Forrester Vendor Landscape DRaaS Q4 2016

FOR INFRASTRUCTURE & OPERATIONS PROFESSIONALS
Vendor Landscape: Disaster-Recovery-As-A-

Service Providers, Q4 2016
DRaaS Providers Promise To Keep You Up
by Naveen Chhabra
December 7, 2016
Why Read This Report Key Takeaways

Service outages cause inexcusable harm to I&O Pros Are Still Responsible For Business
customer experiences, putting infrastructure and Impact Analyses And Risk Assessments
operations (I&O) professionals under tremendous DRaaS providers will help make your technology
pressure to ensure that business technology infrastructure resilient, but I&O pros remain
services are available 24x7, regardless of risk. responsible for identifying risks that could affect
Disaster recovery (DR) readiness once required your business, determining how much impact
significant time and financial investment, leading these risks could have, and specifying how the
firms to underinvest in this high-priority area. firm will address them.
Disaster-recovery-as-a-service (DRaaS) promises
Business Service Recovery Times Will Be
a great alternative. This report highlights 21
Longer Than DRaaS Providers’ Commitments
DRaaS vendors and provides a framework to help
A common misconception among I&O pros is that
I&O pros choose the right service provider for
business services will be functional as soon as
their needs.
the systems are powered on. During any major
outage, you will have to validate data integrity,
application interdependency, network access,
and security to ensure that services are working
as desired — and this will create some delay.
Build A Long-Term Vision With Your DRaaS

Provider Partner
DRaaS is available on a pay-per-use basis. Resist
the temptation to swap providers to gain better
price points. Needs such as proximity to your
data center, the cost of transition, and the scale
of operations will demand your commitment and
encourage developing a long-term vision with
your DRaaS partner.
FORRESTER.COM
FOR INFRASTRUCTURE & OPERATIONS PROFESSIONALS
Vendor Landscape: Disaster-Recovery-As-A-Service Providers,

Q4 2016
by Naveen Chhabra
with Glenn O’Donnell, Arnav Gupta, Michael Caputo, and Bill Nagel
December 7, 2016
Table Of Contents Notes & Resources

2 DRaaS Is Essential To Your Resiliency Forrester interviewed 21 vendor companies,
Promise including Accelerite, Acronis, Axcient, Barracuda
Networks, Bluelock, C&W Business, CenturyLink,
I&O Leaders Can Rely On DRaaS Providers
Daisy, Hewlett Packard Enterprise, IBM, iland,
For Cost, Speed, Testing, And Flexibility
NTT Communications, Peak 10, Plan B Disaster
Understand The Three Options Offered By Recovery, Quorum, Recovery Point, Sungard
DRaaS Providers Availability Services, Telefónica Business
Solutions, TierPoint, Verizon, and VMware.
DRaaS Providers Are Split By Proprietary And
Industry Standard Replication Tools
5
Related Research Documents
Answer These Seven Questions To Narrow
Your Search Adopt A Plan-Do-Check-Act Cycle For Continuous
Infrastructure And Operations Improvement
Recommendations
Brief: New Data Resiliency Approaches Render
16 Aim For Airtight Resiliency More Than
Backup Obsolete
Restoration Or Recovery
Vendor Landscape: Data Resiliency Solutions,
What It Means Q3 2016
17 Enterprises Increasingly Depend On Service
Providers
18 Supplemental Material
Forrester Research, Inc., 60 Acorn Park Drive, Cambridge, MA 02140 USA

+1 617-613-6000 | Fax: +1 617-613-5000 | forrester.com
© 2016 Forrester Research, Inc. Opinions reflect judgment at the time and are subject to change. Forrester®,
Technographics®, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester
Research, Inc. All other trademarks are the property of their respective companies. Unauthorized copying or
distributing is a violation of copyright law. Citations@forrester.com or +1 866-367-7378
FOR INFRASTRUCTURE & OPERATIONS PROFESSIONALS December 7, 2016
Vendor Landscape: Disaster-Recovery-As-A-Service Providers, Q4 2016
DRaaS Is Essential To Your Resiliency Promise

