Establish an Effective Data Protection Plan Give data

Establish an Effective Data Protection Plan Give data the attention it deserves by building a strategy that goes beyond backup. Info-Tech Research Group Inc. is a global leader in providing IT research and advice. Info-Tech’s products and services combine actionable insight and relevant advice with ready-to-use tools and templates that cover the full spectrum of IT concerns. © 1997 -2020 Info-Tech Research Group Inc. Info-Tech Research Group 1

Table of contents 1. Executive Summary 2. Execute the Project/DIY Guide 2. 1 Phase 1: Define the Current State of Your Data Protection Plan 2. 2 Phase 2: Conduct a Business Impact Analysis to Understand Requirements for Restoring Data 2. 3 Phase 3: Propose the Future State of Your Data Protection Plan 2. 4 Phase 4: Establish Proper Governance Around Your Data Protection Plan 4. Next Steps 5. Bibliography Info-Tech Research Group 2

ANALYST PERSPECTIVE It should be called data recovery, not data backup! Data protection is not like traditional projects that rely on ROI calculations to demonstrate success. The value of your data protection strategy comes to life only after an incident occurs. The absence of a robust data protection strategy can expose the organization to so much risk that it halts operations altogether. So why is it that, despite this enormous risk, getting feedback from the business is like pulling teeth? IT departments need to simplify the technical language, build business facing documentation, and communicate the consequences of failure, to have the right conversations. Start by changing the paradigm from backup, which is focused on the task, to data protection, which is focused on the outcome. Teodora Siman, Research Analyst, Infrastructure Practice Info-Tech Research Group 3

Our understanding of the problem This Research Is is Designed For: This Research Will Help You: üEnterprises seeking to reengineer their backup üEvaluate your current data protection practices. üSelect the data protection solution that fits with strategy and architecture üIT managers and system admins that need to select a backup solution your organization’s specific requirements. üConsider the ongoing governance required for data protection. This Research Will Also Assist: This Research Will Help Them: You: ü Data owners ü Understand how their data is being protected. ü Provide feedback on the necessary future state. Info-Tech Research Group 4

Executive summary Situation • Data is critical to business operations. In fact, not having the proper • data when it’s needed can lead to lost opportunities and have a damaging financial impact. Backup is viewed as a necessary but undervalued process. Too much focus is placed on backing up the data, but not enough focus is placed on the requirements for restoring in case of an incident. 1. Don’t let failure be your metric. The past is not an indication of future performance. Quantify the cost of your data being unavailable to demonstrate value to the business. Complication 2. Stop offloading backup to your most junior staff. • Business requirements can be vague. Not knowing the business needs Data protection should not exist in isolation. often results in over expenditure and overexposure to liability through data Get key leadership involved to ensure you hoarding. can meet organizational requirements. • Backup options are abundant. Disk, tape, or cloud? Each has drawbacks, efficiencies, and cost factors that should be considered. 3. A lot of data is useless. Neglecting to • Backup infrastructure is never greenfield. Any organization with a history properly tag and classify data will lead to a costly data protection solution that protects has been doing backup. Existing software was likely determined by past redundant, useless, or outdated data. choices and architecture. Resolution • Determine the current state of your data protection strategy by identifying the pains and gains of the solution and create a • • business facing diagram to present to relevant stakeholders. Quantify the value of data to the business to properly understand the requirements for data protection through a business impact analysis. Identify the attributes and necessary requirements for your data tiers to procure a fit-for-purpose solution. Info-Tech Research Group 5

It’s about restoration: focus on recovery for success in backup There is a significant confidence gap between backup and restore capabilities. Completely confident -11% 2. Organizations are uneasy about responding to the changing needs. The expansion of programs 3. There is a disconnect between backup admins and core users. Involving users in planning; the backup environment can help better meet their needs while setting realistic expectations. 45% 22% 33% Completing Backups Within the Required Time Interval such as cloud and digital workplaces has increased the diversity of backup ecosystems. Specialized solutions for highly virtualized systems have added new features to backup but have increased complexity and contributed to a piecemeal approach to backups where some apps and data sets are overprotected and others are underprotected. 51% 29% 23% 44% 14% 37% 15% 30% 22% Managing Core User Expectations 22% Very confident Restoring Lost Data Within the Recovery Time Objective 55% Responding to Changes in the Organization's Backup Needs “very confident” or “completely confident” in their ability to meet their backup window, only 44% were confident in meeting their recovery time objective. Level of Confidence in Organization's Backup Abilities Ensuring Consistency of Backup With Original Data 1. The backup window dictates the backup policy – but meeting it does not guarantee recoverability. While 55% of respondents said they were Source: Info-Tech Research Group; N=74 Info-Tech Research Group 6

