What does an hour of downtime cost?

Two safety nets

A backup is a copy of your data from a point in the past. In the event of a major failure, that copy must be restored. This means systems have to be rebuilt, checked, and applications restarted. That takes time, which is fine.

With disaster recovery, the environment is continuously replicated to a second location where the necessary compute, storage, and network capacity is reserved in advance. Nothing needs to be restored because the environment is simply started up at the second location. This is a matter of minutes per VM.

Data loss also differs between backup and disaster recovery. While a nightly backup could mean losing up to a day's worth of data, replication involves only seconds to minutes of data loss.

Why do you need both?

The short answer: disaster recovery covers outages, while a backup covers encrypted and corrupted data. A replicated environment (disaster recovery) follows production in seconds, meaning it will also replicate data if it is encrypted by ransomware. Therefore, disaster recovery—and specifically its recovery points—is only a solution for production failures. In the event of a hack or ransomware, this is not enough. An immutable (WORM) backup, potentially on isolated (air-gapped) storage with a longer retention period, is the safety net you need if the replica is also compromised.

Calculating the cost of downtime

Determining how to set this up is a calculation: the cost of an hour of downtime multiplied by the number of hours recovery takes. This includes revenue loss, employee labor costs, and the costs of the recovery process itself. If an hour of downtime costs 5,000 euros and an environment takes 8 hours to restore, the bill is 40,000 euros.

Recovery takes longer as more data needs to be restored. And data grows in every company. If your data doubles, your recovery costs rise to 80,000 euros. Unfortunately, the amount of time you can afford to be without your systems does not grow with it. Quite the opposite.

Disaster recovery costs more than a backup because capacity is reserved continuously. You should therefore deploy it where an hour of downtime is most expensive: mission-critical systems get disaster recovery, while the rest get a backup. This allows you to weigh the annual costs of disaster recovery against the cost of a potential outage.

Complying with NIS2 and preparing for the worst

NIS2 explicitly mentions business continuity, backup management, and disaster recovery as required measures. What you need to be able to demonstrate is that you know which systems are critical, that recovery is configured for them, and that it has been tested. That is exactly what you need if things go wrong despite your best efforts: which systems come back online first, who decides that, and what is the maximum duration this will take?

Periodically testing your failover with formal reporting makes it visible to auditors while providing peace of mind when it matters most. Contact us and let’s calculate which of your systems and workloads require disaster recovery and which can be managed with a backup solution.