The MSP Finance Team

EP069 – Profitable BCDR Strategies for MSPs with Melvyn White from Axcient

Why You Should Listen:

Understanding BCDR Layers: Learn the critical differences between backup, disaster recovery, and business continuity to enhance your MSP strategy.

Practical DR Planning: Discover a four-step process to create a comprehensive disaster recovery plan, including real-world applications and essential team roles.

Monetise DR Services: Gain insights on how MSPs can effectively price and sell disaster recovery and business continuity services, turning them into profitable recurring revenue streams.

Listen on Spotify or Apple Podcasts

Connect with Melvyn White on LinkedIn by clicking here – https://www.linkedin.com/in/melvyn-white-7b69614/

Connect with Daniel Welling on LinkedIn by clicking here – https://www.linkedin.com/in/daniel-welling-54659715/

Connect with Adam Morris on LinkedIn by clicking here – linkedin.com/in/adamcmorris

Visit The MSP Finance Team website, simply click here – https://www.mspfinanceteam.com/

We created It’s a Numbers Game Podcast to help MSP owners learn and understand how to build and maintain a financially healthy MSP business. In this podcast series, MSP business owners like you will learn the fundamental steps, the tips and tricks, the dos and don’ts to achieve MSP financial growth.

We look forward to catching up with you on the next one. Stay tuned!

Transcript;

Dan: Great to have you with us. And when I say us, it’s only me today as Adam’s, gallivanting around,around the countryside somewhere. so, so Melvyn, we, we talked a little bit in the, in the green room about,how to actually kick off this conversation.I think we should start at the very beginning with, really understanding that the layers, that,that exist within BCDR.

Dan: So, and I’m gonna potentially incorrectly summarize these as backup disaster recovery and then be BCDR business continuity disaster recovery. So, um.am I in the right starting point at least?

Melvyn: No, absolutely. yeah. That’s very comprehensive.

Dan: and so, um,what would we say are the differences then between those different, categories? how does it layer up?

Melvyn: yeah. So, so I think, Daniel, to, to kind of, you know, Kind of home in on that. When we talk about, sort of back up what we’re talking about, backing up data, the ability to have your data somewhere that isn’t in the immediate area of yourself. It could be to be fair. I mean, from a very simplistic level, it could be backed up from somewhere that isn’t on your machine to another location.

Melvyn: Could be the same location, just maybe a different desk. When we talk about,B. C. D. R. We’re talking more about backup, disaster recovery, the ability to be able to then recover the data again. It could be on Prem, could be in the cloud, depending on your kind of, Disaster recovery plan. and the last bit is the business continuity piece.

Melvyn: So, when we look at business continuity, we’re talking about more of a, concise plan, a disaster recovery plan, shall we say, which is not just backup, not just disaster recovery, but, business continuity, you know, what happens in the event of a disaster. of a disaster. How can, in the event it could be a fire, a flood, data breach that exposes, you know, customer information, could be an insider attack.

Melvyn: so it’s how do people, plan for those in a step by step sort of guide. And yeah, BCDR backup is included in that, but it’s more of kind of a more of a structured approach. This is good to see.

Dan: Really interesting points you raised there. The actual risk or the event that triggers this,and you touched on the couple there in terms of, you know, it could be a bad actor. it could be, it could be a ransomware, it could be a hacker. but, Importantly, and I think the area that’s often forgotten is it could be an internal member of the business, a sa saboteur.

Dan: and,and I guess all of these different risks have, um.have present in different ways. And I guess that’s a different topic. So we’re assuming the bad thing has happened on we and we now need to recover from that bad thing. and I would assume that when we’re talking to an end user customer about this, they’re probably more thinking about. Our business continuity than they are, recovering, an email from three years ago that an ex employee might have tried to try to delete, in a court case or, you know, for whatever reason. so.what’s the typical,how does this present, to the MSP?

Dan: Normally, are they having that, that, business continuity conversation first, or are they having the backup conversation first?

Melvyn: I mean, we, as actually the vendor who provide business continuity specifically around the backup and disaster recovery element, the conversation is typically always, you know, how are you backing up? How are you recovering? whether it be file folders, where would be server snapshots? so that’s typically where it parks with us.

