Disaster recovery

A backup you have never restored is not a backup. It is an untested assumption with a storage bill, and the number of organisations that discover this during the disaster is the whole reason this skill exists.

DR is not about having backups. It is about having a rehearsed path from a catastrophic state back to a working one, with known timings.

1. Set the two numbers first

Everything else follows from these, and they must come from the business, not from engineering preference:

• RPO — recovery point objective. How much data can you afford to lose? This sets backup frequency. Hourly backups mean up to an hour of writes gone
• RTO — recovery time objective. How long can you be down? This sets architecture. A four-hour RTO permits restore-from-backup; a five-minute RTO requires a warm standby