In today’s digital business era, great customer experiences depend on technology more than ever.
Customers, employees, partners, and regulatory authorities expect business services to always be
available, no matter what. Recent airline service disruptions have cost the industry dearly — not just
in the form of lost business or penalties, but also in terms of damages to customer loyalty, reputation,
and employee morale.1 Every firm in every industry is vulnerable to plunges in company valuation
and customer trust should technology systems fail.2 Yesterday’s recovery practices just don’t work
in today’s social media world, where a firm’s image can be instantaneously maligned. Service
accessibility starts from the resiliency baked into an application from its inception.3 DRaaS promises to
help I&O pros build a resilient technology infrastructure so they can deliver “always-on” services where
downtimes are either imperceptible or last just a few seconds. Forrester defines DRaaS as:
A pay-per-use managed service that uses cloud-based infrastructure and continuous replication
technologies and orchestrates the transition of applications to recovery infrastructure in case of
an outage to deliver a resilient business service.
Currently, Forrester sees a few factors influencing the use of DRaaS:
› Businesses increasingly rely upon technology services. Using terms such as “mission-critical,”
“platinum-class,” or “Tier-1” application, firms are increasingly classifying technology services as
mission-critical or business-critical.4 Different service tiers require different availability levels. Some,
like stock market applications during trading hours, can’t sustain even subsecond downtimes or any
loss of transactions. Others, like ERP or CRM applications, can sustain few seconds of downtime;
still others, such as an airline’s frequent-flyer application, can go down for several minutes without
aggrieving customers.5 But in general, tolerance for service downtime is very low as more business
processes depend on technology and each process spans multiple business applications.
› Technology enables vendors to commit shorter recovery times. DRaaS is different from
traditional backup and recovery practices. Characteristics that differentiate DRaaS from traditional
recovery offerings include automated, continuous replication of data and systems, scalable
infrastructure, orchestrated recovery, and pay-as-you-go pricing; DRaaS offerings also have
self-service interfaces for restore requests, reporting, and taking relevant actions. Providers run
customers’ production environments out of their cloud environment during planned downtime —
such as for testing or patching — or unplanned downtime.
I&O Leaders Can Rely On DRaaS Providers For Cost, Speed, Testing, And Flexibility
DRaaS turns the conventional disaster recovery model on its head to bring significant benefits to
organizations of all sizes. DRaaS is a natural choice for applications that can sustain a few seconds
or minutes of downtime or loss of transactions. DRaaS providers promise aggressive recovery
timelines — as long as the applications run on virtual infrastructure and have been configured to
easily run from a DRaaS provider environment in event of an outage. To successfully fulfill the tall
order of managing resiliency needs, DRaaS providers offer:
© 2016 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law. 2
Citations@forrester.com or +1 866-367-7378
› Better functionality at a lower cost. DRaaS providers can keep costs down because most clients
are only consuming storage resources at any given time; they boot virtual machines (VMs) only in
the event of a test or an actual disaster or keep just a few VMs in hot standby mode for mission-
critical applications. While most DRaaS providers price their services by actual storage and VM
usage, some charge a minimum amount in the form of a setup or onboarding fee.
› Easier, more frequent, and less expensive testing. Organizations continue to struggle with DR
testing.6 With DRaaS, testing is generally automated and nondisruptive, meaning that you can
test more often. And unlike traditional DR providers, some DRaaS providers don’t charge a fee for
additional self-service tests. The provider can bundle DRaaS contracts with testing services and
failover assistance if you require additional help.
› Flexible short-term contracts with faster time-to-market. One consistent complaint about
traditional outsourced DR models is that they are contractually too restrictive — lengthy, complex,
and inflexible.7 If you need to make midterm changes, the contract terms will likely impose
additional and potentially excessive fees. Given the pace of business and technology innovation,
you will undoubtedly need to make such adjustments. By contrast, DRaaS providers usually have
extremely flexible contract models; almost all have customers sign a yearlong contract but charge
for usage by the month. This allows I&O pros to adapt according to their organization’s changing
tech environment and business needs.
› Skill augmentation. One of the reasons I&O pros lag in building DR capabilities is a lack of
required skills. DRaaS providers offer consulting services to help you develop the technology
resiliency plans that need to be derived from your firms’ business continuity plans. DRaaS quite
often comes bundled with 24x7 white-glove support.
Understand The Three Options Offered By DRaaS Providers
In order to offer capabilities that serve a broad range of recovery requirements and assemble a bouquet
of services at different price points, most DRaaS providers offer three types of service instance:
› Dedicated. A dedicated instance is a hot VM to which application and data changes are written
almost instantaneously without any perceptible delay or transaction loss. This VM runs in instant
recovery mode to take over the application workload the moment any outage hits the primary
application instance or VMs. Dedicated instances are quick and reliable, but the most expensive
of the three options; they are favored by enterprises with recovery time objectives (RTOs) and
recovery point objectives (RPOs) measured in seconds. Dedicated instances require continuous
replication via a replication solution like Zerto.
› Reserved. A reserved instance, which is a step below a dedicated instance in terms of cost and
capabilities, is a warm standby instance to which changes are written and will need to be powered
on in the event of an outage. Reserved instances are a good fit for applications that have RTOs
of a few minutes to a few hours or which may need to be hosted on a physical server. This option
reduces operational costs a bit compared with a dedicated instance — but not much. It requires
replication via solutions like Double-Take for physical machines and Zerto for virtual infrastructure.
› On-demand. These instances cover lower-priority applications at a lower cost. On-demand

services are likely the right choice for a collection of noncritical applications that don’t warrant
immediate recovery but which are critical to ongoing business operations. While lower priority,
these need to be incorporated into the recovery strategy. An on-demand instance is equivalent
to a cold backup site where data is replicated in scheduled increments of minutes or hours. This
is a low-cost option for applications that do not require rigorous availability guarantees; not all
providers offer it. Replication solutions like Veeam serve requirements for such applications well.
DRaaS Providers Are Split By Proprietary And Industry Standard Replication Tools
Replication is the technology heart that pumps the blood of application and data changes from the
primary instance to the recovery instance. DRaaS providers choose different replication options
depending on the use case and the category of customers they plan to serve. Some use proprietary
technology; others use industry standard solutions. Common solutions include:
› Backup- and/or appliance-based replication. Acronis, Barracuda Networks, CenturyLink, and

