The 2013 IT Trust Curve study surveyed 3,200 respondents to assess their organizations’ IT maturity levels and ability to withstand and quickly recover from disruptive incidents such as unplanned downtime, security breaches, and data loss. Discover the impact and upside of having high IT Trust maturity, as captured in this overview of the survey results. More via http://www.emc.com/campaign/it-trust-curve/index.htm

1. Conducted by
Vanson Bourne Research
N o v e m b e r
© Copyright 2013 EMC Corporation. All rights reserved.
2 0 1 3
1

2. &
100
IT
DECISIONMAKERS
3200
INTERVIEWS
ALTOGETHER, 1600 IT & 1600
BUSINESS DECISIONMAKERS
COUNTRIES
USA
BRAZIL
FRANCE
ITALY
NORDICS
RUSSIA
SOUTH AFRICA
JAPAN
100
BUSINESS
DECISIONMAKERS
CANADA
UK
GERMANY
SPAIN
BENELUX
INDIA
AUSTRALIA
CHINA
10
50/50 SPLIT
VERTICALS
BETWEEN ORGANIZATIONS WITH
100–1000 EMPLOYEES &
MORE THAN 1000 EMPLOYEES
© Copyright 2013 EMC Corporation. All rights reserved.
2

3. THE FOUR BIG MEGATRENDS IN INFORMATION TECHNOLOGY TODAY
ARE CLOUD COMPUTING, BIG DATA, SOCIAL NETWORKING AND
MOBILE DEVICES. ADOPTION AND MATURITY OF THESE TRENDS
MUST FLOAT UPON A SEA OF TRUST — TRUST THAT MY
INFORMATION IS SECURE IN THE CLOUD, TRUST THAT MY DATA
WON’T BE LOST OR STOLEN, TRUST THAT MY IT WILL BE
OPERATIONAL WHEN IT NEEDS TO BE — WHICH, THESE DAYS, IS
ALL THE TIME. THE MORE TRUST THAT CAN BE EARNED AND
GUARANTEED, THE BIGGER AND FASTER THE IMPACT OF THESE
TRENDS. CONVERSELY, THE LESS TRUST THAT IS ESTABLISHED, THE
MORE LIMITED THESE TRENDS WILL BE.
DAVID GOULDEN
© Copyright 2013 EMC Corporation. All rights reserved.
3

4. OVERALL MATURITY
OVERALL MATURITY DISTRIBUTION
LAGGARDS
70
EVALUATORS
ADOPTERS
LEADERS
36%
8%
NUMBER OF RESPONDENTS
60
50
40
17%
30
40%
20
10
0
0
25
50
75
100
MATURITY SCORE (OUT OF 100)
© Copyright 2013 EMC Corporation. All rights reserved.
4

5. MATURITY PILLARS
OVERALL MATURITY DISTRIBUTION
LAGGARDS
70
EVALUATORS
ADOPTERS
LEADERS
36%
8%
NUMBER OF RESPONDENTS
60
50
40
17%
30
40%
20
10
0
0
25
50
75
100
MATURITY SCORE (OUT OF 100)
© Copyright 2013 EMC Corporation. All rights reserved.
5

6. SCORING
METHODOLOGY
The study focuses on attributes of IT
– information availability, backup, &
security – that contribute most to
the ability to withstand & quickly
recover from disruptive IT incidents.
1,600 IT responses were used to
rank their organizations’ maturity
levels, ranging from lowest to
highest – Laggard, Evaluator,
Adopter, & Leader.
Those organizations with more
progressive strategies & those
using more advanced technology
achieved higher ratings.
© Copyright 2013 EMC Corporation. All rights reserved.
6

7. MATURITY SCORE
BY COUNTRY
CHINA
(OUT OF 100)
China
65.2
USA
61.8
South Africa
60.9
Brazil
53.8
Australia
52.8
Spain
51.6
France
COUNTRY—JUST AHEAD
OF AHEAD OF THE USA
3 OF THE 4 MOST
MATURE COUNTRIES ARE
51.4
UK
BRICS
49.7
Canada
49.5
Benelux
49.5
India
49.4
Italy
49.1
Russia
48.7
Germany
48.4
Nordics
Japan
© Copyright 2013 EMC Corporation. All rights reserved.
IS THE MOST MATURE
43.0
38.8
J A PA N
LAGS AS THE
L E A S T MATURE
7

8. MATURITY SCORE
BY INDUSTRY
(OUT OF 100)
Financial services
54.1
Life sciences
53.9
IT and technology
53.8
Healthcare
51.6
Public sector
51.1
Manf.
51.0
Retail and consumer products
49.8
Energy
49.4
Comms, media and ent.
49.2
Consulting
© Copyright 2013 EMC Corporation. All rights reserved.
IN ADDITION TO IT,
HIGHLY-REGULATED
INDUSTRIES DISPLAY
PROPORTIONALLY
HIGHER LEVELS OF
MATURITY
46.1
8

