Outsourcing can remedy your backup woes--you can bring an expert in-house, back up to an online service or move your data to a hosted data center.
Backup is a paradox
Storage staffs may dread dealing with it, but they're still reluctant to loosen their grip on the practice. But as stiffer compliance requirements add even more urgency to ensuring an effective backup process, some companies are asking whether it makes more sense to outsource their backup. Outsourcing, prevalent in nearly every business sector, is still viewed with suspicion by many storage groups. Yet outsourcing specific storage processes can improve a storage group's productivity, consistency and efficiency.
There are three basic mechanisms for outsourced backup:
- Insourcing. Invite a vendor to manage your backups using onsite resources, remote resources or both.
- Online backup. Ship data from your data center over a network to an offsite service provider.
- Hosted backup services. Move your primary data to an outside data center with a backup service offering.
The two physical variables for these alternatives are the locations of your data and backups (see "Outsourced backups: Where your data goes," at right). The key issue is whether your primary data and backups should reside in your data center or at a managed hosting center. Usually, business and technical realities will determine the choice. Many firms are reluctant to use a managed hosting provider for their primary storage and servers, while other organizations with large amounts of data find the bandwidth costs required to ship backup data to an offsite provider are prohibitively high. For those organizations, insourcing is the only logical choice.
Insourced backup services are a popular option for medium- to large-sized organizations. Bringing management resources in-house is easier to implement technically and maintains the status quo in terms of physical data security. Many outsourcing firms can provide onsite staff to manage backups, but a more efficient backup management solution goes beyond supplying people on site. For example, remote monitoring and the expertise of a service operations center can deliver better service at a lower overall cost (see "Outsourcing options: Which one is right for you?" at right).
Small businesses are more likely to opt for online backup services. They offer professional data management and instant offsite storage, which is reassuring to companies with limited or no IT resources. Unlike the other two outsourcing options, online backup data never rests at the same site as the primary storage, an important differentiator if backup data will be used for disaster recovery purposes. The limiting factor is cost--the bandwidth needed to support online backup might be available, but pricing can be high. Most online providers send incremental data over the WAN, so be aware of the amount of time a full restore would take. Online backup providers often mail a disk or server containing your data for a large recovery, which takes time. In general, the pricing structure for this type of service is oriented toward small amounts of data.
The final option, hosted backup services, is limited to organizations that wish to outsource more than backups. Many companies have concluded that they'll receive better service, availability and flexibility by locating their entire IT infrastructure at a managed hosting center. Many of these centers, in turn, offer backup services to their customers. This type of service is typically provided by a third party that focuses on backup services.
The path to managed backups
No matter which managed backup option you choose, preparation is the key to successful outsourcing.
- Optimize and stabilize your current environment before handing it over to someone else to manage. Some providers will be only too happy to manage a bloated environment, especially if it puts more money in their pockets.
- Understand the reporting the provider offers. Is it a Web-based portal, hard copy or e-mail? How often is it updated and how much history does it offer? What attributes of your backups does it measure? Also, be sure you know your compliance reporting requirements.
- Look for a suite of services that meets your needs. Some are nuts and bolts, some are people-oriented and others are operational.
- Understand the migration plan. What happens to the old infrastructure, and how will capacities be increased when needed?
- Improve the backup process. There's no advantage to having someone take over bad backup processes.
- Maintain flexibility with your service provider; your business and data will change.
A major consideration in choosing an outsourcing vendor is how easily its processes will integrate with your IT procedures (see "The path to managed backups," at right). Backup and restore activities aren't simple or standalone processes. Setup, daily operations, troubleshooting of backup failures, and the restoration of data all require interaction with system administrators, database administrators, network administrators and operations support staff. For example, you'll need to determine which members of your staff will do the following:
- Manage client configuration, exclude lists and schedules
- Monitor the nightly backups and respond when trouble arises
- Manage the offsite storage vendor
- Initiate and manage the data restores
Other issues to consider include:
Service-Level Agreements (SLAs). Most outsourced backup options are governed by an SLA. The content of SLAs can vary widely. Some specify only high availability of the backup service, while others focus on metrics like recoverability or even promise improvements in the alignment of data protection with user needs. Make sure the backup outsourcer's SLA corresponds with the factors you care about and that there's a satisfactory balance between service delivery, risk and cost.
SLA adherence. Most backup service providers offer a Web-based portal that provides real-time access to key performance indicators and metrics for daily backup success and failures, the amount of data being backed up, and tape drive and media utilization. Other common reports include weekly or monthly backup trends, and whether your contract with the service provider is nearing a cost or service threshold.
Incident management. Incident management deals with the discovery, resolution and reporting of events in the environment. Determine your organization's requirements as to when you should be informed of incidents and then delegate someone to take action as necessary. Questions to consider include:
- Do you or your service desk want to be called when something fails?
