ebook: state of data backup for smbs

2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBS

BUSINESSES RUN ON DATA.To ensure that data is available to keep a business running, every small to medium sized business (SMB) needs to be prepared and think ahead. If an SMB waits until it is hit with a crashed computer, a security breach or a natural disaster, its data – the lifeblood of its business – may never be recovered.

If an SMB’s data backup system fails, so could the business. According to the U.S. Small Business Administration (SBA), approximately 40-60 percent of small businesses never reopen their doors after a disaster1. In financial terms, reports place the cost of data loss for businesses at an average of more than $500,000 over the course of a year2.

This 2014 Report on the State of Data Backup for SMBs reveals key insights around data backup, security and recovery as a result of a survey conducted during the first quarter of 2014 by Carbonite, Inc.

The survey compiled responses from 500 IT staff at companies in the U.S. with fewer than 100 employees, and includes highlights of current trends, observations, opinions and attitudes about the state of data backup from the small business IT pro’s point of view. As a result of collected responses, five key themes have emerged – priorities IT professionals should consider as they work to improve their data backup, security and recovery strategies in 2014 and beyond.

Questions in Carbonite’s Report on the State of Data Backup for SMBsfocused around three data-centric areas:

Results from these questions revealed five key themes about data backup for SMBs:

1. DATA IS A SILENT KILLER TO THE BOTTOM LINE: Respondents recognize that the financial impact of data loss on their businesses has the potential to put them out of business.

2. THE NON-FINANCIAL IMPACT OF DATA LOSS: Most IT personnel have experienced data loss and have seen that its impact goes well beyond just profit-and-loss issues.

3. DATA SECURITY AMONG SMBS: Most small businesses are more concerned with internal security issues than they are with external ones.

4. DATA BACKUP IS UNDERUTILIZED: Failing to back up data every day poses a risk, yet most SMBs perform infrequent backups and do not trust employees to take the initiative of backing up their own files.

5. BACKING UP ONLINE AND TO THE CLOUD: Where data gets backed up varies greatly, but a majority of SMBs do seem to recognize the benefit of backing up to the cloud and online.

BACKUP SECURITY LOSSFrequency, Location,

AutomationConcerns, Encryption, Best Practices, Policies

Damage, Preparedness and Experience

2014 REPORT ON THE STATE OF DATA BACKUP FOR SMBs I 1

1 Beesley, Caron. “4 Ways to Safeguard and Protect Your Small Business Data.” SBA.gov. January 10, 2013. http://www.sba.gov/community/blogs/4-ways-safeguard-and-protect-your-small-business-data.2 Walker, Danielle. “Study: IT leaders count the cost of breaches, data loss and downtime.” SCMagazine.com. November 20, 2013. http://www.scmagazine.com/study-it-leaders-count-the-cost-of-breaches-data-loss-and-downtime/article/321782/

BACKUP

THEME 1: DATA IS A SILENT KILLER TO THE BOTTOM LINE

When it comes to the impact of data loss on their companies, IT professionals at SMBs are realistic about the deep damage that can be caused. When asked, “Approximately how much would it cost your company in lost revenue if it lost all of its data files?” the largest number of respondents – nearly a third (31 percent) – said the cost would exceed $500,000. This number is not only consistent with reports of the average cost for data losses among businesses in the U.S. cited above, but also shows how the size of the business affects the size of the financial risk. Of those who predicted that a total loss of data would cost their companies more than $500,000 in lost revenue, nearly three-fourths (72 percent) were from companies with more than 50 employees. By contrast, of the 23 percent who placed their potential loss at $10,000 or less, a significant majority (59 percent) represented companies with fewer than 50 employees.

Respondents recognize that the financial impact of data loss on their businesses has the potential to put them out of business.

The respondents’ recognition of how much damage data loss could do to their companies was reflected in their pre-paredness. When asked, “How prepared or unprepared would your company be if it experienced data loss?” a vast majority (89 percent) claimed to be prepared at some level with only two percent feeling like they were“very unprepared.”


