If your organization is in the process of, or has migrated to, a virtualized environment, it may make sense --...
strategically and tactically -- to pursue a cloud disaster recovery (DR) initiative.
A cloud DR initiative simply means that something you might have implemented using alternate data backup arrangements or a hot/warm/cold site DR services can now be implemented using a cloud service provider. Instead of depending on your own resources for system and data backup and recovery, a third-party organization can provide some or all of your DR requirements.
But what are your requirements? How important is disaster recovery to senior management of your organization? Based on your current DR arrangement, what value can cloud DR services deliver?
An effective strategy for deploying cloud DR services begins with launching a pilot cloud DR program.
If your current DR strategy is satisfactory (e.g., supports mission-critical systems, provides ample data storage), and you consider the investment reasonable, it may be advisable to continue handling DR in-house. However, if you view your current technology DR capabilities as nominal, or perhaps insufficient for your peace of mind, a cloud DR solution may make sense.
The decision to use cloud DR services is generally based on the following criteria: 1) business requirements for mission-critical systems and data and databases; 2) identification of recovery time objectives (RTO); 3) identification of recovery point objectives (RPO); 4) identification of critical systems and data, especially production systems and data; and 5) existing DR procedures.
The ups and downs of a DR services migration
Among the well-known potential benefits of cloud services are low total cost of ownership (TCO), low capital expense (Capex), elimination of equipment, reduced floor space and paying only for services that are needed. Major concerns for cloud implementations include security and data protection, prevention of unauthorized access, prevention of rogue cloud deployments, management of multiple environments, performance management and resource management. But like each individual type of cloud service, cloud DR also comes with a unique set of potential pros and cons you need to consider.
The potential benefits of cloud DR services include:
- A secure DR environment.
- Sufficient resources to back up and recover critical systems and data.
- Sufficient bandwidth to replicate critical systems and data to a secure storage location in a timely fashion.
- A secure environment that ensures protection of critical systems and data.
- Support for DR program activities, such as facilitating and documenting DR tests.
- A commitment to providing long-term support for your DR requirements.
The potential downsides to cloud DR services include concerns about:
- Ensuring a solid and secure perimeter around your critical systems, and data concerns about strategies to prevent unauthorized access to your systems and data.
- Strategies to identify and prevent rogue cloud implementations using your data.
- Strategies for optimizing performance and resource management.
- The vendor's disaster recovery planning, testing, documentation and deployment capabilities.
More on disaster recovery strategies
Cloud and mobile help and hurt DR strategies
Does virtualization simplify DR?
Data center consolidation spurred by DR
An effective strategy for deploying cloud DR services begins with launching a pilot cloud DR program, with a certain number of systems and volumes of data replicated to a cloud platform. Next, schedule and conduct tests to recover (e.g., fail over) systems and data to their backup peers, followed by a subsequent recovery (e.g., fail back) to their original production status. After reviewing the success of the pilot, launch a production schedule of data replication (asynchronous or synchronous, depending on RTO and RPOs) to the cloud of selected production systems and data. Initially, you'll want to establish a balance between on-site DR resources and cloud DR services. As you gain more experience and confidence with the cloud DR service, consider shifting backup and recovery for additional production systems and data to the cloud DR service. Note that, due to legal considerations or government regulations, it may make sense to maintain in-house backup and recovery for any of your company's more important assets.
A key activity in cloud DR is testing the recovery and restoration of systems and data. Make sure you are confident that the cloud DR service provider encourages periodic testing of recovery capabilities. Also, from an audit perspective, make sure the service provider can deliver documentation of all its proposed activities, including testing.
If the financials are favorable, you have checked references from other customers, and the cloud DR services provider has sufficient resources to accommodate your requirements, and can ensure uninterrupted uptime for your organization's mission-critical systems, a cloud DR initiative is well-advised.
Paul Kirvan, FBCI, CISA, has more than 25 years' experience in business continuity management as a consultant, author and educator. He is also secretary of the Business Continuity Institute USA Chapter.