IBM Global Technology Services

Thought Leadership White Paper

November 2012

Transitioning business continuity to the cloudA systematic approach to adopting cloud-based resilience

2 Transitioning business continuity to the cloud

Executive summaryFinding better ways to reduce IT service disruptions without increasing costs is a challenge that continues to plague many organizations. Traditional approaches to business resiliency—like server, storage and even data center redundancy—were often the only options that could satisfy the stringent resilience objectives of enterprises. However, these options were expensive, and perhaps most importantly, they can still leave the business vulnerable to downtime.1

Many enterprises have expressed the need for a long-term resil-ience strategy that can more quickly adapt to changing business requirements while supporting increased consistency in service delivery across the globe.2 In addition, organizations need a long-range plan that is capable of reducing recovery times in the event of a system outage, service disruption or disaster.

Moving business resiliency to a cloud environment can provide such a solution and offers a myriad of benefits. For example, it can help organizations become more agile and f lexible by allowing them to add or remove resources as needed and pay only for what they use. In addition, the cloud makes it possible for businesses to convert capital expenditures to operational expenditures.

Successfully transitioning continuity to the cloud, however, requires a well-planned approach and a thorough understanding of cloud-based options. Multiple considerations must also be addressed, including service-level agreements (SLAs), offsite storage feasibility and integration with traditional disaster recovery methods.

This white paper examines the resiliency challenges facing organizations today and discusses the factors that organizations must address. The paper also presents a step-by-step approach for planning, designing, implementing and evaluating the transi-tion to cloud-based resiliency.

Resiliency and its challengesAberdeen Group found that between June 2010 and February 2012, the cost per hour of downtime increased, on average, by 38 percent.3 This increase is not surprising as more and more business operations have been automated. Today most, if not all business processes include some type of computing capability and those come to a complete standstill if the server or business application is not available. Aberdeen estimates the industry average cost of an hour of disruption to be around $182,000USD.4 Also, the 2012 IBM Reputational Risk and IT Study found that system outage is one of the top two IT risks that can harm an organization’s reputation.5

It is no wonder that improving resiliency and continuity has become such a high-priority business objective in recent years. Numerous factors have contributed to this trend:

●● The number of applications to be managed and poten-tially backed up has increased multifold over the past decade. Companies invest huge amounts of money in the hardware and technical management of these applications. Furthermore, the proliferation of applications has increased the potential points of vulnerability.

●● Organizations today are more geographically dispersed than ever. Although companies invest heavily in infrastruc-ture, poor performance and spotty availability are often a reality given today’s distributed workforce and customer base.

●● Infrastructural ecosystems have become more complex. Today’s typical IT infrastructure is increasingly heterogenous and distributed, making it more complicated to recover data in the event of a disruption.

●● Decreasing costs of hardware are encouraging organizations to maintain backup and recovery in house. However, few of these enterprises have the skills, expertise or discipline to manage this effectively.

●● The use of virtualization is increasing. This can help reduce costs, but important information may be lost if virtualized applications are not properly managed.

IBM Global Technology Services 3

Organizations who improve from “Laggard” to “Industry Average” levels of downtime can potentially reduce losses over $3 million USD per year.6

Although IT budgets for disaster recovery and business continu-ity have been decreasing around one percent each year, business demands have increased. Organizations are under increasing pressure to “do more with less.” Organizations must operate in mixed environments and around the clock in the midst of capac-ity and skills shortages.5 At the same time, they must face the challenges of:

●● Providing high data availability●● Supporting business continuity during downtimes and data

outages●● Facilitating faster recovery from interruptions or disruptions●● Securing skilled professionals to manage recovery and backup

in house

And the perceived and actual risks are increasing. According to a joint Forrester Research and Disaster Recovery Journal survey, 82 percent of business continuity decision-makers and inf luenc-ers feel that their organization’s risk level is increasing. Survey respondents cited the following as the top reasons why they believe that their IT risk is increasing: 1) reliance on technology; 2) business complexity; 3) frequency and intensity of natural disasters; and 4) reliance on third parties.7

Cloud technology can helpOrganizations increasingly rely on the cloud for running IT applications—and are finding that it is a more scalable, f lexi-ble and cost-effective solution. Disaster recovery and business continuity also plays a big part in the decision to adopt cloud computing. By 2015, 30 percent of midsize businesses will adopt recovery-in-the-cloud services to support IT operations recovery.8

Some of the advantages of a cloud-based business resilience design include its ability to help:

●● Improve recovery time, from days to hours or minutes ●● Provide tailored delivery models●● Offer improved scalability and geographic diversity of

operations●● Allow for pay-as-you-go pricing●● Offer more f lexibility, for example, workloads that can evolve

with the needs of the business●● Integrate with traditional environments and other cloud

environments●● Allow for data portability●● Afford greater agility, for example, as can be seen in rapid

provisioning of new disaster recovery services designed to provide more effective self service

Cloud computing offers the scope for improved service provider interaction and reduces management effort through centralized portals.