Over $500,000

$10,0000 - $99,000

Less than $10,0000

$100,000 - $$499,999

31%23%

23%23%

Approximately how much would it cost your company in lost revenue if it lost all of its data files?

Somewhat UnpreparedVery Unprepared

Very prepared

Somewhat Prepared

9% 2%42%47%

How prepared or unprepared would your company be if it experienced data loss?

QUICK FACT

QUICK FACT

Despite being confident in their preparedness, respondents were far less positive about how a major data loss would impact their companies. When asked, “How likely or unlikely would your company be to go out of business if it permanently lost all of its data files?” 41 percent placed the possibility of failure at either “Very Likely” or “Somewhat Likely.” While 40 percent of businesses with fewer than 50 employees and 39 percent of those with more than 50 employees felt there was at least some chance of their businesses failing, nearly a third of businesses with fewer than 50 employees (29 percent) felt failure was “Not at all Likely” as opposed to just 16 percent of businesses with more than 50 employees (16 percent).

Very Likely

Not Very Likely

Somewhat Likely

Not Likely at all

18% 37%

23%22%

How likely or unlikely would your company be to go out of business if it permanently lost all of its data files?

THEME 2: THE NON-FINANCIAL IMPACT OF DATA LOSS

Data loss was familiar to most who took the survey. Nearly two-thirds (62 percent) of IT professionals surveyed had experienced some form of data loss in their careers. Those who had experienced data loss were asked what, if anything, resulted from the data loss (respondents were allowed to cite more than one result for this question).* Financial impact due to either profit loss or a missed business opportunity both were cited by a third of those surveyed (33 percent and 32 percent respectively). Additional results can be seen below. The survey found that data loss also negatively impacted employees with respondents citing some employee impacts even more often than loss of customers (20 percent). Negative impacts on employees included: work/life balance of employees suffered, office morale suffered, the IT department became micro-managed, employees were fired or laid-off, or employees quit.

Most IT personnel have experienced data loss and have seen that its impact goes well beyond just profit-and-loss issues.

If you have ever experienced data loss at your company, which of the following, if any, were the results of your company’s data loss?

Profit loss

Missed business opportunity

Work/life balance of employees suffered

Office morale suffered

IT department became micro-managed

Loss of current customers

33%

32%

25%

24%

21%

20%

Employees were fired or laid-off

Employees quit

Other

None of these

I have never experienced data loss at my company

Don’t know/refused

15%

11%

1%

4%

38%

0%


QUICK FACT

QUICK FACT

*Respondents were allowed to select more than one answer

SECURITY

THEME 3: DATA SECURITY AMONG SMBS

It is evident from the survey results that IT professionals at SMBs are not overly concerned with outside forces exploiting vulnerabilities in their systems to steal data. While 22 percent of those surveyed placed the likelihood of an outside threat at either “very” or “somewhat” likely, an overwhelming majority (78 percent) placed their concerns as either “somewhat” or “very” unlikely.

Despite having data security policies and procedures in place for employees, most small businesses are still more concerned with internal security issues than they are with external ones.

When asked, “Approximately what percentage of your company’s backup data files is encrypted?” Only slightly more than half (54 percent) said they encrypted more than half of their data and only 36 percent encrypt three-fourths or more of their backups. Though a much smaller number, the fact that 10 percent do not encrypt any of their backup data is surprising considering today’s escalating risks.

Very Unlikely

Very Likely

Somewhat Likely

Somewhat Unikely

12%11%

47%30%

In the next 12 months, how likely or unlikely is it that your company will be hacked?

1% - 25%

26% - 50%

76% - 100%

0%

51% - 75%

16%

20%36%

10%

18%

Approximately what percentage of your company’s backup data files is encrypted?


QUICK FACT

QUICK FACT

But while external threats are not a tremendous concern for respondents, internal threats are a major issue. Those surveyed were asked, “Which of the following, if any, would you rather have employees bring into the workplace compared to their personal cloud applications?” Among the responses offered were things such as “Last night’s leftovers,” “Children,” “Pets” and “The flu.” While humorous on the surface, the numbers were not so funny as 71 percent indicated they would rather have employees introduce some kind of significant distraction or interruption to the workplace than personal cloud applications. Only 29 percent said they would rather have employees introduce cloud applications from their personal devices into the workplace.

