Sourcing Recovery and Continuity Services

The decision on whether to outsource recovery and continuity services is becoming more complex. Here we consider the factors influencing such a decision and the approaches enterprises are taking.

The business continuity manager has never had so many viable options for sourcing recovery and continuity services. At the same time, the process of recovery is becoming more complex. There are more options because of advances in software and hardware technologies that enable processes such as remote mirroring, shadowing and clustering. Any of these can be resourced internally or from an external service provider (ESP). The process is more complex because:

• More complex technologies are used as part of the recovery solution.
• There is greater complexity in, and dependence on the network .
• Recovery requires integrating more platforms with greater heterogeneity.
• Greater interdependencies between applications increase the number of applications that need recovery in the first few hours and days.
• There are more interenterprise dependencies.

The combination of greater choice and greater complexity is strongly influencing the decision to insource or outsource.

Factors Driving the Decision to Insource

• Traditional hot site recovery services have an innate economic advantage because the service provider syndicates the equipment between many clients, giving them room to make a margin and still save the client money. However, for the newer, advanced recovery solutions mentioned above, most of the equipment is not syndicated. There are many other reasons to consider outsourcing as the right thing to do but, for these kinds of services, cost is not usually one of them.
• The single most common complaint that enterprises have about using an ESP is scheduling and managing tests. As the environment increases in complexity, the task becomes even more problematic.
• The ESP's capacity limitations for mainframe services are rarely a reason to insource. Capacity is more of a challenge in the distributed environment, where clients with a large number of servers to be covered may be forced to use several of the ESP's recovery locations. While this can work technically, it adds complexity, time and, potentially, performance issues to recovery. The problem of multilocation recovery has persuaded some of the largest clients to insource all or part of their recovery capacity.
• Many enterprises take the view that the resource is just too critical to be left to someone else. Enterprises need to pay particular attention to the contractual rights they have to obtain immediate access to the recovery center, and the cost of having such rights. If immediate or appropriate access is not guaranteed, or the cost is too high, then insourcing may be the only option.
• Where the enterprise cannot benefit from economics of syndication — for example, where the equipment is rare or old — an internal solution may be forced.

Factors Driving the Decision to Outsource

• Many enterprises spent the 1990s consolidating data centers. While this has been driven by sound economics, those left with a single data center or a single data center in global regions have no option other than to use the resources of an ESP. Many enterprises have alternative data center resources on campus or within a short distance. It is extremely tempting to use this resource since it addresses the most common risks, but it usually does not address risks, such as natural disasters or industrial-relation problems, that may affect a region or workplace. It can be an appropriate choice as long as the executive management team is aware of the unmitigated risks or there is a third option.
• Enterprises increasingly make sourcing decisions as part of an enterprise-level sourcing strategy and not as a set of piecemeal decisions. The sourcing decision related to business continuity capability should be no exception to this. Enterprises are starting to make use of business process outsourcing, application service providers and hosting — all of these will directly affect the way the recovery will be done. A business continuity sourcing decision made in isolation risks being reversed within a couple of years at significant cost.
• Telecommunications costs form the substantial part of total costs where distance is significant or where the telecommunications network crosses national boundaries. Choosing a local ESP will reduce these costs substantially, and can make the case for outsourcing much stronger, particularly in Europe.
• Despite short-term economic problems, the skills shortage will continue to drive many outsourcing deals, and business continuity planning (BCP) services are no exception to this, particularly where advanced recovery services are used.
• Insourcing a business continuity solution requires discipline in the investment process to ensure that the necessary capital investments are maintained throughout the life of the solution. The temptation to underinvest when times get hard is usually overpowering. This undermines the recovery capability.

Are enterprises insourcing or outsourcing?

Most recovery strategies combine both — an enterprise cannot completely outsource BCP, as most of the resources for planning and testing have to come from inside the enterprise. However, a significant proportion of enterprises that still operate their own data centers and opt to use the advanced recovery strategies are choosing to do this internally. The reasons for this are usually reduced cost, easier testing, faster recovery and guaranteed access. There is not much evidence to support the assertion that an internal solution will be faster than a well-designed and well-tested solution delivered by an ESP, but cost is a key factor, along with speed of access to the recovery site.

The decision to insource or outsource business continuity services is more complex than ever and it is certainly not a "one size fits all" decision. IT management teams need to weigh all the above factors when making the decision for each kind of service and for each location. The result will usually be a combination of insourced and outsourced services balancing speed, risk, skills, strategy and cost.

This research is part of a broader article consisting of a number of contemporaneously produced pieces. See COM-13-6392 for an overview of the article and links to related pieces.

This research is part of a set of related research pieces. See AV-14-5338 for an overview.