DR-as-a-service providers need to be vetted properly to ensure that the services you have purchased are deliverable and meet expectations during a disaster.
Disaster recovery as a service is a hot topic and an exciting offering from cloud providers today. But before there can be a discussion on what to look for when you evaluate DRaaS providers, there has to be an understanding of the services they offer.
In reality, DRaaS is a broad spectrum of potential services. The technology solves the problem of having another location to bring up an organization's entire IT in the event of disaster. It eliminates duplicate hardware and software requirements and has the potential to save a company a lot of money.
Here are some services that DRaaS providers can offer:
simple data recovery for administrators and selective recovery from within the service provider's data center;
virtual machine mounting (and physical-to-VM conversion) within the service provider's data center for temporary application availability; and
full DR within the service provider's data center, including optional services such as VM mounting, VPN rerouting, domain name system (DNS) updating, virtual desktop infrastructure (VDI) access to data for users and physical access for administrators.
Along with technical services, providers can also run operations for extended periods of time and bring in experienced staff to assist with recoveries, DR planning and testing.
The key to selecting a DRaaS provider is to ensure it delivers what your organization requires to stay up and running. Don't assume a service provider offering DRaaS will cover all disasters and deliver all possible services. The worst time to discover that the service provider cannot provide a required service is during a disaster.
Conduct an internal DR assessment
Before you evaluate DRaaS providers, you should conduct an internal assessment as to what is required organizationally by applications, users and customers. In other words, what does DR mean to the organization?
Does it mean zero downtime and zero loss of data or some defined period of downtime and a loss of some data? How does this requirement vary by application, workload and so on? And what types of disasters are you protecting against -- hardware failures, human errors, malware, natural disasters, terrorism?
Finally, what is the budget? The old rule of 90/10 applies here. The last 10% of recovery time objective and recovery point objective often represents as much as 90% of the cost. The closer either or both get to zero, the more rapidly costs go up. Determining the answers to the above questions is crucial in establishing whether a DRaaS provider can meet your requirements.
Essential questions to ask DRaaS providers
Many DRaaS providers are to the BC/DR market. This is because DRaaS is a natural outgrowth of the backup-as-a-service market.
Many DRaaS providers are new to the business continuity and DR (BC/DR) market. This is because DRaaS is a natural outgrowth of the backup-as-a-service market, and cloud backup is far simpler to deliver. Picking a service provider necessitates a thorough vetting to ensure the services purchased are deliverable and meet expectations.
Do not expect a service-level agreement (SLA) to guarantee that expectations are met. SLAs typically provide a refund of payment if the service provider fails to contractually deliver. The key is asking DRaaS providers questions on a wide array of criteria before selecting a service.
Here are four primary areas you should address when asking DRaaS providers about their services:
Resources
What percentage of the service provider's customers can be supported concurrently during a regional disaster, such as a hurricane? Find out what DR resources are available for recovery and how many customers can be supported concurrently using the service provided. Knowing how resources are managed, tracked and updated can help you evaluate DRaaS providers. What happens if the vendor cannot provide DR services?
Considering the number of customers a provider may service, it can help to know where you and your potential disasters stand when it comes to prioritizing. What are the rules for declaring a disaster? Is it first-come, first-served until resources are maxed out? What happens to those who cannot be serviced?
Access
Be sure to ask DRaaS providers about how internal applications can be accessed in a crisis and what the status of VPNs will be. Will they be managed or rerouted? When using VDI, find out how that will affect user access and who will be managing it during a disaster.
With outward-facing applications, ask providers how customers, partners and users will access them and whether or not DNS nodes will be updated for outward and customer-facing applications. Along with users, ensure that administrators will also have access to servers and applications when necessary.
Assistance
When you evaluate DRaaS providers, ask about their standard processes and what assistance they will provide. What are the procedures for failback? What professional services/skills/experiences are available from the service provider to facilitate DR, and how much do they cost? How much help can be expected in a DR event? How much support is needed or desired from the provider will vary by organization.
For example, what are the DRaaS provider's testing processes? If your organization prefers to perform testing internally, let the provider know, and find out if that is an option. Also, find out how long you can run in the service provider's data center after a disaster is declared to ensure that you have enough time to recover.
Pricing
How much your organization budgets for DRaaS will vary by company size and industry, so check costs with potential providers. General costs, along with those of additional services, could make all the difference. What are the costs associated with the various DRaaS options? Are they a la carte, bundled or priced upfront? Is there a mix of upfront and recovery event costs?
DR is a nontrivial event. DRaaS has the potential to be a cost-effective, efficient BC/DR solution but only if it meets your organization's requirements.
Next Steps
Deciding between an IaaS host or MSP for disaster recovery
When premium disaster recovery service providers make sense
