The Beginner’s Guide to Business Continuity Management in the Cloud

云服务可能包括分析、应用程序, databases, storage, servers, and networking. Services tend to be available on demand, which means you can easily increase capacity. Though the cloud presents some challenges, it also offers these advantages:

• Uses load balancing to deliver processing and storage resources where your company needs them
• Charges only for services you use and quickly scales up or down
• Eliminates costs related to hardware that you must maintain and secure
• Reduces your electric bill because you don’t need to power servers and the air conditioning to cool them
• Reduces the latency of the fixed company-owned data center through global data center networks
• Increases availability because storage is decentralized; if one center fails, another should be available
• Helps control company expenses, increase efficiency, and reduce vulnerabilities

Read our article oncloud collaboration best practicesto learn more about the benefits of the cloud.

The cloud computing stack consists of SaaS, PaaS, IaaS, StaaS, and serverless models. Companies buy subscriptions or use a pay-per-use (PPU) model.

In a subscription model, businesses pay a recurring fee for a program they use often. With a PPU, customers pay a fixed price for single or infrequent use. Increasingly popular, PPU offers flexibility for scaling systems up or down.

Harry Brelsford, CEO ofSMB Nation and M365nation, says the cloud service models overlap in function. For business continuity and daily tasks, he adds that most small businesses will work only with SaaS tools.

Model	Business Use	Provider	Business Continuity Benefit
SaaS (software as a service)	Companies or individuals subscribe to services, which they access through the internet. The service provider manages the software, hardware, upgrades, and security patching.	Canva, Concur, Dropbox, Exabeam, G Suite, Jira, Microsoft 365, QuickBooks, Smartsheet, Zendesk, Zoom	Customers can use multiple devices to access the software anytime, anywhere they have access to the internet.
IaaS (infrastructure as a service)	A company rents servers, racks, and virtual machine (VM) storage on a pay-as-you-go basis. The service provider manages the physical hardware and location, and the company installs and manages its programs.	Amazon Web Services, DigitalOcean, IBM SmartCloud Enterprise, Microsoft Azure, Rackspace, Skytap Agile Development	公司可以迅速增刊ort a system without paying for hardware and maintaining the required data center environment. The model provides high availability in emergencies, and you don’t need disaster recovery equipment and staff. The vendor is responsible for network and hardware security and maintenance.
PaaS (platform as a service)	Providers offer a development framework on which companies build web-based software programs. The service provider manages the hardware and the software back end.	Apprenda, AWS Elastic Beanstalk, Force.com, Microsoft Azure, Red Hat OpenShift, Salesforce	Companies can continue to develop, test, and deploy new products from any employee location.
STaaS (storage as a service)	Companies rent data storage space that resides in the cloud.	AT&T Synaptic, AWS, Microsoft Azure	Small and medium-size companies can use this option for off-site backup.
Serverless	The service provider maintains servers and manages space and workloads.	AWS Lambda, Google Cloud Platform, Microsoft Azure	A form of IaaS, serverless computing allows companies to scale as necessary and pay only for what they use, instead of pre-purchasing resources. They focus solely on the business functions of the application clients. The service provider dynamically adjusts resources as needed.

You can also describe cloud host environments in these ways:

• Public Cloud:Also called the external cloud, in a public cloud, a service provider owns all hardware and software. Users manage or access software and services over the internet. Public cloud providers offer free, subscription, or PPU fee models.
• Private Cloud:Also known as the internal cloud, in a private cloud, a company owns the hardware and software. A private cloud may include a company’s on-premise data hardware or equipment housed offsite. The organization sometimes hires a third party to manage the private cloud in a single-tenant arrangement. To ensure security, a private cloud operates behind a firewall, and only authorized users may access it via an intranet or a closed virtual private network (VPN). Businesses concerned with increasing speed and availability, as well as security, and who must comply with strict regulations usually opt for a private cloud implementation.
• Hybrid:在这个模型中,一个公司可以使用任意组合of on-premise, private, public, and third-party private infrastructure, depending on data sensitivity. Companies use hybrid systems to ensure compliance and maintain highly sensitive data internally.
• Dedicated:Akin to IaaS, a single tenant occupies a dedicated public cloud, which offers cost savings and enhanced speed and performance.
• Shared:Virtual machines partition a single physical server into virtual servers that share memory and computing resources. Shared resources are low maintenance and less expensive. However, they may present security and performance issues.
• Multicloud:One company uses multiple public clouds and other resources, including on-premise and virtual machines. Multicloud installations reduce dependency on a single provider and provide optimized services for different business functions.

Learn more about how you can use these cloud service models in your business from ourguide to cloud integration．

Pros	Cons
Cloud services aren’t onsite, and you don’t have to install and manage it.	You are always responsible for understanding backup and security protocols, even for third-party providers.
It’s always on.	Data centers are subject to failures and downtime.
It’s safe, with dedicated security experts monitoring the setup 24/7.	许多网络安全及其他专业人士不trust cloud security.
It provides safe, automatic backups.	You still need to understand how your cloud provider backs up your data.
Data centers can provide better physical security than most companies, protecting from break-ins and physical threats like floods.	You need to understand the data center’s physical security plan.
Your service provider builds in more resilience and redundancy than you could achieve on your own.	With your own hardware, you can create a redundant setup or move assets. The cloud includes layers you can’t control.
You buy only what you need.	You might have to invest in more resources and personnel than you currently need

The cloud offers timely and error-free data recovery for business continuity. The cloud offers a secure, seamless alternative when you cannot access your main offices. Home offices, satellite offices, or recovery sites can continue working as normal.

Traditional recovery solutions often took hours to transfer data from on-premise tape or flash drives or servers to recovery hardware. The on-premise model could stall an entire company if the main servers crash.

