Planning for backup and recovery: the key elements for a successful backup and recovery strategy

Computer Technology Review, March, 2004 by James Dow

Backup and recovery are point-source solutions on the continuum of availability and resiliency. Availability describes operational behavior of a system under adverse conditions (i.e., failure of one-half of a clustered system). Resiliency describes the operational behavior of system restoration after service degradation due to an unplanned event. In their most extreme examples, both availability and resiliency are provided by backup and recovery systems.

Backup and recovery systems traditionally address two specific requirements: error correction (i.e., inadvertent deletion of a necessary file or files) and disaster recovery. Many firms developed and currently operate backup and recovery strategies primarily designed to address the operational issue of error recovery. The backup media generated by these error recovery strategies are subsequently taken off site and extended to meet disaster recovery requirements mandated by regulatory bodies or to support limited recovery for only a few weeks or long enough to close the business. Most of these strategies focused on the risks associated with a site- or institution-specific outage or disaster.

Re-Evaluating B&R Strategies

Enterprises of all sizes, from small businesses to large financial services firms, are re-evaluating backup and recovery strategies. This is driven by several, highly correlated factors. The terrorist attacks of September 11, 2001, and the North East power grid failure of August 14, 2003 demonstrated, firstly, that regional disasters must be considered as likely as localized institutional disasters--which calls into question the validity of over-subscription in the first-come, first-served shared services disaster recovery market, such as IBM, EDS, and SunGard. Secondly, these events demonstrated that in the age of e-business, same-day settlement, and real-time Internet transactions, computer systems are no longer business facilitation tools, but rather fundamental components of the ability to perform business at all. This calls into question the pervasive belief that long-term recovery strategies can rely on the ability to close the business through access to sufficient books and records. These factors are evident in the Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System, which addresses business resiliency in the financial services sector, and was co-authored by the Federal Reserve Board, the Office of the Comptroller of the Currency, and the Securities and Exchange Commission.

Internal providers of data center services are increasingly challenged to address a diverse set of changing requirements and subjective interpretations. The key to success in this endeavor, however, is to ensure that the solutions are well mapped to the business requirements. Inasmuch as business requirements are potentially subject to significant change, as indicated above, the first step in the architecture of a functional availability and resiliency model is to perform a Business Impact Analysis or BIA.

Business Impact Analysis

The BIA provides identification of critical business processes required to operate the business. These business processes are then mapped to the underlying applications, which, in turn, allow identification of systems, databases, and files required to operate the business. Within the context of the BIA, all business processes and applications seldom share a common level of criticality, requiring the imposition of tiers of availability; for example, some systems must be operational within 30 minutes of an event, and other systems must be operational within two business days. An important factor for the enterprise to consider during the BIA is the dollar value of the business to be recovered. Backup and recovery systems mitigate risk of loss, but only at the cost of implementation. A well-understood cost model of the business to be protected is critical for valid interpretation of the costs to deploy a robust recovery system.

RTO, RPO and MPO

The definition of these tiers of availability and resiliency provide the foundation for a functional architecture. The key data points that differentiate the tiers of availability are the RTO, RPO, and MPO. The RTO is the maximum time between an event and the time at which a system must be returned to operation, or Recovery Time Objective. The RPO is the maximum allowable data loss, or Recovery Point Objective. The MPO, or Maintenance Point Objective, is an additional but less commonly articulated metric that describes the maximum allowable window for the performance of system maintenance.

The RTO, RPO and MPO are critical data points to consider during architecture of an availability and resiliency model. As previously discussed, tape-based backup and recovery systems can be considered as point-source solutions on this continuum. Tape-based backup systems, however, do not easily accommodate a RTO of less then four hours, due to the time required to physically retrieve the data from tape, nor do they easily accommodate a RPO requirement of less than 24 hours for similar reasons.