The following article was published today in CTR
Tuesday, 23 November 2010 13:38
By Nancy Hurley
IT Service Management (ITSM) aims to develop best practices and processes that marry IT service delivery with business needs for operational efficiencies and financial benefits, as well as for the increased satisfaction of internal or external users/customers. ITSM products abound for many applications, yet, for data protection (encompassing backup, replication, retention, and recovery), they are notably rare. Considering the fact that no business-critical applications can work if data is not available, it is surprising that so few such products are available.
If one accepts ITSM for data protection, we are required to think of data protection as a service in the first place– as a part of the value that IT delivers to the organization. Many enterprises are not “there” yet. Aside from inadequate or inefficient data protection that results in downtime, inaccessible data can cause lost revenues and perhaps even lost customers, especially for MSPs, cloud providers and complex infrastructures.
In these environments data protection is a critical IT service with business, financial and operational impact. These organizations, and the others that choose to adopt data protection as an IT service, would be wise to implement Service Level Agreements (SLAs) governing performance, availability and recovery/response as determined by business needs. SLAs and SLA management are integral to ITSM systems, and data protection as a service is no exception. Adopting an ITSM-like methodology, a Data Protection Service Management (DPSM) model, addresses these issues by establishing best practices guidelines and processes for data protection operations. These may involve standardizing on backup policies for certain functions, applications or servers; for example, daily full backups of Exchange servers with retention rates of 180 days. (It should go without saying that backup infrastructure must be able to support the business objectives.)
It’s incumbent on IT organizations to set terms and expectations appropriately, and to be able to report on their ability to meet those expectations. Creating SLAs, and managing IT operations according to those SLAs, vastly reduces risk and takes the guesswork out of delivering IT services to customers or stakeholders. SLAs for data protection in particular are rare, and if they exist, they are often outdated. In place of actionable, effective SLAs, many organizations rely on static reporting of backup successes and failures. This after-the-fact troubleshooting does little or nothing to help meet business goals or deliver value to the customer or internal department that receives the service.
An SLA that is merely implied instead of predetermined is often the most risky in terms of the provider-recipient relationship. The impact of incidents and failures becomes far greater than it could be. The recipient may have certain expectations (including unmeetable ones) or believe the service should be delivered at a certain level. Often the expectation is simply “all my data is and will be recoverable whenever I may want it,” while the provider believes and behaves differently. Corporate management, operations, and external auditors may have their own expectations. Customer satisfaction can rarely be achieved in this case, and a provider cannot prioritize or manage service problems because there are no realistic parameters for success.
Data protection SLAs, in fact, improve the process. Expecting all backups to work all the time is unreasonable considering the variables, from the application itself to the network status to the available capacity to the available window. With the above expectation, the IT manager would spend too much time making sure all backups work all the time, and all data is available. But managing to the SLA empowers the IT provider to identify which backup failures jeopardize which SLAs.
Being clear about what is achievable, and helping data owners understand the costs associated with data protection, creates agreement regarding expectations for recovery. This is becoming particularly vital to cloud and SaaS vendors that must communicate trust and credibility to their customers and prospective customers. These and other providers will find that consistently publishing SLA results increases customer retention and satisfaction, and reduces turnover.
No two providers will define success the same way, or have the same vision of what SLA compliance means to their customers. Standardized automated reporting is helpful for assessment and troubleshooting, particularly when multiple data protection applications are in use. However automated error reporting only shows a small portion of the overall picture, and if the point is to meet service delivery objectives, then more comprehensive management is required. A true DPSM solution can analyze whether or not an organization is meeting its business goals. DPSM tools evaluate the infrastructure’s ability to adhere to promised service levels, determine which job failures impact the potential success of the SLA and why, and eliminate redundant policies to allow the IT resources (human, technical, capital and otherwise) to focus on fewer more relevant tasks. DPSM tools also perform many more functions to ensure recovery, reduce risk and improve customer satisfaction. With this analysis capability, providers can also respond better to audits because there is supporting documentation that shows that the correct data is being retained for the correct span of time.
Data protection is too critical not to be considered in terms of its impact on business goals, and it deserves the same attention to best practices and process success as all other mission-critical IT services. The DPSM model, including managing to SLAs, significantly improves IT business alignment, reduces capital costs and improves customer satisfaction.
Nancy Hurley is president and CEO of Bocada, Inc. (http://www.bocada.com), a market leader in data protection services management. She is most familiar to the industry as a senior analyst at Enterprise Strategy Group (ESG) where she provided strategic consulting to vendors in the storage software and infrastructure markets. She has held executive positions with Sun Microsystems, Tektronix Communications and Hewlett Packard