Melvyn: But when it comes to who we, who we partner with, which is the MSPs, IT service providers, the conversation is always steered more around. Okay, so as a responsible business owner, you need to develop a comprehensive disaster recovery plan, a step by step guide that you can use to overcome obstacles that life would put in their way.

Melvyn: So, you know, a disaster recovery plan should include, several key steps, as part of a sound recovery plan. And that’s how MSPs would lead that from the vendors perspective. Perspective, sorry. yeah, it would be typically how do we get them. Functionally to recover from a fire flood, you know, some sort of natural disaster that involves their data being deleted or wiped out, from a production environment.

Dan: and is this a, is this the, well, perhaps you can talk us through the conversation,the sales person, or MSP account manager, customer contact, VCIO. Again, I’m throwing titles out there, but who does have this conversation with the client typically,from the MSPs perspective.

Dan: And I guess importantly, who are they having that conversation with within their end And, client as well, you know, are they sufficiently,senior enough to say, no, we don’t need to protect against, a fire or a flood or a meteor, or a train strike or, you know, whatever the drama is,so, can you perhaps walk us through that, that, that conversation maybe, and what,how a DR plan sort of layers up?

Dan: Thank you.

Melvyn: yeah, sure. Absolutely. So it’s got a four step process really. So, now I worked for many years within the MSP space myself, more on the Integrate aside. so working with kind of systems. but yeah, I mean, we would always have these in depth conversations with business owners, the C suite talking about in the event of a desert, whether it be like you just said, it could be a pandemic could be a natural disaster, something you can actually see physically.

Melvyn: you know, causing a significant disruption physically to a building or somewhere where the business just has to kind of relocate. and the conversations that I used to have would be okay, well, in the event of a, of this type of disaster, how do you risk assess and then how do you, Measure the business impact.

Melvyn: So it’s a B. I. A. So it’s a business impact analysis. So the whole purpose of disaster recovery plan is to help the business survive, right? So the first part of any disaster recovery plan is to have a comprehensive risk assessment on a business impact analysis. So during this part of the process, you’d be looking at all potential risks to your business.

Melvyn: from, you know, failure of a key server or the loss of a critical file to a hacker ransomware attack to a fire, flood and other natural disaster is very comprehensive. You know, something is as simple as a server falling over to a huge, natural disaster. So once these risks have been assessed, you then look at the impact of each event and how that would affect the business.

Melvyn: And, And give them the ability to be able to recover in that sort of scenario. So that’s the first one. So the second one would be more practical. It’s having an inventory hardware and software. So hardware, software, you know, software failures are common. Common disaster for business owner and, you know, comprehensive disaster recovery plan should include a thorough analysis of what you own and what’s being used.

Melvyn: and that, that should be detailed. very key thing. the third would be, an instant response team. So an instant response team is a critical part of any disaster recovery program. So, think about. Who has the necessary skills before you continue to add them into the incident response team, but could be, for instance, members of the IT staff, men and women who have the technical expertise, repair service, troubleshooting software to get your systems back online.

Melvyn: And the team may also include key managers, a group of individuals who. Can communicate with the clients to let them know that they’re there to help them in that disaster. And the last bit, Daniel, sorry, is to, is to keep your disaster recovery plan at the ready. So don’t keep it secret. it’s important that everyone on the incident response teams knows where the disaster recovery plan is, where it’s located and how they can access it in the event of emergency.

Melvyn: And it’s also important to make sure. You have hard copies, not just kept in the cloud or, you know, in someone’s laptop. so that’s what I think from a, business owner MSP level. That’s where the conversation comes from. And then eventually it kind of rolls out, coming back to the vendor. i. e.

Melvyn: someone like Axian and where they would fit in into that process.

Dan: right, yeah, there’s a few things to, to break out there. So I’m glad you went into some of the detail there. going well, let’s work in reverse if we can. the readiness point, great one. I’ve, I’ve seen, Some comical, fictional scenarios where there’s a disaster afoot.