Which of the following, if any, would you rather have employees bring into the workplace compared to their personal cloud applications

Last night’s leftovers

Their children

None of these

Their pets

The flu

Their loudest speakers

Other

40%

32%

29%

28%

19%

18%

1%

As for whether SMB employees are going around IT policies and introducing their own applications to their companies’ networks – an issue known as “Rogue IT” – those surveyed were nearly evenly split. When asked, “How strongly do you agree or disagree with the following statement: ‘Rogue IT is an issue at my company,’ meaning, employees go around the IT department when making IT decisions,” 49 percent agreed that employees were practicing “Rogue IT,” while 51 percent did not see this as an issue.

Agree stronglyAgree somewhat

Disagree Somewhat

Disagree strongly

18% 31%

31%20%

How strongly do you agree or disagree with the following statement: ‘Rogue IT is an issue at my company,’ meaning, employees go

around the IT department when making IT decisions


QUICK FACT

QUICK FACT


While only about half felt that “Rogue IT” was an issue, the majority of respondents said the practice is going on within the confines of their businesses. When asked, “If you had to guess, approximately what percentage of the employees at your company are using their own personal cloud-based applications for work-related functions that you are completely unaware of?” 76 percent said some employees were using their own personal cloud-based applications for work-related functions, but of those, only nine percent felt that number was more than half.

If you had to guess, approximately what percentage of the employees at your company are using their own personal cloud-based applications

for work-related functions that you are completely unaware of?

A - Perfect

D - Below Average

B - Above average

F - Terrible

C - Average

20%6%

49%

1%

24%

It’s surprising that “Rogue IT” seems to be taking place in spite of the fact that an overwhelming majority of respondents – 83 percent – said they have formal data security policies and procedures in place for employees to follow. What’s more, when asked, “What grade would you give the employees at your company on their understanding and implementation of data security practices?” only seven percent of those surveyed placed their employees’ level of understanding of these policies as “below average” or “terrible.” It should be noted, though, that only one-fifth felt their employees’ understanding was “perfect.”

11% - 20%

1% - 10%

51% - 100%

21% - 50%0%

14% 29%9%

24%24%

What grade would you give the employees at your company on their understanding and implementation of data security practices?

QUICK FACT

QUICK FACT

THEME 4: DATA BACKUP IS UNDERUTILIZED

The most important asset of any business is its data. Without it, businesses can’t keep track of inventory, they can’t invoice customers, they can’t run payroll and they can’t ensure that their goals are being met. Considering the importance of data to businesses and the large number that could fail because of data loss, it would stand to reason that backing it up to an off-site location would be a priority. Yet, this survey showed that many businesses fail to do this on a consistent, daily basis.

When asked, “When was the last time you backed up all of the documents and files for your business to a separate location?” only about one-third (32 percent) said they had done such a backup that day. Nearly half (45 percent) said they had backed up all their documents and files within the past week and 15 percent said they performed a backup within the past month. One percent said they hadn’t backed up to another location in over three years.

Failing to back up data every day poses a risk, yet most SMBs perform infrequent backups and do not trust employees to take the initiative of backing up their own files.

Despite being an underutilized insurance policy, the IT professionals surveyed did show faith in their colleagues’ understanding of the importance of backing up their files. When asked, “How much or how little do you trust employees at your company to regularly back up their data files?” an impressive 86 percent said they trust them, including 33 percent who trusted employees “completely.” Of the remaining 14 percent, only a small number (four percent) said they “did not trust them at all.”

In the last month

In the last week

5% 2-6 months ago1% 7-11 months ago1% 1-2 years ago1% More than 3 years ago

Today

15%45%

32%

When was the last time you backed up all of the documents and files for your business to a separate location?


I trust them completely

I do not trust them very much

I trust them most of the time

I do not trust them at all

33%

10%53%

4%How much or how little do you trust employees at

your company to regularly back up their data files?

