Network Computingwww.networkcomputing.com

Of the vendors contacted, five responded with proposals: Exodus, HP BRS, IBM BCRS, Storability and SunGard. Explanations from vendors that failed to respond ranged from e-mail snafus to lack of staff available to prepare a written response.

Terrific T-shirts' Infrastructure Click here to enlarge

The companies that did respond provided an illustrative cross-section of approaches and solutions. Storability's response positions the company as a competent provider of consulting and managerial services, rather than as a direct solution provider. HP BRS, IBM BCRS and SunGard each offers replacement strategies based on years of experience in hot-site recovery operations. Exodus outlines a solution that entailed wholesale outsourcing of Terrific T-Shirts' IT infrastructure to a Web-hosting environment, allowing the T-shirt maker to avail itself of Exodus' own replicated data-center architecture.

Of the respondents, only Exodus, HP BRS and Storability provides price estimates for their solutions. IBM BCRS and SunGard indicate that corporate policy does not permit price disclosure.

Only IBM BCRS say storage recovery could not be provided independently of other (system and network) recovery services. Exodus offers storage recovery as a standalone service, but only to customers using its Web-based data center.

While all the responses have numerous architectural strengths, SunGard's response stands out as a solution set with a pedigree: broad and flexible regarding customer requirements, especially in comparison with the IBM BCRS and HP BRS offerings, possibly owing to the company's vendor neutrality. These three traditional vendors are more or less on par with respect to site availability, network services, consulting services and other components of a comprehensive subscription-based recovery service.

Exodus' solution also has tremendous appeal. However, the initial price tag of $600,000 to $1.2 million for relocating Terrific T-Shirts' operations to the Exodus data center triggers an important question: Can business-continuity concerns be an effective driver for companies to adopt an outsourced or remotely hosted IT model as their production environment? If so, Exodus would be a strong candidate for the job.

It's worth noting that HP BRS, which proposes three alternative solutions for Terrific T-Shirts' storage-recovery requirements, provides prices on two options that were higher that in the Exodus bid. In other words, for the price of a mirrored solution at an HP BRS facility, or of a redundant, mirrored storage infrastructure owned by Terrific T-Shirts itself, the company could just as readily relocate all its operations to an Exodus data center. Of course, HP BRS is cautious about the pricing provided, adding a caveat that more analysis of customer requirements would be needed before the ultimate solution -- and price -- could be determined.

What's Missing

Two points that are not emphasized in this RFI, but are nonetheless extremely important, are data security and strategy validation. Most proposals pay some attention to security, with vendors citing their experience in fielding best-of-breed security solutions as an assurance that the right kind of security would be added to the final solution offered. However, no response provides details about how data transmitted over networks to remote mirrors or tape vaults would be safeguarded from eavesdropping. It is also unclear how data would be protected from access by the vendor's own staff or by others who might be working in and around the customer's storage complex. And there is no indication of how existing data-segregation schemes or access policies used by the customer in the production environment would be translated to the recovery environment. These are critical issues that need to be addressed in detail by the vendor prior to the selection and execution of any strategy.

In the contingency-planning field, validation of a recovery strategy requires testing and measurement. Strategies must be tested periodically to ensure their internal integrity and to demonstrate that they remain in line with customer requirements, which change over time. Traditional vendors of disaster-recovery services understand the testing requirement well. However, short of noting that test or rehearsal time would be included if a customer used a vendor's hot site as a recovery center, our respondents pay little attention to the more fundamental issue of verifying on an ongoing basis that tape vaulting or disk mirroring is producing a usable storage-recovery capability. How will mirrored data be inspected to determine integrity? How will the tape vault be assessed to determine whether data is being stored properly and in a way that will enable reads back from tape when a crisis that requires restoration develops? These questions must be addressed before you sign an agreement to implement such strategies to provide a practical storage-recovery capability.