Dan: And, and the first question is, well, where’s the DR plan? And they’re like, it’s on that laptop. What? The laptop, that doesn’t exist anymore. And , oh, what do we do? What do we do now? so prac, practically, where do these plans exist? is this perhaps a level of value that the MSP. So does the MSP become the custodian of that plan, the coordinator and,and maybe even, that drifts us into the third point about having the team.

Melvyn: Absolutely. I think it’s important, isn’t it? So, with the team,it’s all about making sure that those key players, have the expertise, don’t they? whether it be communication skills, repair skills, you know, it’s important just to keep that incident response team updated. and integrated into the human resources and other parts of the business.

Melvyn: So, you know, business administration. So you don’t want to wait for the disaster only to find out that, key members of the team are no longer with the company, right?

Dan: Absolutely. And, and I guess that probably brings us to the. the elephant in the room, when it comes to these sorts of processes, which is,it’s gotta be, it’s gotta be tested. It’s gotta be rehearsed and what’s the right frequency of, of conducting those rehearsals and to what level do you, you actually go to,are we going to on a Wednesday afternoon.

Dan: Pull the plug on everything can fully disrupt our business and, Test how we get a hundred people working on different machines in a different location, you know, that’s surely the only way of actually proving yet today we can make this happen. so, what’s the, is there like a right or wrong answer?

Dan: Is it monthly, quarterly, weekly, annually?

Melvyn: Yeah, I mean, do you know what? I hate to say it, but it

Dan: Okay. Right. Yeah.

Melvyn: and the reason why I say that you start with a statement that you’re going to work backwards, because I mean, again, depends. Industry, SLA, availability, you know, What is critical to financial services might not be as critical to maybe, a shopkeeper.

Melvyn: but still shopkeepers, would still need to make sure their tills are open and they know what would happen in the event that it wouldn’t. So I think it largely does dictate, what the priorities are for the business. Is it a priority to be, not to have a business continuity plan or disaster recovery plan, is it a priority to have uptime?

Melvyn: You know, what’s an acceptable level that you can be down for? Then it starts to roll up from that. if it’s unacceptable to be down for more than, two or four hours, then it’s working into the plan, you know, what do we fit, what do we check, how regularly, it largely comes down to, the business owners, preference of risk averseness really.

Melvyn: I mean, as we know, many businesses that suffer a disaster, they never really reopen. So, you know, what to do when the worst sort of happens could literally be life or death decision for their business. So, it has to be as comprehensive as it should be. So testing frequently, is really down to the strategic partner and the business owner.

Dan: And I guess. Takes us back to that, that very first, part of the puzzle that you, you described the business impact assessment,and in fact, coming to that,I’m imagining that has some numbers associated to it,you know, we’ve worked out what the cost of an event, a situation is, and therefore, We’ve effectively started to build a budget as to therefore what we’d be prepared to spend to not have that impact

Melvyn: Absolutely. You just have to look at the financial figures from any point in time. and then obviously you’d look at your year on year trends and. Then start working out. Well, how much would a week in August cost us? on paper, they’ll be able to work out pretty quickly. That could be 100 grand a week.

Melvyn: And if that’s the case, if you haven’t got a comprehensive disaster recovery strategy in place, it’s open ended as to when that’s going to be fixed. And then you almost forget about fixing it. Well, okay, well, fixing it is a is an unknown.it’s how do we get up and running in the event of that service on fire?

Melvyn: Well, actually, you know, we just we need to be, you know, ready within an hour, so we don’t want it fixed in an hour. We want to be up and running in an hour. The fixed SLA is a completely different kind of fish because when we’re talking about being ready to go and being fixed, that’s in situ. You should be able to fix the problem whilst being in your disaster recovery plan and being.

Melvyn: In production mode, you know,

Dan: we’ve not yet talked about the, well, the sort of key phrases that I always associate with this topic, which is recovery time objective and recovery points objective. So we want to be back up and running operational. in 10 minutesand we want to be, working as though it was 10 minutes ago.

Dan: So, you know, that’s got to be pretty, pretty tight in, in terms of,of,of what your wiggle room is to actually respond and,and restore to. and. And so how do we though? So let’s take the, it’s going to cost us a hundred grand a week if we’re down, the big question there is if, so how much do you spend to defend or mitigate the potential that you might have to spend a hundred thousand?