SaaS and cloud offerings typically include more redundancy and resiliency against potential outages than an individual company can afford to establish and maintain. Large-scale remote work and continued trade through online shopping was impossible in the early 2000s, before the advent of cloud computing.

Here is a summary of how cloud computing supports business continuity:

• Provides regular backups and easy failover (equipment that assumes the work when primary systems fail)
• Reduces downtime
• Provides better network and information security management
• Scales to suit your business needs; for example, keep critical data on-premise and back up the rest to the cloud
• Helps reduce impact in disruption of service (DoS) attacks
• Removes the need to stand up and maintain a costly physical mirror site of your infrastructure
• Eliminates the need to sync software on two sites
• 减少恢复时间只有几分钟s — potentially
• Eliminates the need to travel to a remote site in potentially difficult or dangerous circumstances

"We would not exist and be able to be successful without cloud computing," says Tony Bombacino, Co-founder and President ofReal Food Blends．"It is 100 percent critical to our business. Like many small businesses, we use Gmail, Google Docs, and Salesforce. We also use Shopify and WordPress. We could not scale without it or stay in touch without it.

“We get on with our phones and FaceTime. Earlier today, we had a Microsoft Teams call. Yesterday we had a WebEx call. Now [with the pandemic] we're trying to use technology to take the place of what often happens in person at the beginning of a relationship."

For smaller organizations, cloud services for business continuity center on SaaS. Small companies should still evaluate a provider’s end-to-end setup and analyze strengths and weaknesses as they would for their own functions.

“I don't think most small to mid-sized businesses think about redundancy and high availability of services,” says Strawser. “I think savvier ones are going to be thinking: Does this tool that my business relies upon have that capability or not? From now on [since the pandemic], all of them are going to be looking for that.”

Businesses in regulated industries need to remember they always bear the onus for doing their part to ensure availability and security. Furthermore, it is easier to build in continuity buffers when you first build and implement an IT or communications environment than in a mature system. If you are starting a business, now is the time to consider business continuity.

Consider these issues when looking for cloud-computing resources for business continuity:

• Backups:Does the vendor back up your data or is that your responsibility? How do they back up data?
• Connectivity:
  
  Sharing data seamlessly across programs makes work easier. “Organizations don't want to move a few workloads that are on-premise. They want to have it all in the cloud because then they don't have to worry about where their employees work,” says the CEO and Chief Architect ofRefactr, Michael Fraser. “But in doing so, they have to think about the impact of how their users are going to connect.”
• Compatibility:Consider vendor-neutral tools and applications. Look for solutions that are broadly compatible with your hardware and software systems.
• Cost:Price and preserving cash are paramount concerns for small businesses, especially in a crisis. Can you get a service for free that provides the same quality of output as a paid version?“We don't choose tools with a price premium for features and functions we aren't yet ready to use,” explains Bombacino. “We try to use best-in-breed when it makes sense if they have versions aligned with small-business needs.”
• Data Extraction:Can you get your data if you change providers? Cloud companies can shut down, too — what happens to your data then? Don’t choose a vendor that either won’t let you take your data or can’t provide a way to extract it. “If the answer is no, and there's no way to get your data out of it whatsoever in any form, then you have to determine if that's okay with you. And for a lot of organizations, that may be fine,” says Fraser.
• Data Ownership:Some free platforms retain rights to your work. Find out who owns the data you add to a cloud resource.
• Data Segregation:Find out exactly how a vendor segregates and protects your data. Also ask who has access to it and how they verify users.
• Distributed Platform:Ensure you can connect your complete platform. For example, users should be able to access internal cloud services only from inside a company network, behind a firewall. In that scenario, you might need to provide a VPN setup to remote workers.
• Functionality:Does the tool do the job the way you want it?
• Location:Avoid a recovery data center co-located at or near your original site. If you need to establish a redundant site, set it up 30 to 100 miles from the primary cloud provider location.
• Remote Access:By their nature, most cloud-based tools permit remote working. You’ll want to ensure the applications are robust and flexible enough to serve a distributed workforce that uses a range of devices, including mobile.
• Security:“Security is still not top of mind for the florist and the baker,” says Brelsford. “They don't wake up thinking about security, so the platform must be secure. For example, in a collaboration tool, can I have a private conversation with you and know that I'm not being overheard?” At the very least, ask the vendor how they plan to handle a hack or breach.
• Service-Level Agreement (SLA):Do the vendor’s guarantees of availability and return to service fit your needs? Also, what is the protocol if your contract ends?
• Support:A cloud services provider may not share your time zone or even reside in the same country. Find out if support is available during your working hours. Ask if there’s access to user forums and a robust online help center.
• Usability:“Not everybody in a company has the same level of tech savvy, so we choose things that everybody can learn fairly quickly,” explains Bombacino. “It's a giant waste of money to invest in all of this technology if people can't or won't use it.”
• Vendor Reputation:You could lose all your data if a vendor suddenly goes out of business. Do some research to see the number and quality of patches and upgrades a company provides, as well as its security history. Consider whether the company is old and stable, with a large user base. “For example, nobody ever got fired for buying an IBM product,” notes Brelsford.
• Vendor Business Continuity:Your cloud services provider needs a business continuity plan, too. Understand how they will protect your data if they experience a disaster or other crisis. Learn about their backup and restore processes, along with how they test recovery plans.

This free checklist covers all the questions you should ask when sourcing SaaS tools or cloud services. The checklist includes space to make notes on provider offerings. Print the Word or PDF versions, or share it as a Google Doc so that colleagues can read your findings.

Download Cloud-Services and SaaS Checklist

Word|PDF|Google Docs|Smartsheet