Stop data hoarding and start protecting what matters Clean Data: Data that has been defined as business critical. This is data that is important for the day-to-day operations of the business. Without it, the business could quickly come to a halt. ROT (Redundant, Obsolete, Trivial) Data: Data that has little to no business function. This data takes up space on storage and backup appliances without delivering value. Dark Data: Data that has not been classified yet. It could be valuable, or it could be useless, but the organization has not taken the time to find out. Dark data poses a threat of noncompliance, which leaves the business exposed to more risk. The Veritas Databerg 1 Classified Data Take the time to understand the data that exists within the organization. This step is critical to effective cost management of the data protection program. You will likely be surprised by the amount of data that is duplicated and/or not useful. 14% Clean Data 32% ROT Data 54% Dark Data N=1, 475 1. Veritas, 2015 Info-Tech Research Group 7

People are often the roadblock to effective data protection • Human error more frequently leads to data loss than any other factor. Optimizing processes and procedures can help mitigate the problem. How frequently does each of the following lead to a data loss that requires recovery from backup? 63% 57% Very Frequently 8% 29% Frequently 37% 7% 24% 49% 34% Human Error 9% 16% 4% 15% 12% Power Failure Equipment or Building Damage 30% Software Issue Isolated Hardware Failure 12% 3% 9% Natural Disaster Source: Info-Tech Research Group; N=82 Info-Tech Research Group 8

Human error almost lost Pixar the Toy Story 2 film CASE STUDY Industry Source Entertainment and Film Dynamic Business Technologies Situation In the late 1990 s, the Pixar team was working on the production of Toy Story 2. The team was using Linux machines, which contain a command that deletes all data below the current directory that it is run on. Incident An employee accidently ran the command at the root level of the project. The Toy Story project started disappearing. In a panicked attempt to save the data, they unplugged the machines. When they restarted the machines, 90% of the movie was gone. The effort required to recreate the film up to that point would have taken a full year with 150 staff. Impact The technical director turned to their backups of the film. It turns out the backups from the last month had failed. Because they were not in the habit of regularly testing their backups, they had not realized this. The Technical Director had a backup of the film on her home computer. It was about two weeks old, but they were able to retrieve the data and footage by connecting her machine to the local network and copying over the files. Info-Tech Research Group 9

Determine the metrics you will use to assess the performance of your data protection project Consider the following as ways to evaluate the performance and success of your data protection project. Metric Methodology User satisfaction (% Business user satisfaction post project) minus (% Business user satisfaction prior to project) Cost Savings (Cost of the data protection program post project) minus (Cost of data protection program prior to project)* SLO 1 Adherence (Number of SLO failures post project per year) minus (Number of SLO failures per year prior to project)* RGO 2 Adherence (Number of RGO failures per year post project) minus (Number of RGO failures per year prior to project) RTO 3 Adherence (Number of RTO failures post project per year) minus (Number of RTO failures per year prior to project)* 1. Service-Level Objective 2. Recovery Granularity Objective 3. Recovery Time Objective * Negative number indicates improvement Info-Tech Research Group 10

Articulate the need for a robust data protection plan 1 The importance of backups is obvious, but many organizations continue to misunderstand its value. Backup cannot be valued based on traditional ROI metrics. Most of the time, it doesn’t create revenue, enhance productivity, or save time. As a result, backup risks being dismissed as a tedious task that must be performed or a sunk cost that isn’t worth investing in. The proof of value is in recovery, not in meeting the backup window. Some organizations are content to hear that their backup objectives are being met, without realizing that their recovery goals may be unattainable. If the solution can complete its task within the backup window, administrators assume that backup operations were successful. But unless the backup is recoverable, you may as well have not backed up at all. An underprovisioned backup system poses a significant financial risk to your organization. This means investing in the technology, the training, the people, and the processes that go into ensuring that backups are successful, reliable, and that they can be restored in line with the organization’s recovery time objective (RTO). In an under provisioned backup environment, something will slip through the cracks – with potentially disastrous results. It’s never the business’s problem, it’s never your problem, until they don’t have the data. – Darryl Levesque, Principal Research Advisor, Info-Tech Research Group 11

Use a business impact analysis to determine requirements for the organization’s data 2 All storage tiers must be backed up and recoverable, within appropriate timelines and in compliance with the business value they add. Start the backup strategy by understanding requirements for primary data. Successful backup architecture implementations require a clear picture of what is required to ensure reasonable availability and business continuity for all primary data. This will be critical to eventually determining what backup media and architecture effectively supports the organization’s data at the most appropriate total cost. The physical architecture of storage typically consists of three separate tiers that house data of different value. • Primary Tier: Highest performance and fastest storage typically houses mission-critical data. • Secondary Tier: Intermediate speed and performance can be a mix of mission-critical and non-critical data. • Archival Tier: Slowest and cheapest storage for data that rarely needs to be read and is not time-sensitive. Info-Tech Research Group 12

