Salesforce Disaster Recovery Considerations

And How Data Backup Comes Into Play

What is Business Continuity (BC)? 

Disaster Recovery (DR) and Business Continuity (BC) go hand-in-hand. Disaster Recovery is a part of an organization’s Business Continuity Plan (BCP), where DR focuses on technology and BC focuses on the corporate business as a whole. Business Continuity and Disaster Recovery practices are meant to get a business operational after an interruption (human-made or natural) as quickly as possible and reduce risks such as major downtime. BC is a practice that takes a proactive approach to plan for the best outcomes for the organization after an unexpected disruption. 

So, what is Disaster Recovery (DR)? 

When you look up the industry definition of Disaster Recovery (DR), you’ll find industry experts like Disaster Recovery Institute International (DRI) defining it as

The technical aspect of business continuity. The collection of resources and activities to re-establish information technology services (including components such as infrastructure, telecommunications, systems, applications, and data) at an alternate site following a disruption of IT services. Disaster recovery includes subsequent resumption and restoration of those operations at a more permanent site.

Disaster Recovery Institute International (DRI)

True disaster recovery involves a set of policies, tools, and procedures to recover and resume operations of vital business systems (technology). Business-critical systems can range from financial applications to messaging systems to other necessary applications that enable the business to continue operating, such as CRM tools like Salesforce. This is where SaaS backup solutions come into play because you, the customer, are responsible for your data. In contrast, services like Salesforce are really only responsible for the uptime and infrastructure of their application (unless you buy their add-on native backup and disaster recovery services). 

What’s the difference between Business Continuity and Disaster Recovery? 

The easiest way to think about the difference between the Business Continuity and Disaster Recovery components is to consider one as a proactive practice and the other as a reactive practice. Business Continuity is proactively planning for things that may fail in the business, and Disaster Recovery is the reactive process enacted when that failure occurs. By having a strong and tested strategy for Business Continuity Disaster Recovery (BCDR), your organization can become more resilient in the face of potential emergencies. That is why your organization needs both a Business Continuity Plan (BCP) for the business and a Disaster Recovery Plan (DRP) for the technology.

Preparing for failure 101

As your organization grows, it is crucial that you develop a Disaster Recovery Plan. Now, we’re not saying that you need a scope that’s filled with all the bells and whistles right away, as DR plans aren’t one-size-fits-all. It’s a plan that’s meant to be reassessed and evolve with your organization’s development because what you may need today or may deem critical may not be the #1 priority in five years. 

The easiest way to kickstart planning is to create an initial framework. Start with a benchmark goal to hit and milestones required to deem the initial DRP as fully developed. Looking at the example below, you’ll notice that some may start with no DR strategy. In contrast, others with DRPs in place may start at another level, which will need to be updated over time as the plan needs to mature to accommodate various critical business systems.

With a framework for assessment at the foundation, this is now a good time to conduct your Business Impact Analysis (BIA).

Salesforce data recovery considerations

As you conduct your BIA, you will identify potential risks and associated impacts for a disaster situation. During this analysis, you will pinpoint systems that are deemed critical to your business and your organization’s Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

Recovery Time Objective (RTO) is the amount of time (minutes, hours, days) your business can afford to be down for.

Recovery Point Objective (RPO) is the age of the data that will be recovered from your backup before business resumes.

When you have compiled this information, you will need to strategize and consider what your business needs are for your DRP:

• Compliance & Regulations
• Budget
• Data & Technology
• Vendors
• Internal Teams (stakeholders + response team) 
• Communications & Messaging
• and other considerations.

Once your analysis is completed, it’s the perfect time to develop your DRP. Fortunately, there are many free DRP templates available online, such as Tech Target’s, that you can leverage to start creating your organization’s DRP. 

How does data backup fit into your DRP?

If disaster strikes, your organization will need somewhere to recover your data from. This is where Salesforce data backup comes into play. Your backup tool will need to align with your RTO and RPO in order to meet your DR requirements. Interestingly enough, ESG Research found that over 50% of organizations actually expect RPOs lower than 15 minutes for Salesforce (see the diagram from ESG Research below). 

The criticality of Salesforce data is no joke because it holds all of your customer data. That’s why we’re not surprised that the RPO requirement is quite stringent and that you need a comprehensive backup solution that can support this. 

