Choosing a disaster recovery site: distance, hosting, and network paths

Reference article · 5 min read

Most disaster recovery planning starts with a list of systems and an argument about recovery time objectives. The site decision comes later, under budget pressure, and gets made on whichever option is closest or cheapest. That order is backwards. Where the second copy of your environment sits determines what failures you can actually recover from, how long recovery takes, and who has to be physically present at an inconvenient hour.

Judge a candidate site by the events it protects against and by the exposure it shares with the primary. A second facility that fails for the same reason as the first is not a recovery site.

Separation is about shared hazards, not mileage

Distance is a proxy for something more specific: the chance that one event reaches both locations. Two buildings a long drive apart can share a seismic zone, a storm track, or a substation. Walk through each shared dependency deliberately.

Geologic and hydrologic. Same fault zone, same river basin, same coastal surge or evacuation zone, same wildfire interface.
Power. Same utility, same transmission path, or the same regional grid operator. Ask which substation feeds each site, not just for the utility name.
Fibre and carrier. Same conduit, same bridge or rail crossing, same carrier hotel. Two carriers frequently lease strands in one sheath.
Government and staffing. Same emergency declaration, same road closures, same people. If your team can reach the alternate site on a normal commute, the event that closes the primary probably closes those roads too.

Short drive time helps with hardware swaps and signals shared exposure at the same time. Many agencies accept distance and buy remote hands.

The four realistic hosting options

Another agency facility. You control physical access and the capital is already spent. The common failure is that the second building sits on the same utility feed, the same fibre path, and the same network core, and was built as office space rather than for generator runtime and cooling load.
Regional colocation. You buy power density, cooling, carrier choice, and staffed security. Examine the remote hands terms closely: response commitments, escort rules, who may open your cage, and whether after hours work carries a slower response.
A partner jurisdiction under a joint agreement. Reciprocal arrangements between neighboring counties, cities, or districts are often cheap in cash and demanding in governance. The agreement has to state who may touch equipment, what happens when both parties declare at once, how costs and records custody are handled, and how either side exits.
A second cloud region. Nobody racks anything and capacity is available on demand. Region selection is still a geography decision, replication and egress carry real cost, and the identity and management plane can be a shared dependency. Confirm you can authenticate, reach runbooks, and rebuild without anything that exists only in the primary region.

Network paths decide more than the building does

Circuit diversity. Ask each carrier for documented route diversity, including building entrance points and shared conduit. Diversity that cannot be shown on a path map is an assumption.
Replication bandwidth. Size the link on daily change rate and the largest expected burst, not on total stored data, and plan how the initial seed gets there.
Latency and replication mode. Synchronous replication is limited by distance, because every write waits for the far side. Asynchronous replication buys distance at the cost of a measurable recovery point.
Out of band management. A separate path to consoles and power controllers, independent of the production circuit, keeps a bad night from becoming a site visit.

Addressing, DNS, and how failover actually happens

Decide early whether recovered systems keep their addresses or get renumbered. Keeping them usually means provider independent address space announced from both sites, with the routing coordination that implies. Renumbering is cheaper to arrange and more expensive to execute, because hardcoded addresses hide in firewall rules, interface configurations, mobile data terminals, and vendor integrations. Inventory those while it is still a spreadsheet exercise rather than an outage.

For name resolution, confirm that authoritative nameservers are themselves diverse, that time to live values are lowered before an event rather than during one, and that more than one named person can change records and reach the registrar account. Check what else is pinned to the primary site: certificates, licence keys tied to hardware identifiers, and partner allowlists.

Public safety and regulated data constraints

Criminal justice information carries requirements under the FBI's CJIS Security Policy covering matters such as encryption, personnel screening, and physical and logical access, and those requirements follow the data to the alternate site and to any contractor who can reach it. Next generation 911 systems, ESInet connections, and alternate PSAP arrangements are generally governed by the state 911 authority and the state plan, which may constrain where call handling and dispatch can fail over. Health, tax, and student records carry their own rules. These frameworks are revised periodically, so confirm current requirements with your state CJIS Systems Agency, your state 911 authority, and agency counsel before committing.

What to ask and what to require

Ask for the substation, the carrier entrance paths, and the flood and seismic designations for the specific address, not the metro area.
Ask who performs physical work after hours, how they are reached, and who authorizes them.
Require a documented failback path. Returning to the primary site is often harder than leaving it.
Put a live exercise in the contract or joint agreement, including full failover of one production workload, with a written result and corrective actions.
Require notice before the provider changes carriers, subcontractors, or facility operators, and the right to terminate and retrieve data in a usable format.

HQT works with state and local agencies on infrastructure and continuity planning, including alternate site evaluation, network path review, and recovery testing.

Frequently asked questions

How far away should a disaster recovery site be from the primary data center?

There is no universal mileage figure that fits every agency. The practical test is whether a single event, such as a flood, storm, earthquake, wildfire, or utility failure, can plausibly reach both locations, which depends on local hazard maps, the power grid, and fibre routes rather than distance alone. Some regulators, insurers, and state policies impose their own separation expectations, so confirm those before you set a target.

Is a second cloud region enough for disaster recovery?

It can be, provided you treat the second region as a real site and not as an assumption. Verify that identity, key management, backups, runbooks, and administrative access do not depend on anything that exists only in the primary region, and measure what replication and egress actually cost at your data volumes. Then test a rebuild in the second region rather than relying on the provider's regional independence claims.

Can two counties use each other's facilities as disaster recovery sites?

Reciprocal arrangements between neighboring jurisdictions are common and can be inexpensive, but they need a written agreement rather than a handshake. The agreement should cover physical and logical access, what happens when both parties declare an event simultaneously, cost allocation, handling and custody of records, security responsibilities, and how either side terminates. Have counsel review it, especially where public records, criminal justice data, or health data are involved.

What network questions matter most when selecting a disaster recovery site?

Ask for documented circuit route diversity including building entrance points, since two carriers often share conduit. Size replication bandwidth on daily change rate and peak burst rather than total stored data, and decide which systems need synchronous replication, which is distance limited, versus asynchronous replication. Also settle how addresses and DNS will move during failover, and make sure out of band management does not ride the production circuit.

Does CJIS policy restrict where criminal justice data can be replicated?

The FBI's CJIS Security Policy sets requirements for protecting criminal justice information, including encryption, personnel screening, access control, and auditing, and those obligations apply wherever the data is stored or processed, including an alternate site and any contractor with access. The policy is updated periodically and state agencies may add their own conditions. Confirm current requirements with your state CJIS Systems Agency before selecting a site or provider.