As I speak with potential Managecore customers an issue is being brought up more and more that is troubling. The issue these customer prospects want to discuss, is they have recently found out that some, if not all, of their SAP® systems are not being backed up by their technical managed services provider. For an SAP customer, that is downright frightening!
SAP is the lifeblood for any company that uses it. It may not be the only system that your company depends on, but it is generally the system of record and central to most other data processing functions. Customer data, inventory, sales orders, bills of material, financial history, (the list goes on), are all critical to keep a business functioning. Losing days, weeks or months of this data would be catastrophic. And without a backup, anything that would corrupt the live running environment would mean the data is gone forever.
Regardless of industry, there is almost a complete reliance on computers today, so most companies would have no way to reproduce data that was lost. How many job functions in your company still operating with a paper trail? Are customer orders still taken down on paper before entered? Are shipping documents handwritten as trucks are loaded? Probably not. So ask yourself, “If we lost the last 30 days of transactions in our production SAP system, how would we recover?” I’m not asking how you’d recover the data, I’m asking how your business would recover. My bet for some of you the answer is “It wouldn’t!”
Yet somehow these managed service providers have put the urgency of good backups on the back burner or forgotten them all together. Maybe they don’t fully understand the implications to your business should a data loss occur. Or maybe they just have the wrong people managing your systems, they’ve chosen inexperienced or junior level personnel to manage your most critical application who just don’t know what to do.
Hold your Managed Service Provide Accountable
And to be clear, I’m not just talking about some small mom-and-pop type Managed Service Providers, I’m talking about household names in our industry, the biggest of the big. Their customers I’m sure chose them due to name recognition and a perception that they must know what they’re doing, so their SAP systems were placed in competent hands. They probably were showed all sorts of formal processes and reports during the sales cycle, so they must be doing backups, right? Unfortunately, that’s the furthest thing from the truth.
Now some may think (including these very service providers) that systems are resilient these days, so the risk is small. Even if you believe that, a small risk that can put you out of business MUST STILL BE ADDRESSED! Here are a few events that can still require a restore of your data:
• Hardware that goes bad and causes corruption (e.g. a bad memory chip)
• User accidental data deletion
• A transport sent to production that creates an unexpected result
• Power outages
• System crashes
• Ransomware
• Other human errors
SAP system outages may happen less often than they did 20 years ago, but they still happen.
Then there’s the false sense of security issue. Some may think they’re covered because their systems have a High Availability (HA) configuration. That helps but realize that many HA environments still have a single database image thus not protecting it from a corruption event. And if using a replicated database as part of HA, remember that a logical data issue (like data deletion) will simply be replicated to the secondary database. So again, you would still suffer unrecoverable data loss without a backup. And for a ransomware attack, well in the case nothing may protect you.
Then there’s the Cloud. The word Cloud has been bantered around so much you’ll still get a dozen different descriptions depending who you ask. For many however there’s a belief that if my data is in the cloud, its protected by definition. Again, that’s not the case. I personally am a huge proponent of cloud infrastructure, but in the context of running an SAP instance there, the cloud is just a set of building blocks that must still be architected and managed to ensure the security and availability of your data. Having your SAP systems in the cloud does not mean you no longer need backup. You do.
Also, you should not be less concerned if you’re told “Production is backed up, it’s just the non-production systems haven’t been backed up”. In that case I’m sure the plan will be if anything happens, they’ll just restore a copy of production over the DEV or QA systems. Although that’s technically feasible, how much development effort has gone into your non-productive systems that has not yet been moved to production. Critical events tend to happen at the worst possible time, so imagine a development system crash the week before go-live of a 12-month project!
Backups are still required
The other very important factor to backups that is often overlooked is testing recovery! A backup that has never been tested may be useless. Knowing that a backup has been taken is not enough. Why?
Two main reasons.
1.) The technical process of recovery should be tested to ensure that data can be read from the location it was backed up to. Everything from media failure to licensing issues can cause problems restoring data.
2.) You need validation that all data required for a functioning system is available.
The first reason is self-explanatory, can you physically recover data from a backup or not. The second may not be as obvious so let me explain. This second reason is to ensure all the data components are available for the application to function, or multiple applications to function. A baseline example of this problem would be performing an online backup of the database, but not backing up the transaction logs with it. To recover an online database backup, the transaction logs that were created during the backup process are also needed to recover the database to a consistent state. Without them the recovery won’t work. Or maybe backup and recovery works only for your core ERP system, but backup and recovery for the order entry system does not. Sounds like a lesser problem, but how many days can your company go without accepting orders from customers? These are just two simple examples, but you get the idea. When you recover data from a backup, your applications and business should function just like they did prior.
Be prepared no matter what
No one expects a catastrophic data loss, but if you don’t have good backups, with a well-tested recovery process, a critical event could put you out of business.
Regardless if you’re on-premise, in the Cloud, or have High Availability configured, whomever is responsible for managing your SAP systems must ensure backup and recovery works and works well. This mission critical operations task, if overlooked, can be catastrophic to your business. And if they are overlooking backup and recovery, what else are they overlooking!
So here’s what you can do:
Contact your current SAP support vendor today and ask them for the backup logs for the last 30 days. Be sure to ask for the non-production systems too. If backups are being done properly, this will be no more than a 15 minutes task. Any hesitation on their part and you should be worried. If it takes more than a day to produce the list, escalate immediately!
And for extra credit, find out the last time a recovery from backup has been tested! You may be surprised.
If you don’t have proof your SAP backups are occurring, assume they are not!
If you have any questions and want to ensure your SAP systems are properly backed up contact Managecore today and a certified SAP expert will be in touch shortly.
