Data Protection Survey

1
Data Protection Survey
Report October 2004
2
Report Outline
3
Project Design Research Objectives Survey
Methods Respondent Profile
4
Research Objectives and Survey Methods

• Research Objectives
• Gain an understanding of how mid-size companies
  perceive data backup and protection.
• Explore trends and best data backup, storage and
  disaster recovery practices.
• Explore what challenges IT managers face in data
  backup and storage.
• Survey Methods
• An online survey of network tape administrators
  at small and mid-size companies was conducted in
  the continental United States. The respondents
  were screened to meet the following
  qualifications
• Directly responsible for network or data center
  tape storage and administration.
• Manage a team responsible for network or data
  center tape storage and administration.
• Holds a senior management position (CIO, VP,
  director, or manager).
• All companies represented in the survey have a
  network or data center tape backup and storage
  system and keep critical business information on
  their computer system.
• Survey respondents were selected from the
  Technology Advisory Board, a worldwide Internet
  panel of over 25,000 scientists, engineers,
  information systems professionals and information
  technology executives. This database allows
  targeting of respondents with the job
  responsibilities required by this specific
  project.
• Fleishman-Hillard Knowledge Solutions surveyed
  204 tape storage managers and IT directors.
  Interviews were completed online from September
  27 through October 12, 2004. Interviews were 13
  minutes in length.

5
Respondent Profile
The interviewed group was evenly distributed
between small and mid-size companies. The
majority of respondents are managers heading IT
teams of one to three people.
Company Size
Size of the IT Team
Position in the Company
500-1,000 employees
100-499 employees
CIO
Between 1-3 people
More than 8 people
Vice President
Manager
Director
Between 4-7 people
N204
6
Respondent Profile
Respondents are primarily engaged in activities
typical for mid- and senior level managers
heading IT teams.
Scope of Responsibilities
Make decisions on implementation of data backup
technologies
Responsible for making decisions regarding data
backup and storage needs
Involved in contract and price negotiations with
vendors providing data backup and storage
technology or services
Lead development and implementation of a disaster
recovery plan for your companys data center
Head a team responsible for network or data
storage at your company
Personally purchase data backup media
N204
7
Data Backup and Storage Practices for Laptop
Computers
8
Presence of Formal Procedures for Data Backup of
Laptop Computers
Two companies in five (40 percent) rely on an
extensive network of laptop computers used by
employees who work remotely. Less than half (49
percent) have formal procedures in place for
backing up mission-critical data hosted on
laptop computers.
Do you have formal procedures in place for
backing up mission-critical data hosted on
laptop computers?
Does your company rely on an extensive network
of laptop computers used by employees who work
remotely?
Dont know 1
Yes 40
No 60
Yes 49
No 50
N82
N204
Yes 98
Yes 86
Yes 78
9
Practices for Data Backup Hosted on Laptops

• While companies have numerous practices for data
  backup hosted on laptop computers, they most
  often leave it up to the end-user to make
  critical decisions when it comes to data backup.
• In the majority of companies in this group (57
  percent), each end-user is individually
  responsible for downloading laptop data onto the
  company server.
• Two companies in five (42 percent) let the
  end-user determine individually what data files
  are backed up.
• Only one company in five (21 percent) uses
  software for continuous backup of open
  application files in the laptop connected to the
  company network
• Only 21 percent provides end users
  with flash/thumb drives as data backup devices
  for their laptop computers.

N82
10
Practices for Data Backup Hosted on Laptops
Larger companies are more likely to use software
and high-level backup for their laptops, while
smaller companies tend to delegate
decision-making on data backup to end users and
rely on manual backup processes.
N82
11
Events Driving Changes to Testing and Evaluation
Procedures
12
Events Driving Reviews and Evaluation of Data
Backup Procedures
E-mail viruses have had the most profound effect
on data backup procedures. More than half of
companies (59 percent) reviewed and/or changed
their data backup procedures in response to this
threat.
Companies with 100-499 Employees
Which of the following events led your company
to review or change its data backup procedures?
Total
N103
Companies with 500-1,000 Employees
N204
N101
13
Confidence in Ability to Restore Lost Data

• Companies express the highest level of confidence
  (over 50 percent extremely confident) when it
  comes either to restoring most recently created
  files or to restoring data after a major power
  outage. They have the lowest level of confidence
  in restoring mission-critical files under three
  scenarios
• Files are more than a year old
• Backup server is completely destroyed
• There is a local or regional disaster if data
  center is unavailable.