Quorum offer DRaaS using proprietary technologies. These have their own merits, such as quick
and easy startup — and if you use a backup solution from these providers, it’s easy to extend to
DRaaS services. A potential downside is getting locked into a proprietary technology.
› Standard software-based replication. DRaaS providers like Bluelock, iland, NTT Communications,
Peak 10, and Plan B Disaster Recovery use industry standard replication tools from the likes of
Veeam, VMware, and Zerto. You are then free to either switch DRaaS vendors while retaining the
technology or expand to a second provider that uses the same replication technology. The
competition inherent in the latter option can benefit you, the customer. This solution type allows you
to also swap the replication technology itself while keeping the same provider.
› Storage replication. The increasing levels of virtualization across firms will soon consign the
chronic pain of costly storage replication to the dustbin of history. If your firm has applications that
depend on storage-based replication and you are scouting for a DRaaS partner to improve your
resiliency, your applications can easily find a second home. In addition to their standard software-
based replication offerings, traditional DR providers turned DRaaS providers like Hewlett Packard
Enterprise, IBM, Recovery Point Systems, and Sungard also support storage replication.
› Physical server migration. While they commit support to physical infrastructure, a few providers
do so by migrating a physical server to a virtual server instance on the DRaaS provider side. While
this may not be a technical concern, it can affect your organization from a compliance standpoint.
For example, if you have a license to use an Oracle database on a physical server, you may go out
of compliance if you use the same license on a virtual server.
Answer These Seven Questions To Narrow Your Search

Working with the right partner can completely protect your business critical applications and data and
guarantee that they are rapidly available in the event of a partial or full disaster — and at a significantly
reduced cost compared with doing it yourself. What’s more, advanced new features such as partial
granular restore and automated reporting bring new levels of agility, efficiency, visibility, and flexibility
that can transform your investment into a valuable business asset. Firms will be looking for a vendor
that can help them automate the planning, management, and execution of their resilience solution. I&O
pros can use the following seven questions to help narrow the search:
› Do the recovery objectives fit my needs and cost tolerance? Depending on your application tier
and classification, you will have to identify providers that can support your recovery objectives at the
appropriate price points. DRaaS providers claim to support very aggressive RTOs and RPOs, down
to a few seconds, especially for the virtual infrastructure (see Figure 1). But beware: Recovery
windows are often longer than advertised. DRaaS can appear quite attractive because vendors
advertise that their technology and services can help you achieve your RTO within a few seconds —
but note that you need to perform certain validation tasks before the recovered instances are ready
for production use (see Figure 2).
› Does the provider support a heterogeneous environment with a single solution? It’s highly
likely that you are operating a heterogeneous technology environment, and it’s not advisable to
engage a DRaaS provider for each technology stack. You will therefore need to narrow your
choice to providers that can support most of your technology infrastructure, including hardware,
operating systems, virtualization, storage, and business applications. If you are not using any
virtualization replication technologies, you will need to procure the replication technology based
on the service-level agreements (SLAs) you commit to the business and what your DRaaS
provider supports (see Figure 3).
› Can the provider manage my application complexity? You have a slew of business apps, including
those for ERP, financials, supply chain, logistics, and sales management. Does the DRaaS provider
have the experience to support your business applications — or would you be helping the provider
experience these for the first time? It’s not about spinning up VMs in the event of a disaster — it’s
about implementing the resilience plan. You need to account for the risk factors for each application
and fully understand the application and environmental interdependencies (see Figure 4).
› How will the provider manage my application interdependencies? Business processes, often
perceived as simple, actually span multiple applications. For example, a business process to manage
returned goods has to involve a variety of other applications — such as billing, credit management,
inventory management, warehouse management, and product engineering — at various stages.
In outage situations, entire applications or parts thereof may need to move to the DRaaS platform.
Availability of all applications is critical before you can release it for business use. Given these
interdependencies, you can no longer rely on a manual approach but will have to map these to
automated recovery runbooks. The problem of data protection and movement has been solved; the
evolution will come in the form of the orchestrated recovery of complex application environments.
› Do the provider’s DRaaS data centers fit my geographic needs? In which parts of the world
do you operate, and where are your data centers? While you want a provider that can support the
shortest recovery times, recovery time is a function of the distance between your primary data
center and the DRaaS provider site — it’s subject to the laws of physics. If the DRaaS provider is
nearby, that will make engagement easy — but the provider should not be so close that its data
center is in the same seismic zone as yours or is susceptible to similar geographic or political
disturbances (see Figure 5).
› How can the provider improve my recoverability and readiness index? While it’s no secret that
testing more often will improve your readiness to handle outages, only a small percentage of firms
test often.8 How often would you need to test to boost confidence? Do you need help performing
these tests? Does the provider offer 24x7 white-glove support? Does it offer a single pane of
glass for transparency and planning? Some DRaaS providers add testing exercises to their prices,
making it easy to perform tests at no additional cost. You should aim to test your DR at least once
per quarter.
› With which industry certifications must my provider comply? If you are a financial services firm
scouting for a DRaaS provider that can host a recovery environment for your sensitive applications,
you will prefer a PCI-certified DRaaS provider. Similarly, a healthcare firm will seek a HIPAA-certified
provider. Knowing which providers have certifications relevant to your industry makes it easier for
you to do business with them (see Figure 6).
FIGURE 1 DRaaS Provider Commitments, Contracts, And Pricing
Solution/ Recovery Service pricing