Figure 1. With flat IT budgets, the increasing pressure to reduce downtime is creating a need to solve gaps with new technologies

Days

Hours

Minutes

Seconds

Rec

over

y ob

ject

ives

Data loss Gap

HighMediumLow

Potential losses over time

Hot site

s, warm

sites

Dedicated IT equipment

Cdd sites

Shared IT equipment

Tape recovery

Disk recovery

Asynchronous replication

Synchronous replication

4 Transitioning business continuity to the cloud

Enhancing disaster recovery and business continuity can play a big part in the decision to adopt cloud computing for resilience.

Barriers to adopting cloud-based resilienceOne of the biggest barriers preventing some enterprises from embracing the cloud for resilience is lack of knowledge or expe-rience with the different technologies to achieve cloud resilience across dispersed environments. Many organizations do not know which applications and data might have the greatest affinity for cloud resilience and are reluctant to implement new processes that require additional IT, business and recovery education. In addition, they may not have undertaken an in-depth evaluation of their current disaster recovery strategy, architecture and procedures. With such a limited idea of the effect cloud-based recovery can have on their business, these organizations may be wary of an approach that is unfamiliar to them.

Other organizations may not possess the capability to automate dissimilar hardware restorations. If the brands and type of serv-ers the enterprises possess in their production site and recovery center are different (physically or virtually), chances are there will be disparities in recovery efficiency. Such issues may require specialized handling while adopting cloud-based resilience.

Another common adoption barrier is that enterprises have many applications that simply cannot tolerate running in a cloud or virtualized environment, either because they are on legacy

hardware or the vendor won’t support them. Companies with this challenge have traditionally taken a monolithic approach to data recovery (DR), protecting all systems with the same approach; however, as other models emerge, more and more companies are beginning to segment their recovery approaches either by platform or system criticality. In the future, many enterprises will take a multi-tiered approach to recovery, poten-tially using a traditional “cold” site for mainframe applications, coupled with managed services or cloud recovery for open systems.9

Additional barriers include:

●● Concerns about security, compliance and control issues in the cloud

●● Perception that there isn’t a trusted vendor in the market offering the service

●● Concerns over bandwidth requirements●● Lack of buy-in from either IT or business leadership or

decision-makers

Choosing the right type of cloud-based resilience solutionWhether an organization chooses to focus more on internal pain points, such as technology constraints, business preference and costs, or external pressures like regulatory demands, selecting the right type of cloud resilience solution—or combination of types—is essential. Depending on its needs, the organization may prefer one type of cloud-based solution over another, as described in Table 1.

Types of cloud solutions

In-house management Resilience as a service Mix and match

(private cloud) (public cloud) (hybrid cloud)

The business creates a separate virtualized, The organization subscribes to a cloud service, The business implements a blend of both

scalable cloud environment to back up and which it buys on a “pay-per-use” basis with private and public cloud services to help meet

recover traditional data center services rates determined by the resilience requirements business demands for agility as well as risk

across several service tiers. that are needed for specific data services. tolerance for sensitive applications and data.

Table 1. Three ways of adopting a cloud-based recovery solution

5IBM Global Technology Services

An orderly approach to transforming recovery in the cloudCharting the path for a successful transformation to cloud-based business resilience and continuity requires a planned approach that is cohesive and encompasses everything from planning and design to implementation and evaluation. The four phases of a planned approach consist of strategy, design, transition and transformation.

Phase 1: Strategy An end-to-end business resiliency cloud strategy includes system and data availability, recovery and backup, and data archiving. Separately or combined, these services can help organizations use security-rich cloud technologies to more quickly and cost effectively recover from disruptions. The key considerations in strategizing the move are listed below:

●● Understand the business direction, and identify and document the resilience requirements.

●● Analyze workloads to determine which applications and data have the greatest affinity to cloud recovery, because it may not make sense to move recovery for all applications and data to a cloud environment.

●● Determine the most appropriate cloud resiliency delivery model.