9. THE CRISIS
Widespread unplanned downtime,
security breaches, & data loss
61%
of respondents’ companies have
suffered at least one of the
following: unplanned downtime
(37%), security breach (23%) or
data loss (29%) in the last 12
months.
© Copyright 2013 EMC Corporation. All rights reserved.
Nearly half—
45%
—of respondents report that their senior
executives are not confident that their
organization has adequate data
protection, security, & IT availability.
9

10. SENIOR EXECUTIVES’ CONFIDENCE IN THEIR
ORGANIZATION’S IT MATURITY
On average, only 55% of respondents
report their senior executives have any
confidence in their data protection,
security, & availability.
This rises significantly with each level
of maturity.
Leaders
81%
Adopters
Evaluators
Laggards
65%
51%
39%
Conversely, 45% cited no confidence.
Do you think your senior executives are confident they
currently have adequate data protection, security, &
availability?
Only showing percentage for “yes, they already are”, by overall
maturity (Asked to all 3200 respondents)
© Copyright 2013 EMC Corporation. All rights reserved.
10

11. SENIOR EXECUTIVES’ CONFIDENCE IN THEIR
ORGANIZATION’S IT MATURITY (COUNTRY)
Germany
Japan—the least mature country—has
the smallest percentage of respondents
reporting that their senior teams have
trust in IT.
66%
France
64%
Benelux
64%
Spain
63%
India
62%
USA
61%
Australia
59%
Canada
58%
China
Interestingly, the BRICS countries are
scattered throughout the centre—
neither leading or lagging in this
regard.
56%
South Africa
55%
UK
54%
Brazil
50%
Italy
49%
Russia
49%
Nordics
Japan
46%
31%
Do you think your senior executives are confident they
currently have adequate data protection, security, &
availability?
Only showing percentage for “yes, they already are”, by
country (Asked to all 3200 respondents)
© Copyright 2013 EMC Corporation. All rights reserved.
11

12. SENIOR EXECUTIVES’ CONFIDENCE IN THEIR
ORGANIZATION’S IT MATURITY (INDUSTRY)
Life sciences, seen previously to be
among the most mature in terms of the
IT Trust Curve, is the vertical least likely
to report their senior teams are confident
in their organization’s IT.
Financial services
59%
IT and technology
58%
Consulting
57%
Retail and consumer…
55%
Manf.
55%
Comms, media and ent.
10% of those in the public sector don’t
think their senior teams will ever have
this confidence (compared to 6% on
average).
57%
Energy
55%
Healthcare
51%
Public sector
50%
Life sciences
48%
Do you think your senior executives are confident they
currently have adequate data protection, security, &
availability?
Only showing percentage for “yes, they already are”, by
vertical (Asked to all 3200 respondents)
© Copyright 2013 EMC Corporation. All rights reserved.
12

13. CONSEQUENCES OF INCIDENTS IN THE LAST
12 MONTHS (COUNTRY)
Of the 61% of organizations who have experienced
either unplanned downtime, a security breach or data
loss at least once in the last 12 months, the top 3
consequences are a loss of employee productivity
(45%), loss of revenue (39%), and loss of customer
confidence/loyalty (32%).
Top consequence in each country:
• Loss of employee productivity: USA (58%), Canada
(58%), Brazil (46%), UK (61%), France (36%),
Nordics (48%), Russia (48%), Benelux (34%),
South Africa (59%), Australia (47%)
• Loss of revenue: China (59%), Spain (46%), Italy
(40%), Germany (40%), Russia (48%), Benelux
(34%)
• Loss of an incremental business opportunity: Japan
(38%)
Loss of employee productivity
45%
Loss of revenue
39%
Loss of customer confidence/loyalty
32%
Loss of an incremental business…
27%
Loss of business to a competitor
27%
Delay in product/ service…
26%
Loss of a new business opportunity
26%
Loss of customers
26%
Damage to company brand and…
23%
Loss of repeat business
20%
Delay in getting products/…
16%
Damage to company stock price… 10%
Other
1%
None of these
4%
• Loss of business to a competitor: India (47%)
What were the consequences of the incident(s) your
organization experienced in the last 12 months?
(Asked to those who have experienced downtime, security
breach(es) and/or data loss in the last 12 months 1956/3200)
© Copyright 2013 EMC Corporation. All rights reserved.
13

