Hybrid Cloud Backup and Disaster Recovery

KuppingerCole’s Buyer’s Compass is positioned as a practical starting point for selecting cloud backup and disaster recovery solutions in hybrid IT environments, especially in medium to large organizations. It guides readers through identifying primary use cases, weighting functional and non-functional criteria accordingly, rating vendors, asking targeted follow-up questions, and then moving to shortlists, RFIs, and proofs of concept—while ensuring technical and organizational prerequisites are in place. The focus is on aligning products and services to real operational needs rather than attempting to be an exhaustive vendor-selection manual.

The market scope centers on solutions that back up and restore IT service data to the cloud with sufficient metadata (structure and permissions) to meet Recovery Point Objectives (RPOs) and Recovery Time Objectives (RTOs). Service continuity is treated as a core element of confidentiality, integrity, and availability, addressing incidents such as ransomware, corruption, equipment failure, and natural disasters. The text emphasizes that cloud adoption does not automatically eliminate the need for customer-managed backups unless SLAs truly meet business RPO/RTO requirements, and that hybrid delivery increases management complexity—creating demand for consolidated, cross-environment protection.

Top use cases include on-premises/edge protection, IaaS tenant protection (everything above the provider-managed infrastructure), SaaS data protection, hybrid protection spanning delivery models, and disaster recovery with failover and restoration. Selection guidance highlights 20 functional criteria (e.g., immutability, encryption and key control, application-consistent restores, granular restoration, DR workflows, multi-cloud support, virtualization and platform coverage, and compliance controls) plus 10 non-functional criteria (e.g., vendor viability, deployability, geographic jurisdiction, contractual clauses, service cybersecurity, certifications, and vendor-strategy fit). A matrix maps which criteria matter most per use case, complemented by technical prerequisites (architecture, standards, roadmap, skills, specification) and organizational prerequisites (governance, incident response planning, ownership, risk and compliance management).

• The Buyer’s Compass is intended as a starting point to streamline decision-making, not a complete vendor-selection guideline.
• The covered solutions back up and restore IT service data into the cloud for hybrid IT service delivery environments.
• Restoring an exact copy requires metadata such as structure and permissions to meet defined RPOs and RTOs.
• Service continuity is treated as part of the security triad: confidentiality, integrity, and availability.
• Cloud services only remove the need for customer backups when the SLA meets the customer’s RPO/RTO requirements.
• Major cloud providers can store backed-up data across multiple geographic locations for resilience.
• The document lists five top use cases: on-premises protection, IaaS protection, SaaS protection, hybrid protection, and disaster recovery.
• The functional section defines 20 main selection criteria for cloud backup and disaster recovery in hybrid IT.
• The non-functional section defines 10 selection criteria including contractual clauses, cybersecurity of the service, and independent certifications.
• The use-case matrix rates “Basic Backup Capabilities” as High across all five use cases.

• “This document is not a complete guideline for selecting vendors but should provide an excellent starting point to streamline the decision-making process.”
• “Focusing on the most important aspects of products and services offered compared to use cases helps during vendor selection.”
• “Ensuring the continuity of IT services is an essential part of the security triad of confidentiality, integrity, and availability.”
• “There is a temptation to believe that the use of a cloud service removes the need for the customer to take data backups.”
• “This is only true where the SLA (Service Level Agreement) meets the customer's RPO/RTO requirements, and this is not always the case.”
• “This makes it preferable to have a common solution that covers all the different use cases.”
• “Not every aspect is of the same importance for every use case.”
• “Organizations need a plan for managing incidents and this must be prepared and tested in advance of an incident occurring.”
• “Lack of centralized ownership for the continuity of applications and data across different business units and IT environments is the biggest obstacle for having complete visibility and a uniform approach to data protection.”
• “We see many situations that struggle not because of technical weaknesses and wrong products, but because of a lack of organizational maturity.”