Provider offering objectives Minimum fee Minimum term model
Accelerite rCloud RPO: 5 minutes Varies by 12 months Number of aggregate
RTO: 15 minutes provider needs pooled terabyte
(TB) blocks;
allocated TB blocks
per VM
Acronis Disaster RPO: 60 minutes $1,850 12 months Number of VMs; TB

recovery RTO: 15 minutes onboarding fee of storage
service
Axcient Fusion RPO: 1 minute Not disclosed 12 months Number of VMs; TB

RTO: 60 minutes of storage
Barracuda Barracuda No SLA Not disclosed 12 months Unlimited or

Networks Backup metered plan (200
GB increment)
Bluelock Recovery RPO: A few $1,000 per Pay as you go; Number of VMs;
Suite seconds month (covers 12 months storage; data
RTO: A few up to five VMs) transfer; reserved
minutes recovery capacity
CenturyLink Safehaven RPO: 30 seconds $1,850 Not disclosed Number of VMs;

RTO: A few onboarding fee storage,
minutes (covers up to networking, and
six VMs) cloud computing
resources during test
failover
C&W Business DRaaS RPO: Close to $450 12 months Number of VMs;

Seamless real time computing resources,
Continuity RTO: 5 minutes GB of storage
Daisy DRaaS RPO: 0 seconds Not disclosed 12 months Annual standby

RTO: A few premium, number of
minutes to 24 VMs; GB of storage
hours
HPE Continuity- RPO: 15 minutes Not disclosed 12 months Number of virtual

Enterprise services- RTO: 4 to 6 hours cores; GB of storage
Services as-a-service
FIGURE 1 DRaaS Provider Commitments, Contracts, And Pricing (Cont.)
Solution/ Recovery Service pricing

Provider offering objectives Minimum fee Minimum term model
IBM Disaster- RPO: 15 minutes Variable 4 months Number of VMs;

recovery- RTO: 4 to 6 GB of storage
as-a-service hours
iland Disaster- RPO: 1 minute Not disclosed Not disclosed Number of VMs;
recovery- RTO: 1 minute GB of storage
as-a-service
NTT Com- Cloud RPO: Near zero Not disclosed 12 months Number of VMs;
munications Recovery RTO: 15 minutes number of servers
(can be physical
or virtual)
Peak 10 Recovery RPO: Real time $50 per VM for 12 months Number of VMs;
Cloud RTO: 2, 4, or 8 setup GB of storage
hours
Plan B Certified RPO: 6 seconds £200 per 12 months Number of VMs;

Disaster to 24 hours month GB of storage
Recovery RTO: A few
minutes
Quorum onQ DRaaS RPO: 15 minutes Not disclosed 12 months Number of VMs;
RTO: 5 minutes GB of storage
Recovery Point Integrated RPO: Near Minimum 36 months Number of VMs;

Business real-time spending of GB of storage
Continuity RTO: A few $1,500 per
Solutions minutes month
Sungard Recovery RPO: 15 minutes Not disclosed Per month Number of VMs;
and to 24 hours GB of storage
Business RTO: 2 to 24
Continuity hours
Services
Telefónica Disaster- RPO: A few Not disclosed Pay as you go Number of VMs
recovery-as- seconds
a-service RTO: Less than
1 hour
TierPoint Disaster- RPO: Close to Not disclosed 12 months Not disclosed

recovery-as- real time
a-service RTO: 5 minutes
FIGURE 1 DRaaS Provider Commitments, Contracts, And Pricing (Cont.)
Solution/ Service pricing

Provider offering Recovery time Minimum fee Minimum term model
Verizon Cloud RPO: 1 to 6 Not disclosed 12 months Number of VMs;

Disaster hours GB of storage
Recovery RTO: Contract-
dependent
VMware vCloud Air RPO: 15 minutes $795 for one 1 month Not disclosed
Disaster to 24 hours month, 1 TB
Recovery RTO: Immediate storage, 20
if resources are GB RAM at 10
committed GHz, two
public IP
addresses
FIGURE 2 Production Readiness Will Take Longer Than The Technical Recovery Time Objective
►Recovery time objective: ►Maximum tolerable period of disruption:

The stated objective for the amount of The longest disruption the business can sustain
time it will take to recover a system or before there is significant revenue loss, brand
service. damage, and other negative effects.
VM and data
recovery finished;
testing and Application Security
validation begins interdependencies validations
Outage
occurs MTPD
RTO
Business Recovery effort Data checks Network check Validations complete;

applications start and validation to other sites applications ready
operating and connectivity for business use
from the for users
data center
Time Note: the distance between events is not an indicator of the time to complete that activity.
FIGURE 3 Technologies Supported By DRaaS Providers
n
or
io
is
at
e
rv
Replication Supported
ag
ic
e
t
pl
yp
os
or
Provider tech vendors platforms
Ap
St
H
H
Accelerite Dell AppAssure vSphere, physical servers
Acronis Acronis, FalconStor, Hyper-V, KVM, Oracle VM,

