Choosing a data recovery site is difficult because there are no clear standards in this area. The closest we get to a standard is a white paper released by the Federal Reserve in response to Sept. 11.
Early versions of this white paper discussed minimum distances of approximately 200 miles, but were sharply criticized for being technically impossible for some systems due to latency and the replication demands. The paper settled on "an appropriate level of geographic diversity between primary and backup sites for back-office operations and data centers." That's not a lot of help for those of us who have been tasked with this responsibility.
How does one determine "an appropriate level of geographic diversity?" A relatively close site allows for you to have tighter synchronization and leverage your current staff and offsite backup services.
However, a geographic disaster such as a hurricane could take out both primary and recovery sites. But sites too far away can create replication issues for some systems, require a different workforce and could end up costing a great deal.
There is not a one-size-fits-all solution or magic formula that will allow you to plug in your problems and give you a magic distance for your alternative data center. I recommend the following guide to your data center strategy:
- Evaluate
- Document
- Present
To illustrate this framework above, let's take an example of a company that is trying to decide how close they should place their alternative site.
Evaluate
Disaster recovery (DR) planning can derail quickly. Before this company can begin looking at suitable distances/locations, it must establish a focus on the business needs.
The individual tasked with the ultimate assignment must gather the key personnel at the company and decide what is most important when. They must answer questions like what needs to be available within 12 hours of a disaster and what can wait two weeks.
Also, they must evaluate what type of disaster they are going to plan for -- what's the worst-case disaster. The goal here is to determine what information is critical to your business and what can wait and how foolproof your solution will be.
For example, you may decide that a regional data center 200 miles away will meet the majority of your business needs, but there are x number of critical systems that need to have a higher fault tolerance. For those applications, the alternative data center must be in a separate region of the country. Alternatively, the business may decided that they can't afford the expense (personnel, etc.) that comes with a data center across the country and are willing to take on the business risks with an alternative data center 50 miles away.
Once an acceptable distance is determined, you can focus on an environmental risk analysis by evaluating potential data center locations. By comparing the environmental risks, you can reduce the likelihood that two data centers would be affected by the same or related event. The following questions will help guide you in assessing environmental risks:
- What natural disasters is this location susceptible to (e.g., flood plain, fault line, frequency of tornados/hurricanes, etc.)? Do any of the proposed locations share the same risk?
- What is the availability of technical resources for staffing needs at each location? Will a regional event likely affect resource availability in both locations (e.g., hurricane Katrina had a severe impact on people availability in the entire region)?
- How close are support resources? For example:
- Access to replacement parts (via airport, supplier, etc.)
- Access to offsite backup media (If location is a cold or warm site, how are you going to get the media to restore from?)
- Access to alternative power sources (locations differ on power grid resources, fuel supplied by more than one source pipelines, etc.)
While the questions above are not all encompassing, they will help identify shared risk between data centers and avoid a careless oversight that could have a devastating impact.
Document
Now that you have the business needs, you can begin to plan the "how." I recommend using a matrix to map the business systems to current or proposed recovery options followed by documenting cost versus benefit.
The beauty of a matrix is that it forces you to keep a focus on the scope and how IT solutions, such as a secondary recovery site, align with business objectives. The following example illustrates how to bring together the information:
| Recovery Criticality |
Area |
Systems |
Primary location |
Secondary location |
Cost vs. benefit |
| Extreme |
Customer portal |
Web/DB Server |
Data center 1
Atlanta
|
Data center 2
Denver, CO
(1,400 mi from primary)
|
Regional disasters will be mitigated, but total cost will be higher due to personnel requirements |
| Medium |
Data operations |
Quality assurance systems |
Data center 1
Atlanta
|
Data center 3
Chattanooga, TN (116 miles from primary)
|
Both data centers would be affected by a regional emergency, but costs will be lower since personnel can travel and offsite backups can be quickly accessed from both data centers |
These facts will help answer fundamental questions like -- does a regional secondary site really address the business needs, or is the proposed solution overkill? It also establishes a clear understanding around what is gained/lost with the proposed positioning of an alternative site.
Present
Who makes the final decision on where to place the second site? Most likely it will be the executive management team or possibly the board of directors. They will have to either fund the work or accept the business risks that have been documented. When it comes down to business continuity and DR, it is a balance between business risk and cost. IT is responsible for making sure management has the facts to make an educated decision.
About this author: Russell Olsen is an IT professional with a solid business foundation. He has a wide range of experience including CIO, VP of Product Development, VP of Operations, and Senior Auditor for a Big Four accounting firm performing technology risk assessments and Sarbanes-Oxley audits. Russell is a CISA, GSNA, and MCP.
Do you have comments on this tip? Let us know. Please let others know how useful this tip was via the rating scale below.
Do you know a helpful storage tip, timesaver or workaround? Email the editors to talk about writing for SearchDisasterRecovery.com.
