"We are in the cloud, so we are resilient." It is a common belief and a dangerous one. Cloud providers offer the building blocks for resilience, but designing, implementing and testing disaster recovery is still your responsibility.
This guide explains cloud disaster recovery in practical terms.
Cloud providers offer the building blocks for resilience, but designing, implementing and testing disaster recovery is still your responsibility.
What are RTO and RPO?
- Recovery Time Objective (RTO): the maximum acceptable time to restore a service after a disaster. "Checkout must be back within 1 hour."
- Recovery Point Objective (RPO): the maximum acceptable data loss, measured in time. "We can lose at most 5 minutes of orders."
Set RTO and RPO per application, based on business impact, not one number for everything.
RTO and RPO explained
Illustration in progress
What disasters should cloud DR cover?
- Regional or availability zone outages
- Ransomware and malicious deletion
- Accidental deletion or corruption by people or automation
- Failed deployments or migrations
- Compromised accounts
- Third-party or SaaS dependency failures
What are the four main DR strategies?
| Strategy | How it works | Typical RTO | Typical RPO | Relative cost |
|---|---|---|---|---|
| Backup and restore | Back up data; rebuild infrastructure when needed | Hours to a day | Hours | Low |
| Pilot light | Core data replicated; minimal infrastructure ready to scale | Tens of minutes to hours | Minutes | Low–medium |
| Warm standby | Scaled-down full copy always running | Minutes | Seconds to minutes | Medium–high |
| Multi-site active-active | Full capacity in multiple regions | Near zero | Near zero | High |
These strategies are described in AWS's disaster recovery guidance and apply similarly on Azure and Google Cloud.
Cloud DR strategies compared by cost and recovery time
Illustration in progress
How do you choose the right strategy?
- Classify applications into tiers by business impact (for example, Tier 1 revenue-critical, Tier 2 important, Tier 3 internal).
- Set RTO and RPO per tier with business owners.
- Map each tier to a strategy that meets the target at acceptable cost.
- Consider dependencies: identity, DNS, networking and shared databases must also recover.
- Automate recovery with infrastructure as code so environments can be rebuilt reliably.
How do you protect against ransomware?
Traditional replication can copy encrypted or deleted data to your DR site. Add:
- Immutable backups (for example, object lock or vault lock)
- Separate backup accounts with restricted access
- Point-in-time recovery for databases
- Regular restore tests from immutable copies
See our cloud backup strategy guide.
How often should you test DR?
Test at least annually for every tier, and more often for Tier 1 systems. Test types include:
- Tabletop exercises: walk through the runbook as a team
- Component tests: restore a database or rebuild an environment
- Full failover tests: move production to the DR site and back
Measure actual recovery time and data loss against RTO and RPO, and fix gaps.
How Crozaint approaches disaster recovery
Disaster Recovery and Business Continuity is one of the eight disciplines in Crozaint's 24/7 managed services, alongside storage and backup, database services and cloud infrastructure operations. We help classify applications, design DR to meet RTO and RPO targets across AWS, Azure and Google Cloud, automate recovery with tools like Terraform and Ansible, and run regular DR tests.
Because we also operate your environment day to day under ITIL-based processes, DR runbooks stay current as systems change, rather than going stale in a document.
Common mistakes to avoid
- One RTO and RPO for every system
- Replicating ransomware-encrypted data to DR
- Forgetting identity, DNS and network dependencies
- Never testing failover
- DR runbooks that do not match the current architecture
Conclusion
Cloud DR is a business decision implemented with technology. Set RTO and RPO per application, choose a fitting strategy, protect against ransomware and test regularly.
Not sure your DR plan would work today? Book a 30-minute call with Crozaint.