NetApp RHEV, vSphere, Xen
Axcient VMware Hyper-V, vSphere,

XenServer, physical servers
(Windows, Linux)
Barracuda Microsoft, VMware Hyper-V, vSphere

Networks
Bluelock Acronis, CommVault, Hyper-V, IBM, OVM,

Veeam, Vision vSphere, physical servers
Solutions, Zerto (Windows, Linux)
CenturyLink VMware CenturyLink Cloud,

Hyper-V, KVM, vCloud
Director, vSphere, Xen,
XenServer
C&W Business Dbvisit, Geminare, Hyper-V, KVM, OVM,

Infrascale, QSL-Quick PowerVM, vSphere,
EDD, Vision Solutions XenServer
Daisy Asigra, Veeam, Zerto Hyper-V, vSphere
HPE InMage (now Hyper-V, KVM, vSphere,

Enterprise Microsoft), Veritas physical servers (AIX,
Services HP-UX, Linux, OS/400,
Solaris, Windows, zOS)
IBM Actifio, VMware, Zerto Hyper-V, PowerVM,

vSphere, physical servers
(IBM AIX, HP-UX, Solaris,
OS/400 on IBM iSeries)
iland Veeam, Vision Hyper-V, vSphere, physical

Solutions, Zerto servers
FIGURE 3 Technologies Supported By DRaaS Providers (Cont.)
n
or
io
is
at
e
rv
Replication Supported
ag
ic
e
t
pl
or
os
yp
Provider tech vendors platforms
Ap
St
H
H
NTT Comm- ArcServe, EMC, Hyper-V, OpenStack,
unications Geminare, Microsoft, vSphere
Sanovi, Veeam,
VMware
Peak 10 Vision Solutions, Hyper-V, VMware

VMware, Zerto
Plan B Zerto Hyper-V, vSphere,

XenServer, physical servers
(Windows, Linux, Solaris)
Quorum Quorum Hyper-V, vSphere,

XenServer running any
Windows OS and any Red
Hat or CentOS distribution
Recovery Point Capital Continuity Hyper-V, vSphere, logical

(AIX), Luminex (IBM partitions (AIX, iSeries,
mainframe), NetApp, z/OS), mainframe z/VM
Veeam, Vision (z/Linux), Catalogic
Solutions, VMware, DPX/ECX (Xen, KVM, Oracle
Zerto VM); recovered to VMware
Sungard AS Actifio, EMC Recover Hyper-V, vSphere, Linux,

Point, Maxava, Oracle VM, midrange
Microsoft, NetApp, (Tandem, DEC), mainframe
SnapMirror, Vision (IBMz), IBM-i Series (AIX,
Solutions, VMware HP-UX, Solaris)
Telefónica Vision Solutions, Zerto Hyper-V, vSphere
TierPoint Geminare, Microsoft, Hyper-V, vSphere

Veeam, Vision
Solutions, VMware,
Zerto
Verizon Actifio, NetApp, Hyper-V, NetApp, vSphere,

VMware, Zerto physical servers
VMware VMware, Rackware vSphere, physical servers
FIGURE 4 DRaaS Is Ready To Host Enterprise Business Applications
Largest protected
environment Consulting
Provider (VMs, storage) Protected business applications services?
Accelerite 1,462 VMs; 18 TB Not disclosed
Acronis 272 VMs; 70 TB SQL, Oracle, Exchange (including DAG), SharePoint
Axcient 1,500 VMs; 1 PB SQL, Oracle, Exchange, SharePoint
Barracuda 100 VMs; 60 TB Not disclosed

Networks
Bluelock 549 VMs; 240 TB Pervasive database for an airline to keep a no-fly list
constantly available
CenturyLink 105+ VMs; 40+ TB Not disclosed
C&W Business 70 VMs; 50 TB Cognos, IBM DB2, Informix, OnBase (document

management), SAP, WebLogic
Daisy 200+ VMs; 100+ TB SAP
HPE Enterprise 525 VMs; 60 TB Multitier ERP application spread across cloud,
Services mainframe, and physical servers
IBM Not disclosed Not disclosed
iland 300 VMs Large ERP applications like SAP and Oracle
NTT 120+ physical and Electronic publication suite, eShop application

Communications virtual servers; ~40
TB
Peak 10 850 VMs; 120 TB I/O-intensive database application
Plan B 200 VMs; 50 TB Financial trading applications, SQL clusters
Quorum 100 VMs; 30 TB Oracle Enterprise for local HA and DRaaS protection
Recovery Point 500+ VMs SQL, Oracle, Exchange, SharePoint
Sungard 1,000+ VMs; a few SAP Hana service combining storage, hypervisor,
PB and host-based replication
FIGURE 4 DRaaS Is Ready To Host Enterprise Business Applications (Cont.)
Largest protected
environment Consulting
Provider (VMs, storage) Protected business applications services?
Telefónica 2,000+ VMs; 1+ PB CRM, eCommerce, databases, file and content

servers
TierPoint 140 VMs; 16 TB Not disclosed
Verizon 2,000 VMs; 5 PB SAP
VMware 736 VMs; 100 TB ERP, multimedia applications
FIGURE 5 DRaaS Providers’ Assets And Locations
Own Hosted
Provider data center colocation Americas EMEA Asia Pacific
Accelerite
Acronis
Axcient
Barracuda Networks
Bluelock
CenturyLink
C&W Business
Daisy Group
HPE Enterprise
Services
IBM
iland
NTT
Communications
Peak 10
Plan B Disaster
Recovery
Quorum
Recovery Point
Sungard
Telefónica Business
Solutions
TierPoint
Verizon
VMware
FIGURE 6 DRaaS Providers Have A Long Way To Go To Achieve Industry Certifications
SSAE ISO PCI Fed Privacy