Three  data backup options are: 

• Application-Native Backup
• SaaS Data Backup for Salesforce
• Disaster Recovery as a Service (DRaaS)

All three are meant to protect your CRM data but have considerable differences and features. So let’s dive into these options.

Application-Native Backup

If you’re looking for an application-native option, Salesforce released its backup and restore tool in November 2021. By creating their native backup tool, they have added data protection functionality to their circle of trust. They accomplish this by backing up your Salesforce data into their managed AWS S3 Bucket located in the same region as your Salesforce org. 

However, as noted by Tech Target, their tool is a “good starting point” but limited to just a daily backup of Salesforce data, which doesn’t hit the standard of 15-minutes or less for RPO. The other issue is that both your Salesforce production data and backup data are regionally co-located, so if there were an outage in the area, your production and backup data would be down. In terms of data recovery, Christophe Bertrand (Senior Analyst at Enterprise Strategy Group) noted that it is “baseline recovery… a start, but if you use Salesforce as a mission-critical app, this won’t cut it“. 

Suppose you need just a basic Salesforce backup tool. In that case, their native backup tool is certainly one to consider if you do not need to meet an RPO standard of less than a day and if their data recovery times can support your organization’s RTO standard. 

Disaster Recovery as a Service (DRaaS)

If the application-native backup isn’t the right fit, let’s look at the Disaster Recovery as a Service option on the other end of the spectrum with all its bells and whistles. DRaaS is defined as “the replication and hosting of physical or virtual servers by a third party to provide failover in the event of a natural catastrophe, power outage or another type of business disruption.” The DRaaS option allows your organization to failover by leveraging the offsite vendor during a disaster situation.

DRaaS is a great option for organizations that need a 3rd party to step in during a catastrophic, near-shutdown disaster. With this option, there’s a DR site with its own unaffected independent infrastructure that is ready to replicate your mission-critical data to another cloud location to get you back to business sooner. 

Having a managed DR service can help you avoid the extra headaches you’re already dealing with during a disaster. But your RPO and RTO standards are fully reliant on trusting a 3rd party DRaaS vendor and the Service Level Agreement (SLA) between you both. Not to mention, you have to consider how a failover to a different infrastructure will affect your business performance-wise.   

SaaS Data Backup & Backup as a Service (BaaS) for Salesforce

If DRaaS is too much for your organization, and application-native Salesforce backup isn’t enough for you – what’s there left to consider? In the middle, we have SaaS Data Backup and BaaS, where a 3rd party vendor provides a data backup and restoration service. 

With a third-party backup vendor, you can separate church and state (Salesforce production data and backup data) without needing to fully rely on an offsite DR vendor’s infrastructure. A good SaaS data backup or BaaS option will allow you to Bring Your Own Storage (BYOS) so that you can bring your backup data under your organization’s security umbrella and control. Think about it this way; you’re already paying to store the captured data in the production application. You should be able to own and access it at any time as well. Not to mention with data ownership, you can access your data even if Salesforce is down. 

SaaS data backup and BaaS offerings are generally more feature-rich as well, allowing you to have RPOs of less than daily alongside other functionalities such as data archive and data analytics. For data recovery, often, these tools will provide the ability to do granular restoration so that you can pick which data to restore and can avoid overwriting what is actually valid. 

Salesforce: When to call for data backup vs. data recovery

True disaster recovery will never be just data backup. Data backup is just one part of your DRP. Salesforce data backup and recovery is just meant to recover object-level data, so that does not account for full org, database, or disk recovery. For best practices, you should use your Salesforce data backup and recovery tool for day-to-day backup and recovery operations, such as record deletions, integration errors, and human errors. 

For true data recovery with Salesforce, you would need a tool that can handle catastrophic disasters, such as issues with the disk or at the database level. Due to lack of access via Salesforce API, you will need to rely solely on Salesforce for true DR because of how they designed their DR tool. With only limited access to APIs, no 3rd party vendors (SaaS Backup, BaaS, or DRaaS) can provide a true DR solution for Salesforce. Because of this, it’s imperative that you stay up-to-date with Salesforce’s DR and BC audits for compliance purposes.