Cyberattacks now exact a massive toll on global business. There is not only the cost of data loss, which can be considerable, but there is also the very high price of downtime. 

Gartner estimates that downtime can cost as much as $5,600 per minute, while Statista reports that, as of the fourth quarter of 2021, the average downtime after a ransomware attack in the US was 20 days. Work out the math if you dare.

Worse still, the cost of an attack extends far beyond financial loss. Your reputation is at stake. When unavailable to meet your customer’s needs, your brand is damaged, and the impact can be challenging to recover.

Fortunately, you have a defense. The most effective approach to mitigate the cost of an attack is to invest in an orchestrated backup and recovery architecture that ensures data resilience.

When you have that architecture in place, you’re prepared for any potential disaster, not only a cyberattack but also a natural calamity like a hurricane. With a well-defined plan and the necessary tools installed, your business can minimize impact and continue running smoothly.

That’s why 77 percent of IT decision-makers are now investing in orchestrated backup and recovery architectures to ensure data resilience, according to a recent global survey by Arcserve.

This investment is good news because backup and recovery are fundamental to any data resilience plan. It gives organizations the ability to avoid a potentially disastrous situation.

Testing, orchestration, and preparedness: three vital elements of data resilience

Numerous variables and unknowns arise during an incident. Solid backup and disaster recovery (DR) policies will prepare you for them, but only if you include a regular testing program in those policies.

With DR testing, you can ascertain and document the procedures necessary to restore business operations and systems in the event of an incident. Once you’ve done that, you can validate those procedures and fix potential gaps from policy and personnel perspectives. Only through proper testing can these critical aspects be addressed.

Orchestration, which entails using automation to speed up end-to-end recovery, is the second aspect of resilience. Essentially, orchestration determines the optimal sequence for bringing up various interconnected systems during a recovery.

It outlines the ideal order in which you should restore systems, identifies any intermediate steps required for validation at each stage, and ensures a smooth and orderly restoration.

The final element is preparedness. Consider a fire drill in an office building to draw an analogy. During the exercise, an alarm alerts employees to the threat. Exit signs guide them to use the stairs instead of the elevator and gather at designated safe locations predetermined by the organization. Resilience preparedness works the same way. Workers go through regular exercises to ensure everyone knows the necessary actions and execution processes in an emergency.

RPO, RTO, and allowable downtime

Companies today have a lot on their plate; understandably, many don’t give their backup and recovery tasks the attention they deserve.

They may conduct DR tests when setting up new backup software or storage servers but fail to follow through with ongoing, essential tests.

Companies must conduct regular backup tests, whether done quarterly, annually, or concurrent with significant events like a merger, deployment of a new IT system, or employee expansion.

Best practices dictate that it’s crucial to define occasions when a disaster recovery test should occur to avoid a worst-case scenario if disaster strikes.

Ideally, organizations should design a comprehensive backup testing strategy, and there are some key elements they should include when they do. Two primary strategy elements are the recovery point objective (RPO) and recovery time objective (RTO). An organization can determine its RPO by the amount of data loss it can tolerate in case of an incident.

It’s the amount of time that can pass during the incident before the quantity of data lost exceeds the tolerance deemed allowable. RPO establishes backup frequency, whether every hour, 24 hours, or seven days.

RTO, for its part, represents the time allowable to recover and restore operations to a fully functional state after an incident. Recovery is a period of disruption during which new businesses, employees, and day-to-day operations are all affected.

Organizations should validate their assumptions regarding the impact of disruptions and allowable recovery time as part of their testing strategy.

In the study mentioned above, 83 percent of respondents said that 12 hours or less is an acceptable level of downtime for critical systems before there is a measurable negative business impact.

Yet only 52 percent said they could recover from a severe data loss in 12 hours or less, while 29 percent of the businesses surveyed said they couldn’t recover data within a day or more.

These survey results highlight a gap between expectations and actual ability. Organizations should focus on improving their data recovery capabilities to address this issue to align with their acceptable downtime.

Doing this may involve implementing more robust backup and recovery solutions and enhancing disaster recovery plans. It also involves regularly testing and updating processes to ensure their effectiveness.

By closing this gap, businesses can better mitigate the negative impacts of data loss and minimize downtime, safeguarding their operations and reputation.

Fail to prepare... prepare to fail

In a world of omnipresent cyber threats—IBM’s Cost of a Data Breach 2022 report found that 83 percent of businesses experienced more than one data breach last year—being prepared means being proactive.

It means understanding potential threats, mitigating risks, and developing strategies for recovery. Such a proactive stance can make a significant difference in an organization’s ability to withstand any disaster that may strike.

As we have learned from numerous ransomware incidents, unprepared organizations often face severe consequences, leading to outright bankruptcy.

On the other hand, organizations prioritizing preparedness have a better chance of surviving and recovering from disasters. Preparedness is crucial in determining whether your organization will bounce back from an incident or fall flat into failure.