Once you convince an organizational leader that it’s the right time to move forward with a business continuity plan, the next step is to assess the risks and discuss the most realistic outcomes based on their specific situation and compliance requirements. That process includes evaluating their existing RTOs (Recovery Time Objectives) or helping them develop common-sense targets for restoring various systems and data after a major disruption.
Setting benchmarks and expectations is critical. If disasters or significant outages affect one or more of your clients’ locations, their management team should know what to expect and when it will happen. Of course, the safety of their employees and customers comes first, but once the danger subsides, your clients should have a good idea of how long it will take to bring their operations back online. That’s the value of RTOs.
The technology that allows IT services companies to deliver on those promises is just as important. As Datto highlighted in its latest State of the Channel Ransomware Report, 92% of MSPs report that their clients with a viable business continuity/disaster recovery solution are less likely to experience significant downtime if hit with a ransomware attack. The vast majority (4 out of 5) of those IT professionals stated that properly supported organizations were back up and running within 24 hours.
Time is money. The quicker you can restore your clients’ essential systems, the faster they can get back to business and begin serving their customers and collecting money. Realistic RTOs provide assurances that outcome will happen within a prescribed amount of time ‒ after the danger passes.
Set Reasonable Goals
The timing of disasters is rarely convenient. Businesses often experience the most catastrophic events when they’re least expected and their people are ill-prepared to mount a quick response, whether it involves a ransomware attack on a Monday morning or a destructive flood during a client’s busiest sales month. You typically can’t predict when a disaster will strike or what type of damage to expect.
Those are the uncontrollable factors that no one, including business owners and MSPs, can change.
The best advice for business owners (and their providers) is to acknowledge the potential threats, assess each measure of protection, and build effective DR plans. One of the most important things an IT service professional can do is to help each client understand the cost of downtime and how quickly they need to bring various systems back online to restore their operations.
Developing Recovery Time Objectives (RTO) is a sensible first step. Like any strategy, an effective business continuity plan requires specific timelines with goals, such as restoration of various services within a set amount of time based on their realistic organizational needs. Those objectives should be validated and tested periodically to ensure each specific guideline remains relevant to the business and its ongoing operations.
The larger and more distributed the organization (think multiple locations and remote workers), the more difficult it can be to calculate RTOs. The maximum acceptable length of time required for the business to recover lost data and restore key operations may be longer or shorter depending on the location of the primary and backup systems. A common best practice for MSPs and organizations is to chart out information streams and repositories as part of their initial evaluations.
Rank Each System
Assessing each application and set of data may seem tedious, but it is a crucial step for setting recovery priorities. For example, if the RTO is one hour, the organization needs to recover within an hour following an incident. These numbers typically vary across industries and each organization defines these tiers based on several criteria, including operational needs and compliance requirements.
Your clients, preferably with your help, should assign urgency levels for each of their information systems. Here is one example of an RTO schedule that a business might adopt based on its specific needs:
- Tier 1 data and applications are mission-critical, so the restoration target may be 1 hour or less. Email, phones, and line-of-business systems typically fall into this category.
- Tier 2 data and applications are important, but not essential. Businesses may set a 2-4-hour window for the restoration of these services. Examples might include HR and accounting systems
- Tier 3 includes all the non-critical applications that could wait four hours or longer in certain situations
Can your MSP meet these objectives? For example, if the RTO for restoring a client’s email and phone systems is one hour, can you bring them back online in the allotted timeframe? Be careful not to let your organization’s current capabilities dictate a customer’s restoration objectives ‒ though you may use those numbers as guidelines for improving your processes, employee skill sets, and technologies.
Testing is key. Can you (or any good MSP) meet the prescribed RTOs? If not, either the numbers or the DR plans and solutions will need to be adjusted. Your team might need to boost its skill sets and tools. Recognize and fill any gaps.
The Recurring Revenue Opportunity
MSPs can add tremendous value by helping their clients create and validate RTOs as part of their managed continuity solutions. That process is a core piece of an effective disaster recovery plan, especially since your team may be responsible for meeting these critical performance objectives should a tragedy or outage occur.
DR is a business-critical need for your clients and, when properly implemented, a solid source of monthly recurring revenue for your MSP business. Are you currently helping SMBs set RTOs and gain the assurance offered by having a complete managed continuity solution?
Contact the Adept MC partner team and learn how to add a comprehensive managed continuity solution to your portfolio to best ensure the resiliency of your business clients. Our revolutionary automation platform transforms the way MSPs create, deliver, and test disaster recovery plans ‒ and we’ll show you how to turn RTO into new recurring revenue streams.