14. THE IMPACT
MATURITY MATTERS.
The more advanced
the organization’s
maturity, the less they
suffer when it comes
to data loss,
downtime,
& security breaches.
the
53% of organizations indata highest maturity
segment reported
recovery time
measured in minutes or less for their most missioncritical applications compared with only
across all respondents who reported
data recovery in minutes or less
27%
76%
of companies in the highest maturity
segment believe they are able to recover
100% of their lost data in every instance versus only
in the lowest maturity segment
44%
65%
© Copyright 2013 EMC Corporation. All rights reserved.
Organizations in the lowest maturity segment
(Laggards) lost one and a half times more
money over the last 12 months as a result of
downtime than those in the highest maturity
segment (Leader). Average annual financial loss
from downtime across all respondents is
$494,037.
14

15. THE UPSIDE
“If you had adequate controls
to protect data and breaches
were stopped before impact,
how would your organization
benefit?”
(Asked to respondents who have experienced a
security breach/breaches in the last 12 months
734/3200)
Expedited audits & lower
compliance reporting cost
Lower barrier to information
sharing
Lower cost of investigation &
response
More time for innovation &
analysis
Reduced cost of application
deployment / time to market
© Copyright 2013 EMC Corporation. All rights reserved.
49%
48%
45%
43%
42%
15

16. FACTORS THAT LIMIT
TECHNOLOGICAL PROGRESS
92% of all respondents experience inhibitors to
their technology project success.
China is the only country where budget is not the
main inhibitor. Instead resources and/or workload
constraints tops the list here (50%), followed by
planning and anticipation (46%), knowledge and
skills (44%) and then budget (41%).
A lack of confidence in technology impacts one in
five, & a lack of executive/management support
inhibits one in seven.
52%
Budget
Resources and/or workload
constraints
35%
33%
Planning and anticipation
32%
Knowledge & skills
25%
Culture (flexibility, acceptance)
Lack of trust in technology/IT
Lack of executive/management
support
We have no limits to our technology
project success
19%
14%
8%
What most limits your organization's technology project
success in relation to data protection, security, & availability?
(Asked to all 3200 respondents)
© Copyright 2013 EMC Corporation. All rights reserved.
16

17. DIFFERING VIEWS
Just 50% of BDMs (business decision
makers) consider the IT department to
be a driver of a resilient & secure
infrastructure—compared to 70% of
ITDMs (IT decision makers) themselves.
ITDMs
BDMs
70%
50%
Where is the motivation/drive for future
plans/projects to deliver resilient & secure IT
infrastructure coming from?
Percentage that selected “internal: IT department”, by
respondent type (Asked to all 3200 respondents
© Copyright 2013 EMC Corporation. All rights reserved.
17

18. MATURITY DIVIDENDS
FINANCIAL LOSS AS A RESULT OF DOWNTIME, SECURITY
BREACHES, & DATA LOSS
65%
Organizations in the
lowest maturity
segment
(Laggard)lost
REPORTED AVERAGE ANNUAL
FINANCIAL LOSS PER COMPANY
1.5X
more money over
the last 12 months
as a result of
downtime than
those in the highest
maturity segment
(Leader)
© Copyright 2013 EMC Corporation. All rights reserved.
$494,037
Downtime
$860,273
Security Breaches
$585,892
Data Loss
18

19. MATURITY DIVIDENDS
ONLY AROUND A QUARTER OF SURVEYED ORGANIZATIONS CAN
RECOVERY DATA IN MINUTES OR LESS
OUR RECOVERY TIME IS
25% MEASURED IN MINUTES
During an unexpected event
causing downtime to our
most critical applications.
A quarter of organizations have a recovery time
of minutes for mission-critical applications.
Therefore, 27% of organizations surveyed have
a recovery time of minutes or less for their
mission-critical applications.
(Asked to all 1600 respondents)
66%
OUR RECOVERY TIME IS
MEASURED IN HOURS
*
The most common response given overall
is a recovery time of hours.
2% OUR RECOVERY TIME
IS ZERO
Only 2% of surveyed organizations report a
recovery time of zero for their most critical
applications.
3% OUR RECOVERY TIME IS
1 DAY OR MORE
*Don’t know
© Copyright 2013 EMC Corporation. All rights reserved.
Though a small minority report a recovery
time of a day or more.
19

20. MATURITY DIVIDENDS
BIG DATA ANALYTICS IS MORE LIKELY TO BE DEPLOYED BY
THOSE WITH A HIGHER LEVEL OF TRUST MATURITY
74% of the leaders have already
deployed Big Data analytics compared
to just 8% of the laggards. However,
less mature organizations are more
likely to be in the planning stages.
Leaders
Adopters
Evaluators
Laggards
1%
25%
74%
8%
42%
14%
23%
18%
8%
50%
63%
74%
No plans
Deployment underway or in planning stages
Already deployed
Which of these strategic projects, requiring availability, data
protection, & security do you have?
Looking at Big Data analytics only, by overall maturity (Asked to all
1600 IT respondents)
© Copyright 2013 EMC Corporation. All rights reserved.
20

21. Appendix
© Copyright 2013 EMC Corporation. All rights reserved.
21

22. IT only
Questions used to score Continuous Availability (i)
Within each pillar section, respondents were asked questions that determine their technological maturity,
the three used in Continuous Availability were (max score = 18):
Select which of the following best characterizes your current IT infrastructure:

Backup is the main component of our availability strategy – (2pt.)

