Disaster recovery is all about preparing for incidents that hinder or completely shut down a company's operations. These can be high-profile disasters such as floods, fires or terrorist attacks, but also minor accidents that don't appear on TV such as burst pipes, cable fires, infection by ransomware or simply unintentional deletion of data. 

Such disasters result in buildings, machines and IT equipment being damaged and unusable. But they also affect companies indirectly: for example, when power, water or communication facilities fail, or employees cannot show up for work because their means of transportation are unavailable. Even a few days of business interruption cause companies to lose customers. They threaten the very existence of the company. 

The goal of disaster recovery is to ensure operations despite unpredictable events and to minimize any negative impact on a company or organization. To do this, management creates a disaster recovery plan that outlines how emergency teams will be assembled and servers, networks, phone systems or data storage will be restored after a disaster. 

Preparing for potential disasters is not only smart, but often a prerequisite for doing business: That's because disaster recovery is often a requirement for companies that provide IT services. For example, many customers require an ISO 27001 certification for disaster recovery from their service providers.

The Disaster Recovery Plan provides measures, procedures and guidelines on how to react in the event of a failure in order to minimize the impact on the company. Its goal is to keep IT system downtime to a minimum in the event of an emergency so that the company can resume operations as quickly as possible. Therefore, it lists step by step the measures that the IT emergency team should implement in the event of a disaster. It also defines information channels, escalation levels and responsibilities.

In simple terms, the two parameters RTO (Recovery Time Objective) and RPO (Recovery Point Objective) show a company how long its operations may be interrupted and how much data it can lose without suffering significant damage.

The RTO is the time between the occurrence of an incident and the resumption of operations. The time period can range from a few seconds to several days or weeks. The RPO, on the other hand, defines how old the data of the most recent backup may be. The key figure thus describes the maximum amount of data loss that can be tolerated by the company.

RPO and RTO are crucial elements of a DR plan because they define its goals in concrete key figures. Companies must define them separately for each IT system.

The terms disaster recovery (DR) and business continuity (BC) are often used as synonyms. Both are about restoring business operations as quickly and as close to normal operations as possible in the event of a disaster. Often, the same team in an organization is involved with both BC and DR.

However, BC is broader because it is concerned not only with the recovery of IT services, but with the stability of all critical operations. It generally refers to the processes and procedures an organization must implement to ensure that mission-critical functions can continue during and after an incident. A DR plan, on the other hand, focuses on technical systems and includes specific steps an organization takes to resume IT operations after an incident.

Even if a company operates a highly available disaster recovery site in addition to its production systems, events affecting entire regions can cause both systems to fail if they are set up too close together. For example, this could be flooding or severe weather, damage to power lines, or incidents at chemical plants or nuclear power stations that lead to the evacuation of entire regions.

In December 2018, the German Federal Office for Information Security (BSI) therefore set out requirements for the locations of redundant data centers in its “Criteria for the siting of highly available and geo-redundant data centers“. Accordingly, these must be at least 200 kilometers apart.

Operators of critical infrastructures (Kritis) – such as waterworks or electricity suppliers – are bound by these requirements.The office also recommends georedundancy for emergency preparedness to authorities and companies with high or very high availability requirements. Numerous industry associations also recommend that their members comply with the BSI's recommendations. The Open Telekom Cloud enables users with their sites in Germany and the Netherlands to fulfill these requirements with ready-made services that are easy to implement.

To keep their IT-systems running after unforeseen events, companies usually build a disaster recovery site. This is a complete copy of a data center at a location remote from the original, which takes over its functions in the event of an emergency. As such, it incurs the same costs as the original for staff, rent, hardware, building protection, electricity and insurance. In addition, a skilled IT team must maintain and service the additional site, which is a challenge for many companies in these times of skills shortages. This is often beyond the capabilities of small and medium-sized businesses. 

Disaster recovery in the cloud offers a solution here: It allows companies to store data as a backup with a cloud provider such as Open Telekom Cloud and restore it in an emergency. The cloud can completely take over the function of a classic disaster recovery site with the help of virtual servers. This has many advantages: 

• Users only pay for the resources they actually use on a pay-as-you-go basis.
• Since users rent the cloud resources, they set up a disaster recovery solution without a high initial investment.
• Providing resources from the cloud relieves your IT from maintaining redundant systems.
• Deutsche Telekom offers a higher level of security in its state-of-the-art data centers than is possible for most companies themselves.
• You can distribute your disaster recovery systems across geographically distant locations with little effort.