QUICK FACT

QUICK FACT

THEME 5: BACKING UP ONLINE AND TO THE CLOUD

When it comes to backing up data electronically, there still seems to be a difference of opinion as to how this should be done, but one area that does seem to be gaining in traction is the cloud. When asked “Which of the following places, if any, does your company back up data electronically?” a majority of those surveyed (56 percent) indicated that they have embraced the cloud as a destination of choice for off-site data backup (respondents were allowed to name more than one destination for backup on this question).* While this still lags behind the numbers who back up to an external device, such as an external hard drive, NAS device or server (70 percent), cloud use was more popular than off-site servers (37 percent) and flash drives (30 percent). However, 30 percent of those surveyed said their organizations continue to back up data on employee computers or by some other means, and a few (1 percent) do not back up electronically.

Where data gets backed up varies greatly, but a majority of SMBs recognize the benefit of backing up to the cloud and online.

Not surprisingly, the survey showed that those who do back up electronically take full advantage of the technology. Nearly two-thirds (63 percent) said they back up anywhere from three-fourths to all of their documents and files and another 22 percent back up half to three-fourths. Only 15 percent of those who use electronic backup said they do so for less than half of their documents and files.


Which of the following places, if any, does your company back up data electronically?

On an external device, such as an external hard drive, NAS device, or server

In the cloud

At an off-site location

On a flash drive

On employee computers

Other

None of these

70%

56%

37%

30%

29%

1%

1%

Approximately what percentage of your business’ data is backed up electronically? For example, payroll, purchase orders,

billing, email, documents and other communications.

51% - 75%

26% - 50%

76% - 100%

1% - 25%

22%9%

63%6%

QUICK FACT

QUICK FACT

*Respondents were allowed to select more than one answer

CONCLUSION

As this survey shows, there is little question about the importance of data backup for SMBs. This is underscored in statistics from the SBA, which show that a significant majority of small business owners do back up their information3. However, this survey also shows that while the negative impacts of data loss – both financial and non-financial – are evident to SMBs, not all are taking full advantage of the electronic, off-site backup options available to them today. The results also show there is still a great deal of employee education that needs to take place around security measures and policies.

Based on the results of this survey, SMBs looking to enhance their data backup and recovery plans should consider the following:

• Automate Backups: Backing up data is something that a business cannot afford to forget to do, so to avoid the backup not getting done, an automated backup system is a must.

• Build in Redundancy: In addition to backing up to a local hard drive or server, businesses should also consider backing up to a third-party or off-site service such as the cloud. This local/cloud hybrid backup approach will allow fast recovery if the data loss is a local and minor one – such as a crashed hard drive – but will also ensure that data is retrievable if the business property (and onsite storage) is destroyed in a disaster. Adding a cloud service to the backup configuration is particularly beneficial for SMBs, which may not have an in-house IT team to help them manage and administer server backups.

• Have a Disaster Recovery Plan: Approximately 40-60 percent of small businesses never reopen their doors after a disaster. Creating a plan of action that includes secure data backup of information that can be easily accessed following a disaster will decrease downtime and make it more likely the business does reopen.

A hybrid cloud backup solution for small business could make the difference between survival and becoming a mere statistic. Before something happens, SMBs need to ask themselves if they are ready to recover from a major data loss.

The 2014 Report on the State of Data Backup For SMBs is yours to help you make your own assessment and improvements. Think of it as your workout buddy. Just remember when sharing, to follow the gym rules below.

Terms of Use:Carbonite encourages readers to share data/insights from the 2014 Report on the State of Data Backup For SMBs. The Carbonite 2014 Report on the State of Data Backup For SMBs and survey data are available for public use under Creative Commons, CC-BY-NC or Attribution-Noncommercial license. For information on proper usage and sharing of the Report on the State of Data Backup For SMBs, visit http://creativecommons.org/licenses/


Beesley, Caron. “4 Ways to Safeguard and Protect Your Small Business Data.” SBA.gov. January 10, 2013. http://www.sba.gov/community/blogs/4-ways-safeguard-and-protect-your-small-business-data.