Provider 16 27001 DSS HIPAA RAMP FIPS Shield GLBA
Accelerite
Acronis
Axcient
Barracuda
Networks
Bluelock
CenturyLink
C&W Business
Daisy
HPE
Enterprise
Services
IBM
iland
NTT
Communications
Peak 10
Plan B
Quorum
Recovery
Point
Sungard
FIGURE 6 DRaaS Providers Have A Long Way To Go To Achieve Industry Certifications (Cont.)
SSAE ISO PCI Fed Privacy

Provider 16 27001 DSS HIPAA RAMP FIPS Shield GLBA
Telefónica
TierPoint
Verizon
VMware
Recommendations
Aim For Airtight Resiliency More Than Restoration Or Recovery

Disaster-recovery-as-a-service is not a panacea for your resiliency goals. Engaging with a DRaaS
provider is likely the execution phase in increasing your resilience index. Ultimately, resiliency has to
be baked in during application development — but you can’t left-shift so far in a jiffy; you still need to
perform a lot of activities to make your DRaaS investments bear fruit. Forrester recommends that
I&O pros:
› Partner with business stakeholders to define the criticality of application tiers. I&O pros have
historically had the assumed self-responsibility of developing recovery capabilities — and more
often than not, they started with technology. But now, before you go shopping for DRaaS, make it
a point to intimately involve the business decision-makers in identifying critical application tiers.9 A
joint workshop with business stakeholders can help categorize applications by criticality; not every
service is equally critical or needs five 9s of availability or instantaneous recovery.
› Engage with application owners to develop recovery procedures. When developing your strategy,
application owners have an important place in the RACI (responsible, accountable, consulted, and
informed) chart. Keep in mind that replicating the data and having the right application infrastructure
is not enough for recovery. Your DRaaS provider will restore life to the VMs and applications, but
you remain responsible for application and data consistency and sanity checks while conforming to
the committed business SLAs. DRaaS providers will simply disown this part — and in any case, the
application owners in your firm know these issues best. Partnering with them becomes more crucial
than ever.
› Make security considerations a prime factor in buying DRaaS. Your business will invest mainly
in ensuring that business-critical applications can spring back into action quickly. While speed to
recovery is paramount, you must always be vigilant in protecting the security of all applications
and their critical data. Your security posture is equally important and relevant when services run
from the recovery location. Involve your security and risk pros at the recovery design stage; they
will help define the security requirements for business-critical applications. Pursue Forrester’s Zero
Trust security model to protect your applications and data regardless of whether they reside and
execute in your facilities or your provider’s.10
› Thoroughly evaluate DRaaS providers’ own resilience. While you will invest time, money, and
effort in zeroing in on the right DRaaS partner, it’s imperative that you check the resilience partners
have baked in into their own infrastructure, data center, power, and network. The question is: Will
you rely on a provider that does not have resilient infrastructure but ironically promises to increase
your resilience index? You can call it “backup of backup.”
What It Means
Enterprises Increasingly Depend On Service Providers

Outsourcing may not be new to you, but you have probably just started engaging in the DRaaS space.
Engaging and managing provider operations are relatively easy if you have fewer services coming from
them. But you will soon be engaging with a matrix of various service providers — so keep in mind that
your DRaaS provider also needs to engage with your other providers, including application services,
software-as-a-service, and infrastructure-as-a-service. You will soon have to develop a clearer RACI
to map the roles of your providers and your own people. You will have to make changes to existing
service contracts if they affect how you source DRaaS.
Engage With An Analyst

Gain greater confidence in your decisions by working with Forrester thought leaders to apply
our research to your specific business and technology initiatives.
Analyst Inquiry Analyst Advisory Webinar
To help you put research Translate research into Join our online sessions
into practice, connect action by working with on the latest research
with an analyst to discuss an analyst on a specific affecting your business.
your questions in a engagement in the form Each call includes analyst
30-minute phone session of custom strategy Q&A and slides and is
— or opt for a response sessions, workshops, available on-demand.
via email. or speeches.
Learn more.
Learn more. Learn more.
Forrester’s research apps for iPhone® and iPad®

