Why Agencies Aren’t Efficiently Implementing Backup as a Service

Understanding Storage Tiers and Where to Back Them Up

While different BaaS providers use different tiered storage models, it’s helpful for agencies to think in terms of four tiers, 0-3. Which tiers an agency uses will depend on how expensive storage is and how often the data being stored is accessed.

For instance, operational data is used daily and thus needs to be in the readily available Tier 0, where recovery access is immediate. Such data likely won’t be stored in the cloud.

Contrast that with Tier 3 archival data, which some agencies legally must maintain for 30 to 50 years and requires the least expensive, possibly offsite storage.

LEARN MORE: Choosing the best data storage for your agency.

Agencies must look at where it makes sense to use cloud storage for BaaS because for every dollar of storage, it takes about $20 to retrieve that data. The more frequently data is used, the less worthwhile it is to store it in the cloud. Recent economic data for commodities won’t be stored in the cloud.

While BaaS isn’t for every agency, those embarking on their cloud journeys need it from the outset because most data and apps used in the cloud involve storage and backups. Those that fail to plan where they will back up their storage tiers will flounder. Those agencies moving to the cloud still need to plan to back up their data. Migrating to the cloud does not replace the need to back up data.

Don’t Neglect COOP and DR Plans

The other aspects of BaaS that agencies often fail to consider are their continuity of operations plans and disaster recovery. COOPs cover how the agency will keep functioning in the event of any interruption, including cyberattacks, while disaster recovery plans address how data and apps are being stored and how they can be quickly recovered following such an interruption.

Agencies must think about what needs to be restored and in what order, and about who is responsible for ensuring that this occurs. Having a tiered storage model helps, but agencies also must regularly test their COOP once in place.

A COOP goes out of date quickly, sometimes because the person who designed it departs from the agency. A COOP that hasn’t been tested in two or three years is likely invalid because of the set of system changes made during that time.

At a minimum, agencies should review their COOP and DR plans to ensure that all parts of BaaS are in place and that employees know their roles in the event of a cyber incident or other disruption. Agencies that significantly change their operations — such as conducting a complete system refresh — should test their plans more frequently.

This article is part of FedTech’s CapITal blog series.