The case for SaaS data backup and ownership

Government offices have been exploring cloud migration for some time, but the pandemic accelerated the move. A recent study on FedRAMP adoption found 56% of federal government offices now use some cloud-based solutions and systems, while 49% of state/local governments have most of their systems and solutions in the cloud.

While software-as-a-service applications enable tremendous efficiencies and cost savings, they also come with some risk when it comes to data protection and privacy. Federal agencies must follow the Federal Data Strategy framework, two of its key focuses areas being: “Governing, Managing, and Protecting Data” and “Promoting Efficient and Appropriate Data Use.” Similarly, many states have enacted, or are currently enacting, data privacy laws.

To help adhere to these policies, agencies must examine whether the data they gather and store is at risk of exposure. Backing up SaaS data can help them meet data governance and privacy regulations.

SaaS data backup misperceptions

The vast majority of organizations backup their on-premise application data. They know how crippling it could be if the data they rely upon to run their missions and perform their services is lost or corrupted.

That’s not the case with SaaS application data. According to an ESG study, 33% of IT professionals believe SaaS-based applications don’t need to be backed up, with 37% relying solely on the SaaS vendor to back up the data. However, just because a vendor is keeping an agency’s SaaS app running, doesn’t mean it’s protecting the data.

Many SaaS vendors operate under a shared responsibility model. They’re obligated to protect the application itself, but they’re not responsible for safeguarding the data housed inside of it. That’s the users’ responsibility. Often it’s only after a service failure or end-users unwittingly change or delete data that organizations realize critical data is gone and can’t be recovered.

Where and how to backup SaaS data

Where data is backed up and stored is critical to how vulnerable it is. Some organizations use backup vendors to help protect their SaaS app data. This, however, can cause complications because that data typically resides in the backup vendor’s infrastructure under that vendor’s control.

Forty-five percent of federal and 52% of state and local offices are already storing citizen and mission data in the cloud, according to the FedRAMP study. One key way they can mitigate data risk, improve control over data access and enhance compliance is by backing up SaaS app data directly into their own Amazon Web Services or Microsoft Azure cloud storage environment – instead of the SaaS app or backup vendors’ infrastructure. When it’s in an environment agencies own, they have more control over it.

When backing up data into an agency’s own cloud data lake, it’s important to capture it at high frequencies. By capturing the many changes made to the historical data, agencies get insurance needed for continuity and data recovery.

It’s also important to capture information about who made those changes. This includes not only who the people are, but also where they were located, their IP address, the device they used to access data, and so on. This is key for maintaining a digital chain of custody for data and enabling traceability and auditing.

An added benefit of backing up data into an agency’s own cloud environment is cost. SaaS vendors are contracting with the same cloud infrastructure providers as agencies. This means agencies are paying a premium to SaaS vendors to store their data with a vendor they already have an agreement with. Backing up -- and archiving -- data into their own environment often reduces those costs by up to 50%.

Beyond insurance: Backup for strategic gain

The data that government offices generate in SaaS applications has value beyond the applications themselves. Government employees and contractors often need to tap into that historical data for other analytical purposes and use cases.

Many organizations use application programming interfaces to provide direct access to that data so users can copy it in other systems and applications. However, not only are APIs time-consuming to maintain, but when too many users use them, agencies hit their API limits and have to pay SaaS vendors more for continued access. The SaaS app’s performance also takes a hit.

Equally important, many agencies don’t even know how many copies of data are made or where they reside. This quickly becomes a security and data management nightmare -- and can result in violation of data privacy regulations, such as the right to be forgotten.

However, by centralizing backed-up SaaS data in a cloud data lake that they own, agencies can create pools of data for authorized users. IT teams can then use cloud-native tools that plug into the lake, automatically streaming data into applications and systems that can be tracked.

Backing up SaaS data is extremely important. By capturing data at high frequencies in a cloud data lake they own, federal, local and state governments can better protect their data while maximizing the value they get from it.