BCP for SaaS a must on unstable broadband
Business continuity planning (BCP) for software-as-a-service (SaaS) is a must if companies have offices located in areas within emerging markets that have weak or fledging broadband infrastructure, given the higher possibility of outages which can bring operations to a halt.
Apalak Ghosh, lead analyst of emerging technologies research for infotech practice at CyberMedia Research, explained that in India, for example, broadband connectivity issues are more "pronounced" in Tier 2 and Tier 3 cities and will likely remain so for the next few quarters.
"The very idea of being constantly online to use a particular app has its challenges [due] to the difficulty in having uninterrupted Internet connectivity," Ghosh explained. "This is one of the fundamental reasons why companies [in these locations] hesitate to move to the cloud model."
If companies want to try out SaaS, they will first do so with non-mission critical apps, he noted. There is no silver bullet to resolve SaaS usage amid weak broadband infrastructure, but the basic rule of thumb for companies is to be aware of a provider's service level agreement (SLA) for uptime and determine how tolerant they will be in the event of a downtime.
The tolerance level, which looks at the recovery time objective (RTO) and recovery point objective (RPO), is part of the overall disaster recovery (DR) or BCP, Ghosh said. RTO is the duration of time and service level within which an application must be restored after disruption, while RPO is the point in time relative to the disruption where the customer needs preservation of data.
He noted it is more difficult to factor BCP in the deployment of SaaS because a third-party manages almost the entire system, from the infrastructure to application layer. Companies have less ability to tweak the application and underlying infrastructure to make it highly available for their business requirements, Ghosh explained.
Mayank Kapoor, ICT industry analyst for data center and cloud computing at Frost & Sullivan, had a similar view. SaaS has no hardware to speak of, but must be treated as an extension of a company's own IT environment and, therefore, be included in the overall DR or BCP strategy, he said.
Companies have to "accept the reality" there can be Internet downtime in SaaS and make the necessary contingency plans, Kapoor said, noting how enterprises sometimes choose not to purchase DR or BCP options offered by their SaaS vendor to avoid incurring more costs since these are usually delivered as add-ons.
In-depth BCP
Planning for business continuity also goes beyond closer evaluation of SLAs.
Yap Far Loon, business development director for telecommunication at Spire Research and Consulting, said companies should consider contacting existing customers that have provided testimonials for SaaS vendors to help with their evaluation.
They need to also consider the length of time the vendors take to restore services, and how they protect themselves against failure to restore, for instance, reclaiming credit for 5 or 10 percent of the fees, Yap advised.
He added they can explore an offline mode for SaaS apps which backups data in a local server until connection is up again. "This is a critical factor where there is subpar broadband speed and availability," he noted.
Since bandwidth and reliability of networks is a challenge in Tier 2 or Tier 3 cities in emerging markets, Kapoor suggested core apps be accessed via a private Internet connection, such as a dedicated lease line or WAN (wide area network) extension. The public network could serve as a secondary option in case the primary network faces availability issues, he said.
Depending on their business needs or preferences, companies may also check whether a SaaS vendor delivers its apps in a carrier-neutral environment, or if they have exclusive partnership with a specific telco which means these apps cannot be made available via another telco, he added.
Vendors can advise
According to Kapoor, besides education about the importance of business continuity and disaster recovery, vendors can also be asked to factor in redundancy. For instance, there needs to be adequate redundancy for customer data which can be achieved through building a second data center in a different region, he said.
Mark Micallef, area vice president for Asean at Citrix Systems, said most organizations already have more than one data center to establish both scale and redundancy. Vendors also may offer alternatives besides SaaS applications such as virtual desktop tools to help companies maintain continuity of its operations and workforce in times of broadband outage.
They can further help customers finetune their BCP development. For example, companies should base their BCP on worst-case scenarios, rather than multiple graduated versions of incidents, Micallef suggested. From there, they can look at how to keep these scenarios manageable, he said. This involves prioritizing the most essential operations, identifying the necessary staff to carry out these steps to facilitate continuity, and determining how work will be redirected if key people are unavailable.
The BCP plan should also be updated regularly to reflect changes in the importance of SaaS apps and business priorities, he added. On top of that, companies should train their workforce so they know the processes they need to follow and where to turn to for help in the event of a broadband outage.
Conducting employee drills can help personnel familiarize themselves with the procedures, Micallef said.
Yap also suggested SaaS vendors offer "light" applications which do not require high bandwidth as well as offline features in the event of a broadband outage.
But while vendors should do their part, he said companies should avoid overdependence on any one vendor to cope with network outages. Companies should assume responsibility when dealing with connectivity issues, he noted.
One contingency plan could be to subscribe to two broadband providers, making it a combination of either fixed and wireless broadband, or fixed and mobile broadband, Yap added.