- What if an incident falls under the responsibility of a database or network administrator?
- Who has to fix the errors and what's the expectation for a response?
Asset management. Who worries about replacing obsolete equipment and who pays for it? Online backup services hide this aspect from you, but insourced solutions may not. Consider whether your company is in a better negotiating position with hardware and software vendors than your outsourcing provider.
Offsite tape audits. Most organizations pay a monthly fee to store tapes offsite for archival purposes. Media audits can help to realize significant savings by identifying offsite tapes that have expired, are beyond the required archive duration or have been orphaned. Similarly, avoid backing up duplicate data (i.e., it's generally not required to back up a copy of primary data on disk).
Delivery. Service delivery is the level of service across various attributes of the backup and restore process. Some examples include the length of backup windows, the number and flexibility of data protection policies, the time it takes to add a new backup client to the backup schedule, the response time to backup failures and the time it takes to initiate a restore. In general, assume that the higher the level of service, the higher the cost.
Risk. There are different types of risk: failing to back up data, not backing up the right data, inability to restore data or to restore an application to a consistent point in time, security failings, and failure to comply with internal or external regulations. The lower the risk your business is willing to tolerate, the higher the cost of service.
Cost. You want to minimize costs, but not if it puts your company at risk or jeopardizes your service-level requirements. Your current backup process may be in such a poor state that your data is already at risk. In that case, service costs from an external provider may be more than your internal costs, but a reduced risk and increased service level might be worth the higher price. Many factors go into a "total cost of backup" calculation, including libraries, backup servers, networks, software licenses, maintenance, administration and management, media, facilities, offsite tape storage, migrations and finance charges. You'll need to understand which of these costs will be "transferred" to a service provider.
While often overlooked, it's a good idea to establish a baseline of your current backup metrics. Knowing the current state of your service delivery, risk and costs will help you determine your backup goals. If you outsource, do you want to maintain the status quo in terms of client coverage and backup windows, or do you want to improve them? A good first step is to conduct an assessment of the current state of backups. You may find that many systems aren't currently backed up correctly. Other common problems include improperly sized backup infrastructures, excess offsite tapes and overflowing backup windows. These issues should be addressed before an SLA is put in place.
Heading off trouble
If you plan to keep your existing backup infrastructure and believe it's not currently optimized for service, risk and cost, work with your service provider to institute a plan to assess and optimize your environment. Watching for trouble spots is important, whether you're in the process of choosing a service provider or monitoring the infrastructure you have.
Backup failures can be caused by hundreds of issues, many of which aren't directly related to the backup hardware, software or provider. For example, open files and locked databases can cause a nightly backup to fail. Similarly, network trouble can cause backup performance issues, failures or missed windows. These faults are usually excluded from backup service provider SLAs, yet your data is still at risk. Consider whether you want a collaborative relationship with a service provider that works closely with your network, database and system admins to determine the cause and resolution of a problem, or whether you just want your service provider to inform you that your data is at risk, leaving corrective actions to you.
Tape media ownership is another consideration for outsourced backup. If your provider owns the assets, make sure your contract specifies who owns offsite media at the end of the contract term. We've heard of at least one firm that had to write a large check after a difficult negotiation to get back its own data, which was on the service provider's media.
You may also need to consider if you want your service provider to buy your backup-related assets or provide their own. The benefit of getting the assets off your books might be enticing, but it may not be prudent to force your service provider to use an inappropriate infrastructure. A service provider may not guarantee an SLA if your equipment isn't what they would have chosen. Consider the future, as well. While the capacity of your current configuration may be sufficient now, it might not be as you grow. If you transfer existing assets to a service provider, there may not be an incentive to update the equipment. There are two solutions to this problem: Assess your growth and plan for your future needs when you start your contract, or ask the service provider to specify an entirely new infrastructure.
If your users' needs change before the contract is up, you could end up paying significantly more than expected. This "scaling trap" happens when a metric that influences price is based on a threshold you want to avoid exceeding. If your data doubles in a year and your "scaling factor" is backed-up gigabytes, your costs will double, too. We've seen scaling factors based on the amount of data backed up to tape, the amount of primary data, the number of servers being backed up, and the cost of delivering the service plus an agreed-to profit margin ("cost plus"). Each method has its positive and negative aspects. Careful analysis should help you to avoid overpaying, while leaving some reasonable room for growth.
Cost, capacity and capability are often the driving considerations in outsourcing or insourcing IT talent. What's important in any decision to insource or outsource is the ability to restore applications, systems and files. You also need to consider your vendor's willingness to share risk, its ability to deal directly with the business user without damaging the IT department's relationship and its commitment to continuously improving backup performance. All of these are areas crucial to the success of outsourcing initiatives. Finally, remember that finding the ideal backup operations partner and building on that relationship requires time and management skills.