Backup is important, recovery is everything.

Digital data is now widely perceived as a mission critical and core part of a company's value, and data itself has now become the currency of the information age on a global basis. The requirement for continuous availability systems applies to a larger number of business applications than ever before as it has become essential for survival in most businesses today. The attacks of 9/11 now have most companies reviewing, revising, and enhancing their disaster recovery plans and strategies. More importantly, they are focused on how fast their critical systems can be made available in the event of an outage of any type. The most important aspect of disaster recovery is now recovery.

Continuously available systems consist of hardware and software designed to protect against component and system-level failures. Recent data indicates that 44 percent of data loss is caused by either hardware or systems failure, 32 percent is caused by human error, and 14 percent from software and program error. The complexity and cost of these solutions depends on the number of users, the types of services provided, and the definition of what is an acceptable versus an unacceptable outage. The value in terms of lost revenue for an hour's outage for selected applications is listed in Table 1.

Higher availability comes at a higher cost. Every step taken beyond the traditional centralized data center has offered the potential of greater productivity functionality, and convenience for IT organizations. Along with these advantages, however, distributed computing has exposed companies to a ranch greater vulnerability. It is estimated that less than 5% of single-user or desktop/PC systems data is adequately managed, if at all, meaning that the data is unlikely to be recovered in the event of any outage. For server and multi-user systems (excluding the mainframe computer market where storage management techniques are more advanced), as much as 80% of the business data is not managed. From local area networks to distributed computing platforms, and now the Internet and intranets, the level of exposure has increased while disaster preparation has decreased. The newest areas of risk are the Internet and corporate intranets with little preparation given to disaster recovery for these increasingly important systems. The estimated average costs of system failures would be nearly fatal to some companies and can range to nearly $3 million of lost revenue per hour of downtime. A server that is 99 percent available may seem highly available but will actually be unavailable 5,000 minutes per year! Availability figures range from 95-plus percent for NT-based servers to 99.999-plus percent for enterprise OS/390 and z/OS Parallel Sysplex servers. Five nine's are important, nine to five isn't. The number of minutes per year of unavailability can be misleading (Table 2).

Beyond the number of nines as a measure for availability, a new set of metrics has emerged defining the impact of lost availability on the level of service delivered. Often referred to as "QoS" for Quality of Service, we now have a way to look at the type of service being delivered when a failure actually occurs. QoS takes the availability percentages to the next level and begins to add meaning to the impact of an outage. The path to the "high nines" describes new computing architectures that will ultimately become self-healing.

For years the question of "what is your backup strategy" was frequently asked. Recent events indicate that the new critical question is "what is your recovery strategy?" Do many businesses actually know the answer to the question of how long it will take to recover and make an application fully operational again? How much is a business willing to pay for data protection capabilities? The answer to this question is usually based on the importance of data to a particular business (Table 3). However, spending more on IT functionality goes directly against mandates from many companies to reduce their budget, thus putting management in a difficult position. Some applications can tolerate a delayed recovery time whereas others require immediate availability in the event of an outage. Table 1, once again, provides revealing and general guidelines into industry averages for a loss of data per hour in several vertical markets but each business may want to determine the specific business value of their applications.

Compass America, an independent consulting firm, conducted detailed analyses of approximately 150 midrange Unix data centers in Fortune 1,000 organizations from March 2000 to September 200l. They found that only 25% have any type of disaster recovery plan in place. Moreover, one-third of those midrange environments that do have recovery plans have never tested them.

In the event of a disaster, it was estimated that:

* Only 15% of midrange data centers would be able to recover more than 30% of their applications in any time frame.

* Just 3.8% could recover their applications within the same day.

* Only 2.5% could recover within four hours.

These gaps in disaster preparedness reflect a widespread and limited approach to disaster recovery planning in general. In other words, an effective disaster recovery plan must address the requirements of the business and its applications in order for the business to survive, and to accomplish this, a business must invest in high availability strategies and architectures much the way individuals invest in insurance. Who does the best job of protecting data on computer systems today? A survey by the Information Technology Association of America in Arlington, VA indicates a breakdown of businesses that have "adequate" data protection strategies in place (Table 4).

