Hurricane Sandy Effects – How Far Away Should My Backup Data Center Be?

The basic tenant of  primary and backup data centers is that they both cannot be affected by the same event.  You MUST analyze the locations of the primary and backup data centers along with a sound threat assessment to determine where your backup data centers should be.  In a previous post of mine, we discussed distance requirements between primary and backup data centers. Below is the repost:

However, there was a Federal Reserve Supervisory letter that states, ” Maintain sufficient geographically dispersed resources to meet recovery and resumption objectives. The primary site should as far away from the primary site as necessary to avoid being subject to the same set of risks as the primary location and should not rely on the same infrastructure components. The paper does not specify any specific mileage or staffing requirements for implementing this sound practice, and does not recommend that firms move their primary offices, operating sites, or data centers out of metropolitan locations.”

However, financial clearing organizations are expected to establish back-up facilities a significant distance away from primary sites, even if they find it necessary to establish a tertiary site. Firms that play significant roles can meet this sound practice by establishing sites that are within the current range limit of synchronous data storage technology.

But to my knowledge, there is no regulation that can be enforced.  But here are some basic considerations:

• Your backup site should not be impacted by the same conditions that your primary site would be (e.g., tornadoes, hurricanes, hazardous materials spill, flooding, etc.).  This is critical and must be thoroughly assessed.  Example: A client had backup sites that were 50 and 100 miles away but all sites were in the path of a major hurricane.
• You have to be far enough away to be beyond the immediate threat you are planning for but at the same time, you have to be close enough for it to be practical to get to the alternate site in a timely fashion.
• An interagency white paper by the SEC, Federal Reserve and other agencies that came out after 9/11 suggested a 200-mile plus separation between the primary and secondary facilities but final draft called for a more lenient “geographical dispersal.” That means don’t be in the same weather pattern or fault line or serviced by the same power grid and telecommunications and utility providers.
• Make sure your staff has multiple means of access to the backup site.
• The distance question comes down to “risk versus cost”.  Make sure you don’t take the risk of losing your primary and backup data center just because you are willing to accept the risk.  Example; Insurance company in a high risk tornado area places its backup data center twenty miles away from its primary site.  Both sites use the same infrastructure components.

How Far Away is Enough?

Consider the following in deciding how far away the backup data center should be:

1. Business, legal and regulatory requirements mandating the need for out of region recovery.
2. The level of data protection required and fiber optic distance limits.
3. The topography of the area for vulnerability to natural disasters and malicious physical attack.
4. The logistics and infrastructure to support the movement of people (including work at home options) and resupply goods such as diesel fuel.
5. The nature of facilities options and expense of upgrade.
6. The regulatory requirements/guidance for specific industries for “out of region” recovery.
7. The other options to improve recoverability from a range of threats to business operations.

 Final Thoughts

While the perfect answer for each company will differ according to individual need, there are a few general rules to guide you through the site selection process.

• Consider regional disasters first. If you are in the U.S. Gulf Coast hurricane zones, high-risk terrorist area, or in the California earthquake zones, then you should consider having your backup data center at least 100 or more miles away.  In some cases, you might need to consider a data center on the east coast and one on the west coast.
• If widespread disasters are not at issue, think smaller distances. As an absolute minimum, five to ten miles away should be sufficient to avoid problems if your backup site wouldn’t be impacted by the same event as the primary, is on a separate power grid and infrastructure and can be accessed via multiple routes.   Generally, however, having a recovery center at least 25 to 100 miles away should still be considered a best practice for data center recovery.
• Remember people-issues in DR site planning. For work-area recovery, DR centers typically need to be within 20 to 30 miles of the standard work area. Ideally you should look for a site that has multiple means of transporting the people to the site (e.g., roads, light rail, train, etc.)

In closing, weather related events are becoming bigger and more severe in nature.  Plan accordingly and think of that worst case.