Data Protection Services: What They Actually Cover and Why Choosing One Is Easy to Get Wrong
Introduction
Data Protection Services refer to third parties providing technical knowledge or operational management in order to protect the data of an organization instead of the organization depending entirely on its internal capabilities to devise all forms of protection.
This seems relatively straightforward but the number of different models is a factor which leads many businesses to underestimate the complexity.
Why Data Protection Services Are More Complex Than They Appear
The provision of data protection services is not an umbrella term but a combination of the following:
- Consulting and risk assessment services
- Managed backup and recovery services
- Security monitoring and incident response
There are some suppliers who claim themselves as providers of data protection services without mentioning what exactly they are offering. This lack of clarity causes mismatch in expectations when the deal starts.
For a business that hires such a supplier, service scope must be individually discussed for each of the above-mentioned aspects, since an organization that is good in managing backups may not have capabilities in compliance consulting or threat monitoring.
Major Areas of Data Protection Services
Risk Assessment and Consulting
Rules Governing
- Data protection gap analysis
- Risk prioritization on the basis of impact on business
- Technical/policy recommendations for improvement
One of the most common and expensive mistakes is that of skipping proper risk assessment because it might lead to:
- Protecting low-risk areas while high-risk gaps are still present
- Not considering compliance requirements at all
- Being unable to justify the investment without risk assessment
Managed Backup and Recovery
Backup management is a common feature of data protection services and entails a commitment by the vendor to follow recovery time and recovery point objectives.
Managed Backup Services Often Include
- Scheduled backup with monitoring
- Recovery testing in order to prove that data can be restored
- Offsite or cloud backup in case of disaster
Security Monitoring and Incident Response
Incident handling involves not just prevention but also the growing need to monitor events and react promptly once they happen.
Those Services Usually Vary in Many Respects Including
- Around-the-clock monitoring or not
- Incident reaction time promises
- Reporting on incidents and remediation assistance
Compliance Support Services
Services offered by data protection service providers may include:
- Documenting for compliance audits
- Advice about changing privacy legislation
- Handling of data subjects’ requests
How extensive these services are varies according to how specialized the data protection service providers are in certain regulatory regimes.
Pricing and Engagement Models
Some engagements for data protection services necessitate consideration of various aspects, such as:
- Fixed pricing engagements against managed services engagement agreements
- Pricing in relation to volume of data or number of protected systems
- Flexibility of the engagement as demand for data protection increases
These considerations must be made properly since ambiguous engagement models can result in cost surprises.
Why Data Protection Service Engagements Underdeliver Even With Skilled Providers
Value shortfall from the use of data protection service providers does not occur because the service provider is incompetent.
Instead, there may be under-delivery due to:
- Risk assessment is bypassed in lieu of immediately moving to a technical solution.
- There are no clear commitments for continuous monitoring in the contract.
- Insufficient internal communication regarding potential problems raised by the service provider.
How Businesses Choose the Right Data Protection Services
Clarifying Scope Before Signing
Large companies might detail precisely what services they require, particularly when internal staff is responsible for certain protection activities.
Service Qualities Supporting Successful Engagements
Good service agreements typically include providers that:
- Carry out risk assessment prior to suggesting solutions
- Generate reporting on testing and monitoring of backups
- Have a clear incident response commitment
Reviewing Provider Track Record
Companies evaluate on:
- Case studies relevant to their particular industry
- References as regards actual incident response performance
- Relevant certifications related to data protection
Examining the track record of a company allows organizations to ensure the delivery of the service matches marketing promises.
Common Data Protection Service Mistakes
Skipping Risk Assessment
Hiring a vendor for a particular solution without knowing the risks associated with the company.
Assuming Monitoring Is Included
Finding out too late that real-time monitoring was not included in the service agreement.
Ignoring Recovery Testing
Assuming that backups are properly maintained without ensuring that recovery has taken place.
Poor Internal Coordination
Inadequate preparation with regard to:
- The internal entity coordinating with the external provider
- Response time of the internal entity to provider warnings
- Transfer of documentation in case of discontinuation of the engagement
Lack of proper coordination may result in delayed response even when the provider is doing well.
Bottom Line
The field of data protection is wide-ranging and involves many different aspects including risk evaluation, managed backup, security monitoring, compliance assistance, and pricing schemes.
Given the degree of ambiguity in the marketing of these data protection services, it might be more beneficial for organizations to establish the scope of work and investigate the history of success of the service provider first.