Cybersecurity Domain 5

Disaster Recovery (DR) & Business Continuity

Ensuring zero data loss, immutable backups, RTO/RPO targets, high availability, and rapid multi-region failover.

1. Fundamentals of Business Continuity & DR

Disaster Recovery (DR) is the tactical subset of Business Continuity Planning (BCP) focused on restoring IT infrastructure, systems, networks, and data storage after a catastrophic failure, ransomware attack, or physical disaster.

2. Core Metrics: RTO, RPO & MTD

[Normal Operation] ------ (Disaster Strikes) ------ [Restoration Complete]
                             |<-------- RTO -------->|
                 |<-- RPO -->|                       |<-- WRT -->|
                 |<------------------ MTD ---------------------->|

- RPO (Recovery Point Objective): Max acceptable data loss time window (e.g. 15 mins).
- RTO (Recovery Time Objective): Max acceptable system restoration downtime (e.g. 2 hours).
- MTD (Maximum Tolerable Downtime): Max duration before business viability is fatally compromised.
      

3. The Modern 3-2-1-1-0 Backup Rule

3 Copies of Data: Maintain 1 primary production dataset and 2 separate backup copies.
2 Different Media Types: Store backups on distinct storage technologies (e.g., NVMe SAN + Cloud Object Storage).
1 Offsite Copy: Keep at least 1 backup at a physically separate geographic location.
1 Immutable Air-Gapped Copy: Store 1 copy in write-once-read-many (WORM) immutable storage (e.g., AWS S3 Object Lock) to prevent ransomware encryption.
0 Errors: Validate all backups via automated restore drills with zero verification errors.

4. Recovery Site Topologies

Hot Site (RTO ~ 0)

Fully redundant, real-time mirrored data center operating active-active or active-passive with automatic DNS failover.

Warm Site (RTO ~ Hours)

Infrastructure pre-configured with hardware and network links, requiring database backup restoration before going live.

Cold Site (RTO ~ Days)

Physical space with power and cooling, but no pre-installed hardware or loaded data.

Cloud DRaaS

On-demand cloud infrastructure provisioning via Terraform / CloudFormation upon disaster declaration.