3 Identify requirements for your future state Consider all your requirements and devise a data protection plan that can best meet them. Compare your desired recovery capabilities with what is currently attainable. Be certain that your backup process will capture data with the kind of regularity required by your recovery objectives. If you need to recover from ten minutes ago but are only performing daily backups, your schedule is not meeting your organization’s needs. Discuss the gaps between the desired state and the present state. Consider the current backup plan versus the desired plan. What are the points of divergence? What is the case for doing them one way rather than the other? Are there factors that are not being considered that should be acknowledged in your policy? Think about how technology can help – but make sure that you start with your requirements. Requirements drive technological needs, not the other way around. Identify places where software or hardware solutions can help you meet your needs. Info-Tech Research Group 13

4 Don’t neglect the role of governance IT Governance Is… An enabling framework for decision-making context and accountabilities for related processes. A means of ensuring business-IT collaboration, leading to increased consistency and transparency in decision making and prioritization of initiatives. A critical component of ensuring delivery of business value from IT spend and driving high satisfaction with IT. IT Governance Is Not… An annoying, finger-waving roadblock in the way of getting things done. Limited to making decisions about technology. Designed tacitly; it is purposeful, with business objectives in mind. A one-time project; you must review and revalidate the efficiency. Info-Tech Research Group 14

Inadequate SOPs led to a major data loss and over $99, 000 in recovery costs CASE STUDY 1 Company A mid-sized US organization with over 1, 000 employees Source Info-Tech Interview Situation Hard dollar recovery costs • IT supports storage nodes replicated across two data centers. SOPs for backup procedures did not include an escalation procedure for failed backups or a step to communicate successful backups. Management was not aware of the issue and therefore could not address it before a failure occurred. Backup specialist (vendor) to assist with restoring data from tape Incident • Primary storage had a catastrophic failure, and that put pressure on the secondary storage, which then also failed. All active storage failed, and the data became corrupted. Daily backups were failing due to lack of disk space on the backup device. The organization had to resort to monthly tape backups. Impact • Lost one month of data (had to go back to the last tape backup). • Recovery also took much longer because recovery procedures were also not documented. • Key steps such as notifying impacted customers were overlooked. Customers were left unhappy not only with the outage and data loss but also the lack of communication. $12, 000 Temps to re-enter one month of data $5, 000 Weekend overtime for four people (approximately 24 hours person) $5, 538 Productivity cost for affected employees for one day of downtime $76, 923 Total $99, 462 Intangible costs High “goodwill” impact for internal staff and customers. The data loss pointed out a glaring hole in our processes – the lack of an escalation procedure. If I knew backups weren’t being completed, I would have done something about that immediately. – Senior Division Manager, Information Technology Division Info-Tech Research Group 15

Start with why? : Explore the data protection taxonomy 1 Why are you protecting data? Operational Recovery What are you protecting? Device Type How are you protecting data? Where are you protecting data? Who (what vendors) will help you protect data? Protection Technology Disaster Recovery Data Type Storage Technology Retention and Preservation Content Type Access Technology Governance, Risk & Compliance Operational Environment Management Technology Discussed in this blueprint Location Type Market Segments Data Relocation Sales Channels Not Covered 1. SNIA Info-Tech Research Group 16

Use these icons to help direct you as you navigate this research Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities. This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project. This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization. Info-Tech Research Group 17

Info-Tech offers various levels of support to best suit your needs DIY Toolkit “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful. ” Guided Implementation Workshop Consulting “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track. ” “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place. ” “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project. ” Diagnostics and consistent frameworks used throughout all four options Info-Tech Research Group 18

Establish an Effective Data Protection Plan – Project Overview 1. Define the Current State 1. 1 Identify project rationale 1. 2 Document the current state methodology 1. 3 Determine problems and opportunities for the data protection plan 2. Conduct a Business Impact Analysis 2. 1 Understand the importance of a business impact analysis (BIA) 2. 2 Conduct the impact analysis 3. Propose the Future State 4. Establish Governance 3. 1 Determine requirements for future state solution 3. 3 Document the desired features for the future state 4. 1 Explore components of proper governance for the data protection plan 3. 2 Document the desired future state methodology Best-Practice Toolkit Establish project rationale Create a diagram of the current state Guided Implementation Identify problems and opportunities Identify systems and scoring criteria Determine attributes for data protection solution Conduct the impact analysis Create a diagram of the future state Review IT operations, auditing, and compliance best practices for data protection plan Find knockout criteria Module 1: Define the current state of your data protection plan Module 2: Conduct a business impact analysis to understand the requirements for restoring data Module 3: Propose the future state of your data protection plan Module 4: Establish proper governance around your data protection plan Phase 1 Results: • Current state RACI • Current state table-top exercise • Value proposition canvas Phase 2 Results: • Business impact analysis Phase 3 Results: • Future state table-top • Future state solution requirements • Value proposition canvas Phase 4 Results: • Data protection plan Onsite Workshop Info-Tech Research Group 19