Stay ahead of your competition no matter where you are.
Supplemental Material
Companies Interviewed For This Report
We would like to thank the individuals from the following companies who generously gave their time
during the research for this report.
Accelerite CenturyLink
Acronis Daisy
Axcient Hewlett Packard Enterprise
Barracuda Networks IBM
Bluelock iland
C&W Business NTT Communications
Peak 10 Telefónica Business Solutions
Plan B Disaster Recovery TierPoint
Quorum Verizon
Recovery Point VMware
Sungard Availability Services
Endnotes
1
Downtime cost Delta Airlines dearly. Delta estimated that a 5-hour outage caused it to incur a loss in excess of $150
million. Source: Chris Isidore, “Delta: 5-hour computer outage cost us $150 million,” CNN Money, September 7, 2016
(http://money.cnn.com/2016/09/07/technology/delta-computer-outage-cost/).
2
The following lists are of outages that occurred over the past few quarters and which had significant business impact.
Source: Ofir Ehrlich, “The Top 9 Outages That Made Headlines in Q2 2016,” CloudEndure blog, July 11, 2016 (https://
www.cloudendure.com/blog/top-9-outages-made-headlines-q2-2016/).
Source: Ofir Ehrlich, “The Top 9 Outages That Made Headlines in Q1 2016,” CloudEndure blog, April 4, 2016 (https://
Source: Ofir Ehrlich, “The Top 9 Outages That Made Headlines in Q4 2015,” CloudEndure blog, December 29, 2015
(https://www.cloudendure.com/blog/top-9-outages-made-headlines-q4-2015/).
Source: Ofir Ehrlich, “The Top 9 Outages That Made Headlines in Q3 2015,” CloudEndure blog, October 1, 2015
(https://www.cloudendure.com/blog/top-9-outages-made-headlines-q3-2015/).
Source: Ofir Ehrlich, “The Top 9 Outages That Made Headlines in Q2 2015,” CloudEndure blog, July 14, 2015 (https://
Source: Ofir Ehrlich, “The Top 9 Outages That Made Headlines in Q1 2015,” CloudEndure blog, April 1, 2015 (https://
www.cloudendure.com/blog/top-9-outages-q1-2015/).
3
I&O pros are going through an evolution with a paradigm shift from DR to business technology resiliency. See the
Forrester report “Move Beyond Disaster Recovery And Prepare For Business Technology Resiliency.”
4
According to Forrester/Disaster Recovery Journal Crisis Communication, Risk Management, And Business Continuity
Survey, Q4 2013, the percentage of applications classified as mission-critical and business-critical is increasing, with
72% of enterprise applications considered either business-critical or mission-critical. See the Forrester report “The
State Of Business Technology Resiliency, Q2 2014.”
5
In order to develop and justify a business case for resiliency technology investment, you need to classify applications
into recovery tiers and develop a continuity service catalog that will encompass all of your business applications. See
the Forrester report “Justifying The Business Case For Business Technology Resiliency.”
6
The chance that you could successfully recover IT operations without having exercised your DR plans on a regular
basis is slim at best. The chance that you could successfully recover and meet your recovery objectives is zero. Yet
Forrester finds that exercising DR plans is one area in which many organizations continue to fall short. As you look at
improving your preparedness, one area you cannot ignore is your exercise regimen. See the Forrester report “Disaster
Recovery Exercises Fall Short Of The Finish Line.”
7
The majority of firms are using outsourced services for their DR requirements and are in multiyear contracts with
them. We recommend that you review the list of providers. See the Forrester report “The Forrester Wave™: Traditional
Disaster Recovery Service Providers, Q1 2014.”
8
Everyone knows you must exercise your business continuity (BC) plans. However, in dozens of inquiries and
consulting engagements with enterprise clients each quarter, Forrester finds that BC managers are lucky if they can
exercise a portion of a particular BC plan once per year. In fact, we find that BC exercise programs as a whole are
quite immature. Common pitfalls are designing unrealistic exercise scenarios, failing to run exercises often enough,
and neglecting to integrate with other teams, such as crisis management and IT. Most enterprises, even with today’s
level of investment in advanced technology and services, are still unprepared for disasters. For recommendations from
peers and industry experts on how to successfully execute your business continuity initiatives, see the Forrester report
“Stop The Insanity: If You Don’t Exercise Your Business Continuity Plans, You Aren’t Prepared.”
9
I&O pros used to lead with technology, but would have rarely engaged with business stakeholders to develop a shared
understanding of the required resilience levels. See the Forrester report “Justifying The Business Case For Business
Technology Resiliency.”
10
The following describes how the Zero Trust security model offers superior protection of your applications and data.
See the Forrester report “No More Chewy Centers: The Zero Trust Model Of Information Security.”
We work with business and technology leaders to develop
customer-obsessed strategies that drive growth.
PRODUCTS AND SERVICES
› Core research and tools
› Data and analytics
› Peer collaboration
› Analyst engagement
› Consulting
› Events
Forrester’s research and insights are tailored to your role and

critical business initiatives.
ROLES WE SERVE
Marketing & Strategy Technology Management Technology Industry
Professionals Professionals Professionals
CMO CIO Analyst Relations
B2B Marketing Application Development
B2C Marketing & Delivery
Customer Experience Enterprise Architecture
Customer Insights › Infrastructure & Operations
eBusiness & Channel Security & Risk
Strategy Sourcing & Vendor
Management
CLIENT SUPPORT
For information on hard-copy or electronic reprints, please contact Client Support at
+1 866-367-7378, +1 617-613-5730, or clientsupport@forrester.com. We offer quantity
discounts and special pricing for academic and nonprofit institutions.
Forrester Research (Nasdaq: FORR) is one of the most influential research and advisory firms in the world. We work with
business and technology leaders to develop customer-obsessed strategies that drive growth. Through proprietary
research, data, custom consulting, exclusive executive peer groups, and events, the Forrester experience is about a
singular and powerful purpose: to challenge the thinking of our clients to help them lead change in their organizations.
For more information, visit forrester.com. 134669

