Tolga Aktaş The disaster recovery site for your data center must be 50 miles away from the primary site. No, make that 100 miles… or is it 200 miles? Or perhaps kilometers? Well, none of this is correct – the truth is, there is no one-size-fits-all answer to this question.
Advantages of having disaster recovery sites:
- Continuity of your business is ensured without any or minimal damage.
- The risk of data loss is eliminated.
- Costs incurred as a result of any disaster are reduced.
- Because your business systems is still running at the disaster recovery site, you may have an advantage over your competitors whose businesses are interrupted or stopped.
- Access to systems and information continues at the desired level during a disaster
What is a disaster recovery site?
For every company, being unable to provide services for any reason creates serious problems. This extraordinary situation may occur in the form of simple interruptions in your systems or general power outages, as well as natural disasters such as earthquakes, floods, and much larger disasters such as fire. Interruptions in your IT processes can cause serious losses of reputation and customers. Companies have disaster recovery sites to avoid these risks and continue their operations without any (or minimal) stoppage.
A disaster recovery site is a place where a company can temporarily move to after a security breach or natural disaster. This way, a company can continue operations until it becomes safe to resume work at its usual location or a new location. A disaster recovery site can be a physical place where you have offices and critical equipment required for your business. Or, if your business gives you the opportunity to do remote work, you can have a disaster recovery site in the cloud, where you keep your applications and data.
Disaster recovery site – Why it matters
Disaster recovery sites provide organizations with necessary protection from various interruptions. This protection goes beyond just your technical assets. Having dedicated disaster recovery sites provide a sense of reassurance to the organization’s employees, customers, and stakeholders. The goal of having a disaster recovery site is eliminating the possibility of downtime and continuing business operations until they can move back to the primary location. Therefore, a disaster recover site should have the capacity for everything the business might require for their critical activities and services.
Regulations and standards
Let’s continue with an example here – in 2002 and 2003, U.S. federal regulators had planned to require financial institutions to move their disaster recovery centers 200 or 300 miles away from primary sites. However, this initiative had failed not only because the banks have strongly opposed such regulation, but also because it has proved to be quite unfeasible.
The situation in the majority of other countries is similar. Of course, I’m not familiar with every regulation in the world, but from those I read, I didn’t find any with a precise definition. (If I’m wrong, feel free to add such regulations in the comments below.) Most of the regulations that deal with this matter do, however, say there must be a disaster recovery site at a “safe distance.”
Regarding standards, the situation is similar – neither ISO 22301 (new international business continuity standard), nor BS 25999-2 (its predecessor), or any of the standards from NIST SP 800 or ISO 27k series are precise about it.
Risk assessment
So, the decision is obviously left to the companies themselves – and such decisions cannot be made based on someone’s feeling, but on a study. In this case, a study is called “risk assessment,” and its purpose is to take into account all the relevant factors.
Here are the factors that tend to push the location further away:
- Earthquakes – if your location is in a seismic-sensitive area
- Floods – you should position an alternative site out of the same flood plain
- Tsunamis – you shouldn’t place both primary and secondary location on the coast of an ocean
- Other natural disasters – e.g. forest fires, tornados/hurricanes, volcanos – if your primary site is close to such areas, the disaster recovery site should be further away
- Large industrial facilities, nuclear power plants, or military installations – again, at least one of your locations should be at a safe distance
- Dependence on the same source of electrical power – you should look for locations on a different power grid
- Even if your risk assessment proves none of the above are applicable to you, take into account risks like pandemic diseases – in such cases, authorities will likely close the whole metropolitan area
However, there are some factors that force you to position a disaster recovery location as close as possible:
- Telecommunication links – the further the sites are away, the more difficult it becomes (i.e. more costly) to replicate the data between these sites
If your employees are expected to travel to an alternative site in case of disaster – they have to be able to make it within the RTO (Recovery Time Objective); besides, the road between the sites shouldn’t be full of bridges and tunnels.
Main problems – small countries and small budgets
From the position of United States (or for that matter, Canada), the distance of few hundred miles is never a problem; imagine now you are a company in a European country with the geographical size of the Los Angeles metropolitan area, and the population of one city block in L.A. In such situations, the obvious solution would be to position a disaster recovery site in a neighboring country with compatible laws and regulations.
The main problem is usually the cost – building such a site and maintaining it costs far more than just an ordinary office building. This is why you could rent such a space for your alternative data center site from companies specialized in disaster recovery services. Or, there is a cloud computing option, but this is a completely different story…
To conclude, to mitigate most of the risks I would suggest you place a disaster recovery location somewhere between 30 miles (50 kilometers) and 100 miles (160 kilometers) away from your primary location. But again, please do your risk assessment first.
Click here to see a template of Business Continuity Strategy that will help you with making decisions about disaster recovery locations (commercially sold template).
