Is cloud data backup and recovery right for you?

1. Does a cloud-based service arrangement make sense operationally and financially?

Experience has shown that -- when properly configured and with strong security in place -- cloud-based products for data storage, backup and recovery, emergency system failover, and other requirements make good sense. Many organizations incorporate the cloud into operations relatively seamlessly, avoiding potential disruptions that can come with changing technologies.

When it comes to finances, analyze the TCO and ROI of different cloud backup and recovery platforms available to make sure that they fit into your organization's budget. The scalable nature of cloud and the variety of options on the market should enable organizations of all sizes to find a suitable cloud service.

2. What resources would we move to a cloud environment?

Deciding which data, systems, databases and other assets to relocate to a cloud offering should start with medium- to low-risk infrastructure and data elements. This approach gives you time to evaluate a provider's capabilities, technical support, security provisions, and emergency response and DR capabilities. Over time, consider moving other, more critical assets to the cloud platform, but not all at once.

3. What happens to our legacy data storage and management arrangements?

Existing legacy storage assets, such as on-premises storage, SANs, NAS, RAID and other technologies, might still be financially and operationally viable. The organization might have already paid them off, for example. If those resources are still performing well, ask yourself what risks and exposures might occur if your on-premises storage technology is discontinued.

4. Will this affect existing DR activities?

You might be able to offload most or all DR activities to your cloud vendor, especially if you have moved mission-critical systems and data to one or more cloud platforms. This could save you money by reducing the staff needed to maintain your DR plan on-site and avoiding the need for technology on-site to facilitate recovery activities. Any changes to a disaster recovery strategy might cause some disruption, so make sure to assess the associated risks of such a move.

5. What do we do with our policies and procedures for data storage and DR?

Administrative activities, such as policies and procedures associated with backup and DR, should still be in place, especially for auditors. However, you can likely adjust them to accommodate cloud-based arrangements. Review your organization's data backup strategy and disaster recovery plan to determine which policies and procedures will need updates.

6. Could we move our entire infrastructure onto one or more cloud platforms?

For some organizations, shifting specific processes or data might be the extent of the move to the cloud. If your organization wants to move all IT assets to the cloud, there are several factors to consider:

• Upcoming company activities, such as a merger or acquisition.
• Client requirements specifying that a minimum amount of technology must be on-premises.
• Regulatory mandates.
• Competitive and reputational issues associated with such a drastic change.
• Performance issues, such as whether restoration of technology is faster with a cloud backup and recovery product.

Your business requirements will most likely dictate a total -- or partial -- move of your IT assets to a cloud platform. Also, you might want to use at least two cloud vendors so that you won't have to depend exclusively on a single service provider.

Paul Kirvan, FBCI, CISA, is an independent consultant and technical writer with more than 35 years of experience in business continuity, disaster recovery, resilience, cybersecurity, GRC, telecom and technical writing.