Dan: is there any, accepted calculation? and again, Well, I won’t say it depends, but you can tell me that if it

Melvyn: I mean, I don’t know. It’s it comes down to, if you look at, I guess, government, you know, government will have a, a mirror replication of their entire environment.you know, in another location now, 99 percent of businesses can’t afford to do that. They just simply just can’t afford to do it. if the pensioner working, pension department for working pensions, systems were to go down, you know, they would have that kind of mirrored somewhere I would imagine.

Melvyn: so a lot of people, it comes down to Again, you know, one of their appetite for risk is and it is impossible for me to give you direct answer. It’s impossible for me to give you a cost or calculation on that, because a lot of this comes down to analysis of what, what the business is subjected to in terms of their level of risk.

Melvyn: If their appetite is low, then they’re going to, Work out based on a week’s calculation. If they spent 50 grand to be ready, then they would have only lost a marginal amount compared to the 100 grand they would lose if they weren’t ready at all.

Dan: Yeah, no,and, it’s an impossible question to, to answer. And, I guess I’m asking it on Adam’s behalf because he normally throws a sort of punchy question in. So, just, just,

Melvyn: Oh, that’s makes it what to answer. I would say, you know, without going through the detailed steps that and the steps that I’ve given are four step process. There are many more that would be included in that. But ultimately, it does come down to assets. Plan detail, making sure that people know how to communicate, keep disaster recovery plan ready.

Melvyn: and yeah, making sure you’ve got a team and ready to be able to have that analysis. And I think it starts off with the risk analysis. So the risk assessment and the business impact. So. Once you’ve done the assessment of what could, I mean, obviously, if you’re in a flood plain, then you’re probably at more risk of a flood than you are of a fire.

Melvyn: But that doesn’t necessarily mean say you’re not at risk of a fire. And if that’s the case, then once you’ve done the risk assessment, what is the impact to the business? Because no matter where that danger comes from, you want to be able to overcome the challenges and come out stronger on the other side.

Melvyn: Thank you. so it’s all about really making sure that, that assessment’s been done. And once you’ve done that, you’ll be able to then be better equipped to be able to put in, steps to make sure that you can get back up, up and running within a time that doesn’t cost you, your

Dan: And, I guess whilst we’re on the topic of cost, great, a great link to,probably the key topic I have on, on this is how we, or how an MSP should, could do,price this,it, it seems to me there’s an awful lot of, Bespoke or cut custom to the to the end user business.

Dan: activity that’s required here. it’s consultancy. so therefore shouldn’t be given away free of charge or not to be recovered. how do you see, MSPs in your, in your estate, approach this, for example, do they have a, sort of an easy to sell, business impact assessment service that, that’s almost like a, Pre sale, lost leader, first sale type in the process to say, well, we do that.

Dan: and then we can design a solution and make that a managed service to include the testing. how does that work?

Melvyn: Yeah, no, absolutely. I mean, it’s going to start off with the, it’s a kind of professional service exercise and it’s always going to be led by a strategic partner. So if you’re, what typically happens is if you’re not a strategic partner, if you’re not the managed service provider, people tend to sort of come in, they ball in with this as a,I guess as a, as a loss lead.

Melvyn: You know, they want to come in and try and. Have a seat at the table to try and understand what the business is doing and they come in with the bold statement of Well, let’s do this business risk assessment work out where the risks are And then we can eventually become your strategic partner and help you implement these plans.

Melvyn: That’s fine. But you know most people business owners They wouldn’t necessarily take that from somebody who sees them as a prospect because they said well, you know nothing about me but now you want to try and assess my entire business, it’s going to come from that strategic partner who is already in there already providing a huge amount of value.

Melvyn: And if they haven’t thought about doing this type of risk assessment before, it will be a case of sitting down with a Key consultant, maybe over a number of days, which obviously would be paid for, and going through that assessment, those steps and then building the report, but then also there would be inventory assessments, and it would be kind of licensing tools that they could use that they could build into those costs.