●● Understand the potential network latency, and define the cloud architecture that will support the resiliency requirements.

●● Ascertain legacy resiliency processes that may need to change, including plans, policies and procedures such as training and communication. Timelines and milestones should be identified.

Phase 2: Design The purpose of the design phase is to draft a transition plan that is more easily implemented, including financial analysis and placement of proposed resilience tiers.

●● Design and construct the transition plan, being mindful to manage the different application-specific SLAs.

●● Help manage quality, security and compliance. ●● Integrate resilience cloud solution and legacy recovery into

one cohesive picture determined by which of the traditional processes in the organization needs to be preserved.

●● Update policies and procedures, and identify and document changes to management and legacy recovery processes.

Phase 3: Transition●● Run a pilot program in which the initial installation or

instance is convened at a test center and subsets are tested.●● Educate all personnel so that they are well versed in the new

environment, including how to use the cloud-based services, what changes have been made to recovery procedures and the use of the recovery and testing portal. Hands-on supported transition provides education through example rather than by trial and error.

●● Deploy the new solution. The move begins, validating each new service until the enterprise is confident that it can manage it.

Phase 4: Transformation●● The solution team supporting the transformation should help

manage the organization’s environment remotely—either as a dedicated or shared resource depending upon the client’s requirements.

●● Monitoring key performance indexes (KPIs) allows the organization to optimize system response time or other performance attributes. The network, servers, storage capacity and productivity are tweaked to exploit their full potential.

●● Testing is a critical aspect of the transformation phase. The cloud-based solution must be able to be integrated with the existing resilience testing program.

6 Transitioning business continuity to the cloud

Figure 2. IBM offers an end-to-end, cloud-based business resilience solution.

The IBM solutionDespite the many challenges your business may face, the IBM team of resiliency professionals can help your organization successfully take advantage of cloud technology to improve your resilience—even within a tight budget. Our phased approach offers an end-to-end solution that is designed to be security rich, cost effective and scalable to help you:

●● Improve your risk management with an enterprisewide resiliency strategy

●● Reduce your costs through proactive incident response and reduced downtime

●● Facilitate resilient service delivery ●● Respond with greater speed and agility●● Better manage the regulatory requirements of your business●● Reduce the cost of disaster recovery testing●● Increase the frequency with which you are able to conduct

disaster recovery testing

Web Infrastructure Web server Streaming mediaCollaboration Email Workgroup

Transition and transformationStrategy and design

Step 1 Step 2 Step 3 Step 4

Data discoveryand requirement definition

Transformation strategyand design

Migration, standardizationand registration

Remediation, testingand workload transition

Collect key businessresilience requirementsdata on application anddata dependencies. Profileexisting applications,governing policies,strategies and plans.

Identify candidates with“cloud resilience affinity”.Perform financial analysis,proposed resilience tiersplacement, architecturaldiagrams, and executabletransition plan.

Provision target resilienceenvironment. Usingmethods and tools, weautomate, virtual or physicalservers for recovery andconfigure the workload forresilience testing.

Test the resiliencestrategy, gain customeracceptance, and performtransfer to ongoingmanagement.

Tools, assets and IBM Innovation

Repeatable model Factory approach

ISV Applications Oracle Business Suite PeopleSoft Others

IT Infrastructure Print and file management Networking Proxy caching Security Systems management

Web Infrastructure Web server Streaming media Collaboration Email Workgroup

Custom Applications Java (typically hosted in web application server)

Databases DB2, Oracle

Custom Applications(non-Java) C/C++ Cobal, scripts

IBM provides several options for organizations that are ready to consider transitioning to a cloud-based business resilience solution. Whether you prefer a private, public or hybrid cloud setting, we can tap into our extensive expertise and industry experience to develop an end-to-end solution that aligns with your business and IT resilience requirements. Our Resiliency Consulting Services include planning, design and implementa-tion services which can help you document decisions and requirements to create a detailed roadmap for recovering critical business applications in the cloud. Additionally, we can provide key deliverables and services to help plan and implement a robust transition for your enterprise, including:

●● Resilience tiers, including technical requirements for overall cloud capacity:– Security– Data latency tolerance– Network bandwidth optimization– Testing requirements

●● Architectural drawings and work products that describe the solution

●● Recommended actions to integrate your program with legacy recovery solutions and changes required to policies, plans and procedures

●● A transition plan describing the implementation steps and changes needed to support a resiliency cloud

●● A recovery test plan describing the test goals and use cases to validate the resiliency cloud

●● A file plan (optional) describing data and hardware that can be reprovisioned or retired

●● Resiliency consultants to help you more smoothly transition your resiliency capabilities to the cloud

7IBM Global Technology Services

ConclusionFor today’s data-intensive, time-sensitive and transaction-driven enterprise, a cloud-based business continuity approach can play a significant role in reducing the risk of system outage and data loss from IT disruptions. However, as f lexible as the cloud model may be, it is not a mere best practice that can easily be implemented; it represents a paradigm shift for business continuity.

