How prepared are SMBs to recover from disaster?
The vast majority of SMBs both expect the unexpected and feel that they’re ready for disaster – though they may not be, Infrascale reveals.
Ninety-two percent of SMB executives said they believe their businesses are prepared to recover from a disaster. However, as previously reported, more than a fifth of SMB leaders said they don’t have a data backup or disaster recovery solution in place.
The research also indicates that 16% of SMB executives admitted they do not know their own Recovery Time Objectives (RTOs), although 24% expect to recover their data in less than 10 minutes after a disaster and 29% expect to do so in under one hour following a disaster. An RTO is the time between the start of recovery to the point at which all of an organization’s infrastructure and services are available.
Survey results also highlight that there’s no common understanding of disaster recovery and that expectations around disaster recovery solution results and recovery times differ by industry. There is also sector variation in why businesses that feel unprepared for disaster remain unprepared.
“The latest results from our survey are quite surprising, as they suggest that most SMBs think they are prepared to recover their data and be back up and running after a disaster. Yet more than one in five of those same respondents said they do not have a disaster recovery or backup solution in place,” said Russell P. Reeder, CEO of Infrascale.
“That data suggests that there are either varying definitions of what it means to be able to recover from a disaster or, quite simply, a lack of understanding of what it truly means to be able to recover from a disaster. Make no mistake, if a business does not have a disaster recovery solution in place, or at the very least a solution to back up its data, there is no way it can get the data back from a data loss event.”
The research is based on a survey of more than 500 C-level executives at SMBs. CEOs represented 87% of the group. Almost all of the remainder was split between CIOs and CTOs.
A gap between expectation and reality
While 84% of the total SMB survey group said they are aware of their organizations’ RTO, the rest revealed that they are not. More business-to-consumer (B2C) company leaders are in the dark about their organizations’ RTOs than business-to-business (B2B) C-level executives. 22% admitted they do not know their RTOs, while 10% of B2B leaders said they lack such knowledge.
Of those who were able to state their RTOs, 9% said they have an RTO of one minute or less. 30% said they have an RTO of under an hour. And 17% said they have an RTO of one day. But expectations are clearly not the reality in this scenario without redundancy, automation, and a substantial budget to pay for it.
The research also analyzed RTO from an industry vertical perspective. It found that 26% of telecommunications leaders said their RTO was 10 minutes. This was the No. 1 answer for this sector.
Meanwhile, the top answer of executives in the accounting/finance/banking and retail/e-commerce sectors said their RTO was under an hour, with this answer getting 36% and 29% of the votes, respectively. The No. 1 answer for healthcare, garnering a 35% share from this sector, was an RTO of one day.
“Having a low RTO can be achieved one of two ways: you either have redundant, highly automated infrastructure or an expensive disaster recovery solution. If you’re willing to trade just a little amount of time for cost, you can achieve a reasonable RTO with an affordable disaster recovery solution,” said Reeder.
“Every industry uses technology differently to achieve their business goals, which in turn will have a different requirement around the redundancy and availability of their systems. While it may be possible to have an RTO of less than one minute if you implement redundant systems, those costs usually outweigh the benefits.”
When business leaders were asked how long they expect it will take to recover their data after a disaster, 24% of the total group and a 33% of telecommunications executives said under 10 minutes. Thirty-eight percent of the accounting/finance/banking group and 31% of retail/e-commerce leaders said under one hour.
Disaster recovery has a range of definitions and industry vertical viewpoints
The one thing that everyone can agree on is that disaster recovery is needed in multiple scenarios. Fifty-eight percent of the total survey group said disaster recovery means recovering data after data loss and 55% said it involves recovery from a malware attack. 54% said disaster recovery provides the ability to become operational quickly after a disaster.
“The fact that 58% of the survey group said disaster recovery means getting data back after a loss, yet one in five say they don’t have a solution in place to do this, and most SMBs still believe they are prepared to recover for a disaster does not add up,” said Reeder.
“It highlights the need for SMBs to do detailed assessments on their true disaster recovery readiness or face the very real risk of being totally unprepared in the unfortunate but ever-present event of a disaster.”
The telecommunications sector survey group most commonly described disaster recovery as recovering data after data loss, with 59% of these respondents voicing this opinion. The healthcare (68%) and retail/e-commerce (66%) groups indicated that they see disaster recovery primarily as the ability to become operational quickly after a disaster.
Meanwhile, 56% of SMBs in the accounting/finance/banking sector defined disaster recovery as the ability to recover from a natural disaster like a hurricane or tornado.
74% of retail/e-commerce and 73% of healthcare industry executives said their top expectation of a disaster recovery solution is to minimize the time until their business is fully operational following a disaster.
Sixty-four percent of accounting/finance/banking sector leaders said zero data loss is their top expectation of a disaster recovery solution. Telecommunications leaders indicated their top expectation of a disaster recovery solution is to deliver cost savings related to on-call IT technicians, with 63% providing that answer.
“Every business is unique. But one thing all organizations and sectors have in common is the need to eliminate downtime and data loss,” said Reeder.
“Whether a business is dealing with a server crash or a site-wide disaster, unplanned downtime comes with serious consequences. Businesses can dramatically reduce downtime, quickly recover from ransomware attacks, and avoid paying ransoms by employing disaster recovery as a service.
“SMBs also can get ahead of an anticipated disaster such as a hurricane by failing over to their disaster recovery solution before the disaster is expected to hit, completely mitigating any downtime.”
Different industry sectors provide different reasons for their lack of preparedness
Most SMBs expressed the belief that they are prepared to recover from disaster, but 8% admitted they do not feel they are ready to bounce back from one. Of this latter group, 39% said they don’t have the budget to prepare to recover from a disaster.
Thirty-seven percent said they are unprepared because they have limited time to research solutions. 32% said they are not prepared because they lack the right resources. 27% said they don’t have the technology in place to recover from a disaster.
Healthcare (67%) and business-to-consumer entities (48%) both said the top reason their organizations are not prepared to recover from a disaster is that they have limited time to research solutions. 50% of the SMBs in the accounting/finance/banking group said their businesses are not prepared because their IT teams are stretched.
The top answers from the business-to-business survey group regarding lack of preparedness to recover from a disaster were that they don’t have the right resources or the budget. Both answers garnered 31% of the vote from business-to-business organizations.
“This survey data highlights how important it is for businesses to understand and address their disaster recovery risks before it’s too late,” said Reeder.
Most SMBs have faced micro-disasters in the past year
Yet for any differences among industry sectors, one thing all SMBs seem to have in common is suffering from malware infections, corrupted hard drives, and/or other micro-disasters. 51% of the survey group said they had faced such events within the past year.
B2B entities were more likely than B2C organizations to have been subjected to such scenarios. While 41% of B2C organizations have experienced a micro-disaster in the past year, 59% of B2B entities admitted they have had to face such a situation.
22% of the total survey group said they have experienced a micro-disaster more than once within the past year. 24% of B2B organizations said they have had such repeat experiences, while micro-disasters have hit 20% of B2Cs in the past year.