Forrester Vendor Landscape DRaaS Q4 2016

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Forrester Vendor Landscape DRaaS Q4 2016

Încărcat de

Drepturi de autor:

Formate disponibile

FOR INFRASTRUCTURE & OPERATIONS PROFESSIONALS

Vendor Landscape: Disaster-Recovery-As-A-

Why Read This Report Key Takeaways

Build A Long-Term Vision With Your DRaaS

Vendor Landscape: Disaster-Recovery-As-A-Service Providers,

Table Of Contents Notes & Resources

Forrester Research, Inc., 60 Acorn Park Drive, Cambridge, MA 02140 USA

DRaaS Is Essential To Your Resiliency Promise

Currently, Forrester sees a few factors influencing the use of DRaaS:

Understand The Three Options Offered By DRaaS Providers

› On-demand. These instances cover lower-priority applications at a lower cost. On-demand

› Backup- and/or appliance-based replication. Acronis, Barracuda Networks, CenturyLink, and

Answer These Seven Questions To Narrow Your Search

FIGURE 1 DRaaS Provider Commitments, Contracts, And Pricing

Solution/ Recovery Service pricing

Acronis Disaster RPO: 60 minutes $1,850 12 months Number of VMs; TB

Axcient Fusion RPO: 1 minute Not disclosed 12 months Number of VMs; TB

Barracuda Barracuda No SLA Not disclosed 12 months Unlimited or

CenturyLink Safehaven RPO: 30 seconds $1,850 Not disclosed Number of VMs;

C&W Business DRaaS RPO: Close to $450 12 months Number of VMs;

Daisy DRaaS RPO: 0 seconds Not disclosed 12 months Annual standby

HPE Continuity- RPO: 15 minutes Not disclosed 12 months Number of virtual

FIGURE 1 DRaaS Provider Commitments, Contracts, And Pricing (Cont.)

Solution/ Recovery Service pricing

IBM Disaster- RPO: 15 minutes Variable 4 months Number of VMs;

Plan B Certified RPO: 6 seconds £200 per 12 months Number of VMs;

Recovery Point Integrated RPO: Near Minimum 36 months Number of VMs;

TierPoint Disaster- RPO: Close to Not disclosed 12 months Not disclosed

FIGURE 1 DRaaS Provider Commitments, Contracts, And Pricing (Cont.)

Solution/ Service pricing

Verizon Cloud RPO: 1 to 6 Not disclosed 12 months Number of VMs;

►Recovery time objective: ►Maximum tolerable period of disruption:

Business Recovery effort Data checks Network check Validations complete;

FIGURE 3 Technologies Supported By DRaaS Providers

Acronis Acronis, FalconStor, Hyper-V, KVM, Oracle VM,

Axcient VMware Hyper-V, vSphere,

Barracuda Microsoft, VMware Hyper-V, vSphere

Bluelock Acronis, CommVault, Hyper-V, IBM, OVM,

CenturyLink VMware CenturyLink Cloud,

C&W Business Dbvisit, Geminare, Hyper-V, KVM, OVM,

Daisy Asigra, Veeam, Zerto Hyper-V, vSphere

HPE InMage (now Hyper-V, KVM, vSphere,

IBM Actifio, VMware, Zerto Hyper-V, PowerVM,

iland Veeam, Vision Hyper-V, vSphere, physical

FIGURE 3 Technologies Supported By DRaaS Providers (Cont.)

Peak 10 Vision Solutions, Hyper-V, VMware

Plan B Zerto Hyper-V, vSphere,

Quorum Quorum Hyper-V, vSphere,

Recovery Point Capital Continuity Hyper-V, vSphere, logical

Sungard AS Actifio, EMC Recover Hyper-V, vSphere, Linux,

Telefónica Vision Solutions, Zerto Hyper-V, vSphere

TierPoint Geminare, Microsoft, Hyper-V, vSphere

Verizon Actifio, NetApp, Hyper-V, NetApp, vSphere,

VMware VMware, Rackware vSphere, physical servers

FIGURE 4 DRaaS Is Ready To Host Enterprise Business Applications

Accelerite 1,462 VMs; 18 TB Not disclosed

Acronis 272 VMs; 70 TB SQL, Oracle, Exchange (including DAG), SharePoint

Axcient 1,500 VMs; 1 PB SQL, Oracle, Exchange, SharePoint

Barracuda 100 VMs; 60 TB Not disclosed

CenturyLink 105+ VMs; 40+ TB Not disclosed

C&W Business 70 VMs; 50 TB Cognos, IBM DB2, Informix, OnBase (document

Daisy 200+ VMs; 100+ TB SAP

IBM Not disclosed Not disclosed

NTT 120+ physical and Electronic publication suite, eShop application