N204
14
Data Backup and Storage Practices for Networks
15
Presence of Formal Data Backup and Storage
Strategy
The presence of a formal data backup and storage
strategy has become a norm. An overwhelming
majority of respondents (90 percent) indicate
that their organization has a formal backup and
storage strategy.
Does your organization have a formal data backup
and storage strategy?
No 10
Yes 90
N204
Yes 91
Yes 86
Yes 87
16
Testing of Data Backup and Storage Procedures and
Operations
Companies pay more attention to the human
component of data backup and storage. The
majority (56 percent) test data backup and
storage procedures and operations at least
quarterly. Larger companies are more likely than
smaller companies to test procedures and
operations on a monthly basis.
Companies with 100-499 Employees
How often does your organization test data
backup and storage procedures and operations?
Total
N103
Companies with 500-1,000 Employees
N204
N101
17
Disaster Recovery Practices
18
Presence of a Formal Disaster Recovery Plan
Seventy-one percent of companies do have a formal
disaster recovery plan in place.
Do you have a formal disaster recovery plan at
your company?
Dont know 3
No 27
Yes 71
Yes 71
Total (N204)
Yes 72
Yes 98
Yes 86
Yes 78
19
Testing of Disaster Recovery Plan
Testing disaster recovery plans after updates is
still not a universal practice, leaving companies
exposed to risk of unrecoverable loss of data.
Almost half (40 percent) dont test their DR plan
each time they update it.
Do you test your disaster recovery plan each
time you update it?
Do not update our DR plan 7
Yes 54
No 40
N144
Yes 68
Yes 47
Yes 86
20
Testing Disaster Recovery On-Site and Off-Site
Facilities
Regular testing of DR on-site and off-site
facilities, processes, and people has not become
a universal practice (see the following slides).
Thirty-one percent test their on site and off
site facilities only after a problem occurs or
never at all.
Companies with 100-499 Employees
How often does your organization test disaster
recovery on-site and off-site facilities?
Total
N103
Companies with 500-1,000 Employees
N204
N101
21
Testing Disaster Recovery Processes and People
Twenty-eight percent test their processes and
people only after a problem occurs or never
at all.
Companies with 100-499 Employees
How often does your organization test disaster
recovery processes and people?
Total
N103
Companies with 500-1,000 Employees
N204
N101
22
Amount of Time Required to Restore
Mission-Critical Applications By Company Size
How quickly can companies be up and running after
a disaster? Almost half (48 percent combined)
will have to spend at least 24 hours or more to
restore their mission-critical applications. It
appears that factors other than the volume of
data determines the time required to restore
mission critical applications. More than half of
smaller companies (53 percent) would require more
than 24 hours for data restore.
How quickly can your company restore the
mission-critical applications and data
necessary to run the business after a major loss
caused by a disaster?
100-499 employees
500-1,000 employees
Total
2 hours
2 hours
4 hours
4 hours
8 hours
8 hours
12 hours
12 hours
24 hours
24 hours
More than a day
More than a day
Dont know
Dont know
N103
N101
N204
23
Key Findings
24
Key Findings

• One in two companies have not implemented formal
  backup procedures for laptop networks
• Survey finds that two in five companies rely on
  an extensive network of laptops, but less than
  half of the respondents have formal procedures in
  place for backing up mission-critical data
  hosted on laptops.
• E-mail viruses are the number one driver for
  reviewing or changing data backup and storage
  procedures.
• More than half of companies reviewed and/or
  changed data backup procedures in response to
  e-mail viruses, compared with 17 percent of those
  that did so out of concern of a disgruntled
  employee destroying data.
• When it comes to testing the effectiveness of
  their disaster recovery plans, companies are
  being more proactive, but could be doing more.
• Forty percent of companies dont test their
  disaster recovery plan each time they update it
  and 28 percent test disaster recovery processes
  and people only after a problem occurs or
  never at all.