Whether choosing a private cloud, a public cloud or a hybrid solution, following a cohesive plan with clearly defined steps can help enable a successful transition. A cloud management solution that is security rich, cost effective and scalable can give organiza-tions an opportunity to significantly improve their business resilience and to gain full value from their cloud investment.

Why IBM?IBM is a recognized leader with deep knowledge and cross-industry experience in the area of virtualization and cloud services technologies. With a robust set of cloud tools, time-tested methodologies and years of experience in implementing business continuity and disaster recovery solutions, we can pro-vide your end-to-end, cloud-based solution that can more cost effectively support your IT disaster recovery and online business data backup requirements.

In fiscal year 2011, we enabled over 20 million end-user clients worldwide, managed 4.5 million client transactions per business day and connected over 300,000 trading entities to the IBM cloud—making us one of the world’s largest providers of software as a service (SaaS).

We combine best-of-breed hardware, software and services to help provide our clients with more feature-rich cloud solutions. More than 1,800 professionals in IBM’s Business Continuity and Resiliency Services division work with our specialists in storage and software to develop cloud-based business resiliency solutions that can address clients’ application recovery and resiliency, data backup and recovery, and archiving needs.

For more informationTo learn more about the resiliency consulting planning, design and implementation services for cloud resiliency from IBM, please contact your IBM representative or IBM Business Partner, or visit the following website: ibm.com/services/continuity

Additionally, IBM Global Financing can help you acquire the IT solutions that your business needs in the most cost-effective and strategic way possible. We’ll partner with credit-qualified clients to customize an IT financing solution to suit your business goals, enable effective cash management, and improve your total cost of ownership. IBM Global Financing is your smartest choice to fund critical IT investments and propel your business forward. For more information, visit: ibm.com/financing

© Copyright IBM Corporation 2012

IBM Corporation Global Services Route 100 Somers, NY 10589

Produced in the United States of America November 2012

IBM, the IBM logo, ibm.com, and IBM SmartCloud are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at “Copyright and trademark information” at ibm.com/legal/copytrade.shtml

This document is current as of the initial date of publication and may be changed by IBM at any time. Not all offerings are available in every country in which IBM operates.

The performance data and client examples cited are presented for illustrative purposes only. Actual performance results may vary depending on specific configurations and operating conditions.

It is the user’s responsibility to evaluate and verify the operation of any other products or programs with IBM products and programs.

THE INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING WITHOUT ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OR CONDITION OF NON-INFRINGEMENT. IBM products are warranted according to the terms and conditions of the agreements under which they are provided.

The client is responsible for ensuring compliance with laws and regulations applicable to it. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the client is in compliance with any law or regulation.

Actual available storage capacity may be reported for both uncompressed and compressed data and will vary and may be less than stated.

1 Forester, Cloud-based disaster recovery barriers and drivers in the enterprise, March 2012 (A Custom Technology Adoption Profile Commissioned by IBM)

2 IDC, Message from large enterprises and start-ups to providers: Helping custom-ers in a “cloudy” world will require a long-term strategy, making fundamental changes, and building an adaptive business model, November 2011, #231293

3 Aberdeen Group, Datacenter Downtime: How Much Does It Really Cost?, March 2012

Please Recycle

4 Ibid.5 The 2012 IBM Global Reputational Risk and IT Study survey, conducted

by the Economist Intelligence Unit, September 2012, RLW03009-USEN-00

6 Aberdeen Group, Datacenter Downtime: How Much Does It Really Cost?, March 2012

7 Forrester/Disaster Recovery Journal Business Continuity Preparedness, Q411

8 Gartner Predicts 2012: Business Continuity Management Maturity Takes Two Steps Forward and One Step Back Due to Technology and Cultural Changes, November 2011, #G00225480

9 Forester, Cloud-based disaster recovery barriers and drivers in the enterprise, March 2012 (A Custom Technology Adoption Profile Commissioned by IBM)

BUW03028-USEN-00