Backup and replication are key components of our availability strategy – (2pt.)

Replication and standby servers are key components of our availability strategy – (3pts.)

Replication of virtual servers with restart capabilities are key components of our availability strategy - (4pts.)

Active-active instances of applications across data centers is key component of our availability strategy – (6pts.)
During an unexpected event causing downtime to our most critical applications:

Our recovery time is 1 day or more (please specify) – (2pt.)

Our recovery time is measured in hours – (3pts.)

Our recovery time is measured in minutes – (4pts.)

Our recovery time is zero – (6pts.)

Don’t know – no score
© Copyright 2013 EMC Corporation. All rights reserved.
22

23. Questions used to score Continuous Availability
(ii)
IT only
Within each pillar section, respondents were asked questions that determine their technological maturity,
the three used in Continuous Availability were (max score = 18):
Which technologies/strategies are in place to help you manage/ensure you have trust in the availability of your
applications, systems, and data?

Backup and recovery infrastructure – (2pt.) (or highest scoring selection)

Disk-based backup and recovery – (2pt.) (or highest scoring selection)

WAN-based replication of backup and recovery images to second site – (3pts.) (or highest scoring selection)

Asynchronous transaction-level replication – (2pts.) (or highest scoring selection)

Synchronous transaction-level replication – (3pts.) (or highest scoring selection)

Replication of both applications and data (such as virtual machine images) – (4pts.) (or highest scoring selection)

Replication to a second site with restart capabilities (active/passive) – (4pts.) (or highest scoring selection)

Dynamic mobility of virtual applications between data centers – (6pts.)

Disaster tolerant replication (active/active) with near zero RPO and RTO – (6pts.)
© Copyright 2013 EMC Corporation. All rights reserved.
23

24. Question used to score Advanced security
IT only
Within each pillar section, respondents were asked questions that determine their technological maturity,
the one used in Advanced Security was (max score = 18):
Which technologies/strategies do you have in place to help you trust your infrastructure and data is secure?

Strong authentication - 1pt.

Video surveillance – 0pts.

Governance, risk & compliance software – 2pt.

Anti-virus/anti-malware - 2pts.

Network firewalls/application firewalls/intrusion detection - 1pt.

Log/security monitoring - 1pt.

Identity & access management -1pt.

Encryption/tokenization - 1pt.

Digital forensics – 3pt.

Predictive analytics – 3pt.

Security operations center - 3pts.
© Copyright 2013 EMC Corporation. All rights reserved.
24

25. Questions used to score Integrated Backup and
Recovery (i)
IT only
Within each pillar section, respondents were asked questions that determine their technological maturity,
the two used in Integrated Backup and Recovery were (max score = 18):
Select which of the following best characterizes your current IT infrastructure’s information protection capabilities
to prevent/minimize data loss due to site disasters or technical failures:

Backup is performed departmentally, as opposed to a centralized service, with independent backup tools requiring application downtime - (2pt.)

Multiple, separate application-specific backup tools are deployed across the organization regularly requiring application downtime during the backup process
– (3pt.)

Backup is coordinated with storage features to minimize application downtime for the backup process and disk-based backup has been deployed – (5pts.)

Centralized disk-based backup systems exploit de-duplication efficiencies while providing comprehensive reporting of backup actives and protection status –
(7pts.)

Comprehensive backup solutions include replication of backup images to secondary sites, enable archival storage, and ensure we meet our data retention
and retrieval goals – (9pts.)
© Copyright 2013 EMC Corporation. All rights reserved.
25

26. Questions used to score Integrated Backup and
Recovery (ii)
IT only
Within each pillar section, respondents were asked questions that determine their technological maturity,
the two used in Integrated Backup and Recovery were (max score = 18):
Which technologies/strategies are you currently using to prevent data loss?

Tape-based backup and archive – (2pt.) (or highest scoring selection)

Disk-based backup and archive – (3pt.) (or highest scoring selection)

WAN-based replication of backups – (4pts.) (or highest scoring selection)

Software to assist in eDiscovery projects – (5pts.) (or highest scoring selection)

De-duplication of backup and archive data – (6pts.) (or highest scoring selection)

Consolidated backup and archive infrastructure – (7pts.) (or highest scoring selection)

Integrated backup and archive to meet data retention requirements – (9pts.) (or highest scoring selection)
© Copyright 2013 EMC Corporation. All rights reserved.
26