The backup business

By Stuart Whittle, head of information systems, Weightmans LLP

Increasingly, law firms need to demonstrate to their clients they are capable of continuing to deliver the high levels of service they have come to expect in the event of a disaster.

Before our engagement with SunGard Availability Services, Weightmans had no formal company-wide data backup strategy; relying instead on sending data to be stored on disk at an offsite location. As well as reducing the impact of occasional computer and systems failure on productivity, we realised that a clear backup procedure is a key element of being able to maintain operations and service levels in any situation.

We also wanted to ensure that any solution complied with Lexcel. As a Lexcel-accredited practice, the firm undergoes rigorous independent assessment every year to ensure that we meet the required standards of excellence in areas such as client care, case management and risk management. Conforming to that standard, firms are required to develop and maintain a detailed business-continuity plan, including risk assessment, identifying ways to reduce those risks, and robust processes for testing the plan.

As the head of information systems at a top 60 national law firm, I wanted our business-continuity strategy to reach beyond traditional IT disaster recovery (DR), however, and realised that a far broader focus on information availability was needed.

Business continuity isn’t just an IT problem. It is no longer sufficient just to protect the data behind a given process. After all, the services we supply to our clients are now almost entirely reliant on IT for delivery.

Access always available

In order to maintain competitive advantage we wanted to ensure our staff, customers, suppliers and partners had access to core information whenever they needed it. While any occurrence of data loss could have an immediate impact on an individual staff member, as well as a substantial knock-on impact on the productivity of an entire team, the difference between having and not having immediate access to all the necessary information could have had a very substantial impact on performance, operational risk, client satisfaction and ultimately our reputation as a firm. We also recognised that security was a key issue given the privacy and data-protection implications of the 3TB of data, including a significant number of highly sensitive documents that we held in our archives.

It wasn’t difficult getting buy-in from the board. The benefits were obvious, as were the risks of not doing it, and the need to adhere to increasingly stringent regulations in this area. There had been a lot of assumptions about what we would be able to recover in the event of a disaster, which were, to some extent, misplaced.

Rather than simply meeting the minimum requirements for Lexcel accreditation, we decided to review our overall information-availability strategy. Having researched the various options open to us, SunGard’s 'one-stop-shop' approach was the most appealing.

We are now working with SunGard on a five-year contract whereby they will assess our requirements, implement the necessary changes and ensure that information availability is effectively maintained across the firm. SunGard also provides us with technology recovery; data replication; managed hosting; server replication; and electronic vaulting services. This solution strategy ensures that the recovery time objectives (RTOs) – restoring time by system or function – and recovery point objectives (RPOs) – how recent the information restored needs to be – are met.

Data profiling to save costs

As part of our contract with Sungard it also partnered with software provider Kazeon to execute a data-profiling exercise to better understand the data created, stored and accessed at Weightmans. This included both the structured data that was stored in field form in databases or annotated in documents and unstructured data such as e-mail correspondence.

The data-profiling exercise showed that we were storing data many years old, and we realised we required a more efficient storage strategy that differentiated between business-critical and redundant or duplicate data. For example, low priority but essential data needed for audit reasons could be archived using lower availability and more economical storage facilities, while critical information could be stored separately on a highly accessible and rapidly retrievable system. Redundant, irrelevant or duplicated data such as personal e-mails or mp3 files could be eradicated entirely – significantly reducing the volume of data needing to be stored.

Eliminating risk

We now have a two-tier strategy that differentiates between the firm’s data. It stores the past twelve months of all documents as well as other critical data in a remote and highly accessible managed SunGard facility, with older and non-essential data archived separately.

SunGard’s server replication protects clients’ data, keeps critical servers running and helps to ensure rapid recovery of failed systems is implemented to protect servers. The service replicates systems and data onto hardware and software hosted in a SunGard Technology Centre in real time, via a dedicated communications link. They achieved this by installing unobtrusive software on the systems,
so no additional equipment was needed. This means that information can be electronically transferred to SunGard without affecting our normal systems’ performance. Should interruption occur, however, we can fail over and continue normal operations via the replicated systems within 15 minutes.

By implementing SunGard’s electronic data vaulting (EDV) solution we now have a highly reliable, efficient and cost-effective backup solution that is both vastly superior to tape and ideally suited to the 24/7 business environment we work in. Data is backed up directly to disk via a dedicated communications link, situated in a highly secure technology centre. The backed-up data is then automatically copied to a second, geographically separate technology centre for added resilience. As well as removing the time-intensive process of creating tape backups, it also allows us to retrieve critical data and IT services almost instantly. Used in conjunction with server replication, EDV allows us to back up our data while also replicating core IT services. This means we are able to continue operating in the event of a disaster, rather than simply being able to recover from a disaster.

After the business-impact analysis was conducted we determined the maximum time that fee-earners could be without their core business systems in the event of a disaster was three hours. The replication solution seemed the best way to help deal with such a situation. It replicates all the data from the four most critical servers at our Liverpool HQ. Our replication solution now provides near-to-real-time replication of data to dedicated servers hosted in SunGard’s London Technology Centre. This allows the firm to set a RTO of 15 minutes to recover each of its mission-critical servers using the SunGard managed-recovery service, and means fee-earners at the company can be operating as usual within the maximum three hours. This ensures that the firm is well positioned not only to avoid data loss in the event of a disruption, but also to get the systems we need to do business back online as soon as possible.

Having already implemented continuity plans to ensure availability of data, we then extended the project to a review of our communications infrastructure. The firm will also incorporate the recovery of the VoIP telecom system into our information availability strategy. As a result we have now met our firm target of the Lexcel accreditation standard for resilience.

Having tested the new continuity provisions thoroughly we are happy we have taken all the appropriate steps to ensure information availability for our business. We’ve also benefited from zero data loss since the implementation. Furthermore, the new data solutions, and the data-profiling exercise in particular, have helped us to predict our storage costs over the next four years. Having used the BS 25999 standard for business continuity as a benchmark for our plans, we are looking to be certified against the standard in the near future.

Stuart Whittle is a partner and the head of information systems at Weightmans LLP. He can be contacted at: stuart.whittle@weightmans.com