Escrow Averts Service Provider Disaster
As more organizations rely on cloud service providers, they must consider how to handle unexpected outages that could impact day-to-day operations or the long-term capacity to access data or systems from their service provider. What, for example, happens if a service provider is out of business for three days? What happens if the company permanently closes its doors?
Today, 88 percent of enterprises use public cloud and 63 percent have adopted private cloud, a January 2015 RightScale study found. This year, 82 percent plan a multi-cloud strategy, consisting of multiple hybrid, public, and private clouds, the report determined. This growing comfort and reliance on cloud means an expanding role for corporate IT, which oversees more than half of cloud purchasing decisions at 62 percent of those polled. While business units and IT differ on the ongoing role IT should play, 40 percent of business executives surveyed agreed IT should broker cloud services, up dramatically from 18 percent in 2014.
This surge could, in part, be a result of concerns over enterprises' ability to ensure business continuity from external partners. Just as corporate datacenters could be subject to the unforeseen, even the best-prepared service provider partner might encounter problems outside their areas of expertise; another partner's breach; an employee-created problem, or a natural or man-made disaster that disrupts the entire region.
In some cases, organizations are teaming up with several partners: Today, 73 percent work with two or more cloud providers, according to "Is Your Cloud Provider Keeping Secrets?," newly released research conducted by Forrester for iland. Often, risk management and governance professionals want to get involved, especially in heavily regulated industries such as finance and healthcare.
For its part, Acuity Management Solutions teamed up with Iron Mountain and NEC Corp. of America on an escrow and hosting solution designed to provide clients with business continuity and information protection in the case of disaster. Acuity's clients – which came to the provider for legal e-billing, matter management, and analytics services – needed more than a software escrow deposit, said President and CEO Kelley Johnston, in an interview. While they trusted Acuity's services, clients' regulatory burdens meant they required layers of business continuity -- and evidence that operations would not be disrupted if anything untoward occurred at their preferred cloud provider, she said.
"We needed an online all the time backup and continuity plan," said Johnston.
The service provider approached storage and information-management provider Iron Mountain to discuss leveraging its disaster recovery and business continuity expertise, Johnston said. But the two companies sought another element to reassure anxious, regulatory-laden clients in verticals like finance, she said.
Iron Mountain had teamed up with NEC about 18 months prior, said Mike Mitsch, business development director at NEC, in an interview. The companies developed an offering whereby NEC, which hosts Acuity's disaster recovery environment, created a sub-environment available to the service provider's clients. In the case of certain parameters, Acuity's customers can access this sub-environment for 90 days or longer, if necessary.
"Iron Mountain has been focusing on contingency solutions for customers, not just our customers but our customers' customers. In this part case, Acuity is a SaaS provider and they needed a continuity plan for a subscriber," Frank Bruno, director and senior business strategist at Iron Mountain Intellectual Property, told Enterprise Technology. "We have a service that we have productized but there has to be a technological fit. In this particular case, there was a not a good technological fit. [NEC] came up with a plan to create a DR environment that accommodated for a clone server specifically for Acuity's client. Now Acuity customers have the ability to access the Acuity application and their data, no matter what. And that's really the responsibility of all SaaS providers. I will say it is a corporate responsibility on the part of the subscriber to have a contingency plan they can execute independently of their SaaS provider."
Working closely with Acuity, NEC blueprinted their existing environment and recreated it virtually so clients were assured of business continuity in the case of disaster, Mitsch said. Iron Mountain acts as the escrow agent, holding the keys to turn over to NEC to operate the system only in the case of disaster, said Bruno.
"Having the ability to give a subscriber or client a contingency plan they could execute separately from the provider gives them two things: It keeps their users working and it keeps them working for a period of time until they move to a new solution, and then data recovery becomes a huge [issue]," he said.
Using this escrow approach retains an organization's security over intellectual property, data, and proprietary applications, executives agreed, while simultaneously providing an enterprise with a way to quickly resume normal operations if something happens to their service provider. Planning ahead benefits businesses – and CIOs, said Bruno.
"There are a host of contingency plans from good to bad to very bad today. When you think of the lifespan of a CIO, many times it has to do with a situation like that. Whether or not they're addressing the risk really determines whether or not they stay on as CIO," he said. "What you'll see now is a slow gravitation towards governance, risk, and compliance policy where risk managers are getting more involved in the deal and saying, 'Yes, but what if?' and that's why we expect to see rapid growth of cloud services in the enterprise market. It's a market they want to be in, but they want risk addressed first."
