Disaster recovery capabilities directly impact business continuity risk. Understanding DR maturity is essential for acquisitions of mission-critical systems.
Key Metrics
RTO (Recovery Time Objective)
How quickly must systems be restored?
- Critical systems: Minutes to hours
- Important systems: Hours to days
- Standard systems: Days
RPO (Recovery Point Objective)
How much data loss is acceptable?
- Zero RPO: No data loss (synchronous replication)
- Near-zero: Minutes of data (async replication)
- Standard: Hours to days (backup-based)
Assessment Areas
1. Backup Strategy
- Backup frequency and retention
- Backup testing and verification
- Off-site storage
- Encryption at rest
2. Replication
- Database replication setup
- File system replication
- Cross-region capabilities
- Failover automation
3. DR Testing
- Test frequency and scope
- Documented test results
- Identified gaps and remediation
- Team participation
4. DR Documentation
- Recovery procedures
- Contact information
- Dependency documentation
- Communication plans
Key Takeaway: DR capabilities that haven't been tested are theoretical at best. Ask for evidence of successful DR tests, not just plans.