Beyond protecting data from human, software, and hardware failures, critical data is exposed to a variety of other factors. The increasingly heavy damages from computer viruses have extended data security measures beyond just protecting the physical infrastructure as the data itself becomes vulnerable to corruption. In the ICSA Labs Computer Virus Prevalence Survey, in 1999 viruses kept 9% of all servers down for periods of one hour or more. In 2000, the number had climbed to 64% of all servers! In Sept. of 2000, the ratio of viruses to e-mail messages in the United States was one virus per every 1,400 e-mails. In May of 2001, the new ratio was one virus for every 400 e-mail messages. In 2000, 40% of all companies experienced data loss from some type of virus, up from 31% the year before. Data destroyed by a virus must have backup copies taken at a time prior to the virus intrusion in order to survive the attack.

The value of data is increasing on a nearly vertical trajectory for most businesses while the cost of data protection is on a similar trajectory. For the near future, successfully aligning data protection and security strategies with the goals of a business may actually be at odds with each other. If security measures don't or can't match the requirements of the business, another disruptive IT trend will become established. The opportunities for advanced data recovery capabilities are at an all-time high and growing. It is no longer enough just to store and retrieve data, we MUST now become accountable for its presence.

Table 1
The Cost Of Downtime

Industry Sector          Revenue/Hour   Revenue/Employee Hour

Energy                     $2,817,846           $589
Telecommunications          2,066,245            186
Manufacturing               1,610,654            134
Financial Institutions      1,495,134          1,079
Insurance                   1,202,444            371
Retail                      1,107,274            244
Pharmaceuticals             1,082,252            168
Banking                       996,802            131
Utilities                     643,250            381
Health Care                   636,030            143
Average--All Sectors        1,010,536            205

Source: META Group


Table 2
High Availability Metrics

                          Unavailability   System Availability
                          (minutes/year)   (% of 100% uptime)

Unmanaged                      50,000.00   90.0%
Managed                         5,000.00   99.0%
Well Managed                      500.00   99.9%
Fault-Tolerant                     50.00   99.99%
High Availability                   5.00   99.999%
Very High Availability              0.50   99.9999%
Ultra High Availability             0.05   99.99999%

                          Availability    Data Recovery
                              Class       Architecture

Unmanaged                       1         Standard Recovery
Managed                         2         Standard Recovery
Well Managed                    3         Electronic Vault
Fault-Tolerant                  4         Electronic Journaling
High Availability               5         Electronic Journaling
Very High Availability          6         Hot Standby/Hot Site
Ultra High Availability         7         Self-Healing

Cause of
Data Loss

HW System              44%
Human Error            32%
Software               14%
Virus                   7%
Natural Disaster        3%

Source: Strategic Research Corp., Hanson


Table 3
The Data Recovery Value Chain

Value of Data        Recovery Architecture   Recovery Time

Disaster Tolerant    Hot site, completely    Immediate for total
(Mission Critical)   duplexed                I.T. recovery

Fault Tolerant       Remote disk mirrors,    Immediate for data
(Critical)           geographic separation   access

Fault Tolerant       Local disk mirrors,     Immediate for data
(Very Important)                             access

Failure Resilient    Electronic Vaulting     Quick recovery,
(Important)          (Offsite, remote tape   minutes, hours
                     backup)

Failure Sensitive    Onsite Tape Backup      Quick recovery,
(Important)                                  minutes, hours

Failure Sensitive    Offsite Backup          Delayed recovery,
(Varying Degree of   (Truck transfer)        days
Importance)

Source: Horison


Table 4

Business Category          Percent With Adequate
                              Data Protection

Big Business                        22%
Small Business                      20%
Federal Government                  15%
State & Local Government             6%
All Other Categories                37%

Source: Information Technology Association of America