Melvyn: But it’s more of a to get a really good foothold into. And already very well established account by offering just kind of more value to that client and paid for value. Because once the consultant or maybe the, the customer engagement representative has that conversation says, look, you know, this is the structure we have.

Melvyn: Would you be interested in going through this a bit more detail? I think me as a business owner yourself as well, Daniel, we would sit there and say, well, It’s worth having a look at that. And if it’s going to cost me a couple of grand just to sit down and have a detailed report given to me, it would make a lot of sense.

Melvyn: Because off the back of that, there’s going to be a lot of, project work, that wasn’t there before. it’s all going to be project based work, you know, because we’re having to set up inventory. We’re having to set up, you know, proper, plans that may not have been in place before. Absolutely. I think it’s a very, it’s going to be from a strategic engagement

Melvyn: Okay. And, yeah,I’ll, I’ll quote you on that, a co couple of grand,may, maybe,maybe two, two days, professional services. So something of that order. just to get it started.

Dan: just to do the. The business impact assessment part of it. and effectively that then sets the,

Melvyn: Inventory. Yeah.

Dan: yeah, infantry.

Dan: And I guess most MSPs would have a pretty, pretty good or should have a pretty good understanding of what the estate looks like if they’re managing the complete,so yeah, maybe that’s those two steps, and then. yeah, some kind of, pro provision of whatever the solution is, that’s required.

Dan: And,and then we get into the really interesting part in my mind, which is the recurring,revenue opportunity for this. both in terms of,the technical backup,mechanisms. that’s recurring. The,the testing and,and rehearsal stages.

Dan: and again, that presumably,as is more important to the end user business, we’ll, we’ll dictate how big a rehearsal that is,whether we’re in full costume or whether it’s just a make believe in a room, a tabletop,

Melvyn: No, absolutely. Yeah, exactly. It could be as gradual. So or a small scale as it needs to be a small scale could be just from, you know, an accident perspective. It’s okay. How quickly can we spin up a machine in the event of a disaster? How quickly we get the, the file server, the finance system up and running?

Melvyn: and that could be just a dress rehearsal by the technical team because that may be the only impact or risk that they see. Whereas if you are a call center, I mean, that’s a different kettle of fish, isn’t it? If you’re a call center, that’s, thrown into jeopardy. you may have to do a complete dress rehearsal in a different location, you know, so it’s a very comprehensive or a simplistic approach.

Melvyn: Again, it comes down to that assessment and, you know, what is the requirement and what. What is the outcome of, of that within that,

Dan: Okay, good. So, and then,yeah, I mean, I think we’ve pretty much covered most of the,the items I’d, I’d noted down here. So, and I think this, it sounds like,the overriding message for any of our listeners,is really that if this isn’t something you’re having a conversation with your partner, in end user clients about this is something you should be, because I, it’s a revenue margin opportunity, both project and recurring and,and also if you’re not doing it, then someone else might be coming in and having that conversation, which could.

Dan: Could potentially dis dislodge you, from, from the, from the account. So, so no, it been, been a really interesting, conversation. and this is the time, our regular, regular format to, to offer a shameless plug as a thank you for your time and sharing the knowledge.

Dan: So, yeah, how,how do our listeners get a hold of you if they wanna talk further about this?

Melvyn: Yeah, absolutely. So, Melvyn from Axiom, we’re a backup disaster recovery vendor. We solely work with MSPs, and we do this by providing, chain free business continuity solutions, backup disaster recovery. We give you three terabytes of server storage, port storage and 30 days of disaster recovery time included in the device.

Melvyn: Per device per year, reset every year and it’s exclusively to MSPs. So you can reach me on my mobile 07855 303463 or email mwhite, that’s m w h i t e at axion, a x c i e n t dot com ( mwhite@axcient.com )

Dan: and of course,LinkedIn as well. So we’ll, we’ll include a link to, to, to that in the, in the show notes, so people can get in touch as well. So, yeah, it’s been, been a pleasure talking today. And, yeah, look forward to,to, all those MSPs contacting you and, and talking about how they can, how they can, unlock this, this revenue and margin opportunity. Thank you. Thank you very much.

Melvyn: Thanks so much. I appreciate it. Thank you. Bye now.

Want to chat?