Will COOP mean more managed services?

Recent natural disasters have taught a harsh lesson about the possible risks of losing not only a primary data site, but also the people who run it. Continuity-of-operations planning requires both redundancy and failover in order to ensure availability of applications and data. But redundancy by definition means purchasing at least two of what agencies may have worked hard to install one of. All the more reason to consider other people's infrastructures when developing a COOP plan for IT operations.

Federal agencies are apparently taking a second look at managed or hosted services.

'There are a number of agencies that are using managed services for disaster recovery,' said Paul Thomas, vice president of managed services and host computing at Computer Sciences Corp., a systems integrator. But the decision to hand over certain IT operations, whether for COOP or not, is not easy.

Government in general has been slower to adopt managed services than the private sector because of security, reliability and control issues. 'It's not something they tend to think about,' said David Neil, vice president at the research firm Gartner Inc. of Stamford, Conn.

'Government agencies have trouble moving out of an environment where they are making the technical decisions,' Thomas added.

To gain government COOP business, managed-service providers typically develop solutions that are less standardized than their typical business offerings. 'The government is interested in continuing to exercise influence over decisions,' Thomas said, adding that CSC accommodates this need by offering hybrid solutions. At some agencies, for example, CSC provides services on government property, or only handles the management piece, leaving the agency to own its systems.

Thomas said government is not as adept as the private sector at accounting for personnel costs, which may lead it to underestimate the benefits of outsourcing its continuity operations. The privacy demands of federal employee unions have also been a disincentive to outsource IT infrastructure, he said.

Security has proved to be an impediment for some agencies. 'Intelligence is not going to want to share their information across any kind of public network,' said Chris Shenefiel, federal solutions manager for Cisco Systems Inc., which sells COOP solutions based on its networking technology. 'Those guys are not going to outsource their continuity. For the average administrative agency, it's definitely an option.'

But Thomas calls the security argument a red herring, noting that corporations with their own secrets to keep (think Coke and its secret formula) have been willing to outsource parts of their networks.

Neil remains skeptical about managed services as a COOP option. 'From a staffing point of view, you're probably going to be better off in a true disaster,' Neil says, 'but in functionality, you're not going to get too much more than [you] would yourself.'

The key, therefore, may be to approach managed and hosted services as a mission-enabling solution first and foremost'a way of cost-effectively meeting an IT need'with COOP benefits as an additional way of making the business case.

Investing in infrastructure

While managed services can include anything from Web site hosting to real-time seat management, the types that matter most in COOP have to do with networking, data backup and application hosting. Yes, outsourcing Web hosting to a third party may ensure a site stays up in an emergency, but depending on the Web site, it may not be mission-critical enough to factor into a COOP plan.

Not surprisingly, major telecommunications companies such as SBC Communications, Sprint and Verizon have programs for managing the network portion of a COOP plan. Among the major vendors of hosted applications are CSC, EDS Corp., Hewlett-Packard Co., IBM Corp., Northrop Grumman Corp. and Unisys Corp.

Experts say to look for the following features in a managed-service provider:
  • Geographic diversity of sites

  • Documented experience with previous disasters

  • Physically hardened, redundant data centers

  • Service-level agreements that guarantee instant response, not a place in line

  • Solid interoperability among sites, including over disparate wired and wireless networks to ensure continuity for first responders

  • Continuity and succession plans for its own operations.

Agencies whose internal and external service levels depend heavily on Web connections can turn over parts of their infrastructure to managed-service providers that originally existed to help Internet service providers and their large customers handle unexpected traffic spikes. One of the leaders, Akamai Technologies of Cambridge, Mass., owns a worldwide network of more than 15,000 servers that can forward Web content to the ISPs closest to end users, minimizing the Internet's notorious performance bottlenecks. The technology is tailor-made for the data- and application-availability components of COOP plans, and would be difficult for agencies to do on their own. 'You can never build your infrastructure adequately to handle your 'flash crowds,'' said Keith Johnson, Akamai's public sector vice president. 'We're delivering across a network platform, so it's available any time.'

Johnson said 11 of 15 Cabinet-level agencies use Akamai, and while the company doesn't specifically have a COOP offering, it cites examples where its network has helped agencies handle increased public demand following a natural disaster. One is the Geological Survey, which uses Akamai's EdgeSuite service with Web servers in California, South Dakota and Virginia to handle spikes in demand for earthquake data. 'We can keep a minimal infrastructure here and manage the data, and use Akamai to manage that load,' said Lorna Schmid, infrastructure and operations projects manager at USGS. The system responded well last December, when the Asian earthquake and resulting tsunami caused a 23-fold jump in hits at USGS Web sites over a four-day period, from the normal 21.6 million, to 500 million.

SunGard, a prominent disaster-recovery vendor, advocates a mixed approach that combines managed-service offerings for critical applications with traditional data recovery services.

'On 9/11, virtually no data was lost,' said David Palermo, the company's vice president of marketing. 'The problem was, people couldn't get out of New York City to get to the data center.'

To handle such massive and unexpected relocations of people, SunGard maintains roughly 10,000 user seats in facilities in 'most NFL cities,' Palermo said. The human component of the COOP formula may be underappreciated, though; Palermo cites a SunGard study of 100 organizations in which only 19 percent had evacuation sites.

Outsourcing COOP components to SunGard can reduce costs and increase availability by approximately 30 percent, Palermo said.

Shenefiel points to other financial benefits of such solutions, including freeing physical space for other public purposes and reducing labor and training costs. 'It also relieves the capital burden on any one agency to build that thing,' he said.

Ultimately, responsiveness may actually be better, not worse, with a hosted data center. 'When they build their own redundant data center, there's about an eight-month lag in updating the data,' Palermo said.

But Shenefiel also sees a downside when agencies run their mission-critical systems on 'auto-pilot.'

'They're now disconnected from the everyday activities. It's harder and harder to take it back in if they have to. It's almost impossible,' he said.

Bottom line: Managed services can be an added dimension to COOP plans, but they must also factor into an agency's overall IT operations to ensure adequate oversight and management.

David Essex is a freelance technology writer based in Antrim, N.H.

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above