVault Inc., says this feature could save companies hundreds of thousands of dollars a year. "For a small or midsized company, this kind of bonus is invaluable," he says.


A Matter of Trust

Despite these kinds of rave reviews, CIOs report common drawbacks to outsourcing data backup:

  • Fragmented or corrupt files remain damaged, even on the backups.

  • Companies still need to manage legacy storage devices and recover data that previously was stored on tapes, disks and other removable media -- something most standalone storage solutions and SSPs won't tackle without significant additional investment.

  • When a contract concludes, there is no way to ensure that an outsourced storage provider will eradicate data sufficiently.

In addition to these pitfalls, other downsides include concerns associated with forfeiting control of data, the steep bandwidth requirements and the time it takes to restore data.

The control factor is perhaps most central. Particularly in the SSP model (see "Evaluating SSPs"), several nagging issues arise, such as: Who touches the data once it leaves the premises? How secure is it off site? How well is data encrypted as it travels across the open Internet?

Jerry Cantrell, senior vice president of IT at First Citizens National Bank in Dyersburg, Tenn., asked himself these questions last year when he decided to outsource data backup to EVault. He hemmed. He hawed. Finally, after account managers assured him the process would secure the bank's most critical customer data, Cantrell relaxed. Still, sometimes he can't help but worry, he says.

"You're always concerned with someone else handling your data," says Cantrell, whose bank boasts more than 20 branches and $860 million in assets. "Yes, the data is safe. But the paranoia never subsides."

Another downside is bandwidth consumption. Even in situations where data is backed up to a standalone server on site, certain backups can require copying terabytes upon terabytes of information a day. Sending this information over a company's primary T-1 line could slow traffic considerably. For those who transmit Voice over Internet Protocol (VoIP) over the same pipes, quality-of-voice traffic may suffer too.

Cantrell eliminated this concern for First Citizens National Bank by adding a bonded T-1 line to his existing line for a 3-megabyte pipe.

In 2005, at Cooke & Beiler, an investment management company in Philadelphia, IT Manager Asha Joshi employed the same strategy. With two lines, Joshi figured he'd be able to direct data backup traffic to an off-site data center from Iron Mountain over one line and general Internet traffic over the other. So far, the solution has worked.

"For us, investing in this additional bandwidth was worth the peace of mind," says Joshi. "Now, even if we're backing up vast amounts of data, our general Internet traffic doesn't suffer at all."

Even with nearly unlimited bandwidth, retrieving data from an outsourced backup provider can take time -- 24 hours or more. Though that's faster than CIOs can pull it off removable media such as tapes or disks, it may not be fast enough to avoid disruption of business.

One way to address this drawback is through the performance and service-level guarantees in the outsourcer contract. At Parnassus Investments, for example, when Technology Manager Mark Lee decided to outsource backup to EVault in 2005, he went out of his way to stipulate precisely when and how the vendor would restore data when Parnassus needed it.

"We have a series of requirements for files of different type and size," he says. "Today, whether we have a crisis or a user mistakenly deletes a file, we can recover data relatively quickly and painlessly," in many cases within hours of the incident.


Enter Symantec
In 2005, when IT security vendor Symantec Corp. acquired data storage vendor Veritas Software Corp. for $13 billion, experts wondered aloud how one technology would subsume the other. That question was answered this spring, when the company announced its new Symantec Protection Network and kicked it off with an online data backup service.

Although details on the new service were still sketchy, it was expected to debut this summer. The Software as a Service (SaaS) offering targets small and midsized businesses in North America with fewer than five servers. The service is based on Backup Exec System Recovery 7.0, a former Veritas product designed to facilitate and expedite Windows system recovery.

Ellen Hayes, a spokesperson for Symantec, says the new service is unique because it will enable service providers to offer a private-branded managed solution. She also notes that these providers can offer the solution as a full on-demand service or as a complement to existing Backup Exec installments.

Hayes declines to delve into pricing details on the new product. Nick Cellentani, vice president of storage consulting and operations at Adexis, an SSP that plans to sell the technology, says the Symantec service will be offered exclusively through partners and priced competitively.

"We need to be able to compete with the guys who have been doing this for a while," Cellentani says. "In this world of outsourced data backup, where you have companies charging $5 a month, you can't really charge an arm and a leg, or you'll be blown out of the water by someone else."

Symantec isn't the only major vendor jumping into online data backup; also this spring, fellow storage vendor EMC Corp. announced plans to get into the market. The vendor didn't offer details on when it would unveil its new product, nor did it indicate what the product would look like. Are vendors such as IBM and HP next in line? Stay tuned.

-- M.V.

The Cost Factor

No discussion of the pros and cons of outsourced data backup would be complete without a brief mention of pricing. Most CIOs acknowledge that outsourcing data backup costs more than their previous strategies. Still, they say the additional expense is worthwhile.

Standalone storage solutions are the priciest, since companies that opt for this approach must invest not only in the technology that controls the backups but also in the hardware that stores the data once it has been backed up. Some companies have been known to pay $50,000 or more for a comprehensive standalone storage solution. Prices vary depending on the data in question and the size and power of the servers to store it all.

Most SSPs also base pricing for midmarket customers on service level and storage capacity, charging fees for both basic services and per gigabyte (GB). According to Forrester Research Inc., the average price for these services is roughly $15 per GB per month.

There are variations. The service from SOS On-line Backup costs $95.70 a month for up to 50 GB of storage. A similar service from IBackup costs $49.95 a month. For small office/home office users, other products such as Carbonite and Mozy are even more affordable. For a single user, Carbonite costs just $50 per year, or $4.17 a month. Mozy, on the other hand, the service from Berkeley Data Systems, costs $4.95 but offers access to files from the Web.

Of course, you get what you pay for. A handful of the cheaper SSP services don't support files larger than 3 GB. Others fail to offer a 30-day version archive. Still others charge extra for private key encryption, and some don't offer it at all. For the money, Mozy seems to offer the greatest number of features. Not surprisingly, PC Magazine selected it as the editor's choice for remote backup in 2006.

At the end of the day, there's a data backup service for everyone. Given that vendors such as Symantec Corp. and EMC Corp. recently announced plans to enter the space (see "Enter Symantec," at right), price points will only get lower, making outsourcing a viable option for any CIO who wants to revamp backup plans, says Whitehouse of Enterprise Strategy Group.

"All things considered, outsourcing backup isn't really that much more expensive than backing up to tape, and there are tons of other benefits," she says. "Throw in a bunch of time and productivity savings and, at least for some companies, you can look at outsourcing and safely say it just might be a better thing."

Matt Villano is a freelance writer living in Half Moon Bay, Calif. Write to him at

This was last published in August 2007

Dig Deeper on Small-business IT strategy

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.