A recovery time you have measured, not estimated.
Failover engineered against a stated recovery time objective, with runbooks that work under pressure and rehearsals that prove the number.
Why recovery takes longer than anyone expects
Recovery time is almost always underestimated, because the estimate covers restoring the data and not the twenty other things: DNS, certificates, dependencies, the licence that is tied to a MAC address, and the person who knows the sequence being on leave. The only reliable estimate is a rehearsed one.
- The recovery time objective is a number in a document that nobody has tested.
- Recovery depends on one or two people knowing the sequence by memory.
- The dependency order between systems has never been mapped.
- A failover has never been rehearsed on production-equivalent infrastructure.
What we build
A recovery capability sized to the business impact of downtime — replication, automated failover where it is warranted, dependency-ordered runbooks, and a rehearsal that produces a measured recovery time.
- A recovery time objective per service, derived from business impact
- A dependency map establishing the order things must come back in
- Replication or standby infrastructure proportionate to each objective
- Runbooks written to be followed under pressure by someone who is not the author
- Failover automation where the objective justifies the complexity
- A rehearsal producing a measured recovery time and a gap list
How it runs
The rehearsal is the deliverable. Everything before it is preparation for measuring.
- 01Establish impact
What an hour of downtime costs each service, in revenue, obligation or risk. That sets what recovery investment is proportionate.
- 02Map dependencies
What must be running before what. Recovery in the wrong order is a common reason rehearsals overrun.
- 03Build the capability
Replication, standby capacity or rebuild automation, chosen per service against its objective rather than uniformly.
- 04Write usable runbooks
Step by step, with the assumption that the person following them is stressed and it is the middle of the night.
- 05Rehearse and measure
An actual failover, timed. The measured number replaces the estimate, and the gaps found become work.
What changes once it is running
What a rehearsed recovery capability changes.
The number is real
Recovery time is measured from a rehearsal rather than estimated in a planning document.
Recovery stops depending on individuals
Runbooks mean the person on call can execute it, not only the person who built it.
Investment is proportionate
Critical services get the expensive capability; the rest get what their impact justifies.
Gaps surface in a rehearsal
The expired certificate and the undocumented dependency are found on a Tuesday afternoon rather than during an incident.
How an engagement is shaped
Impact analysis first, because it decides what is worth spending.
Impact and dependency analysis
Two to three weeks establishing objectives per service and mapping dependencies. Frequently reveals that a system everyone treated as critical is not, and vice versa.
Build and document
Recovery capability implemented to the agreed objectives, with runbooks written for the person who will actually use them.
Rehearse and maintain
A measured rehearsal, then periodic re-rehearsal as the estate changes — because it will drift.
Common questions
The things buyers ask before they commit. If yours is not here, it is a good first question for the assessment.
- How much does a recovery capability cost?
- It scales with how fast you need to be back. Minutes is expensive; a working day is comparatively cheap. Setting the objective from business impact rather than ambition is what keeps the cost proportionate.
- Can we rehearse without disrupting production?
- Usually yes — failover into an isolated environment proves most of the sequence. A full production failover is a bigger commitment and worth doing occasionally for genuinely critical services.
- What if our estate is part cloud, part on-premises?
- That is the common case. The dependency map matters more in a hybrid estate, because cross-boundary dependencies are exactly the ones that get missed.
What is your recovery time, and who measured it?
If the number came from a document rather than a rehearsal, it is an estimate. We can turn it into a measurement.