The Four-Hour Promise
An 800-person SaaS company promises customers a four-hour RTO for its tier-1 billing platform. Its current strategy is a cold site six hours away with tape backups; the last test restored in 31 hours and missed two databases. A warm cloud site in a second region would meet the RTO but costs roughly $40,000 per month. A pilot-light approach in the same cloud region costs $12,000 per month but shares the region's failure domain. The board has approved a 15 percent increase in continuity spend, not 300 percent. Sales has begun quoting the four-hour RTO in enterprise contracts.
1. Evaluate the three recovery options against the contractual RTO.
Read the worked answer
- Cold site: a 31-hour measured restore against a 4-hour promise is not a strategy, it is an unsupported commitment. It also failed data completeness - missing databases mean the restore is not merely slow, it is unreliable.
- Warm cross-region cloud: the only option that plausibly meets 4 hours. Cost is roughly $480,000 per year, far beyond a 15 percent increase, so it must be scoped to tier-1 only rather than applied platform-wide.
- Pilot light in the same region: cheap and useful for component failures, but a regional outage is a realistic scenario and this option shares that failure domain. A same-region failover test does not demonstrate disaster recovery capability.
- Practical path: warm cross-region for the billing platform and its data, pilot light or backup-restore for tier-2 systems, and re-price or renegotiate the 4-hour commitment for customers who genuinely require it.
- The decision should be driven by cost of downtime and contract penalties versus recovery spend, not by the cheapest option.
2. What should sales and legal do about the 4-hour RTO already being quoted?
Read the worked answer
- Quote only tested capability. An untested or unachievable RTO in an enterprise contract converts a technical gap into a legal and financial exposure.
- Either fund recovery to match the promise for tier-1, or change contract language: tiered service levels, exclusions for regional disasters, service credits, and a stated basis of measurement.
- Sales needs a short, accurate statement of current capability and the roadmap date for the 4-hour target; ambiguity will be resolved by the customer's lawyers, not favorably.
- Disclose the gap to executive management and the board as a material risk; this is a business decision, not a technical one.
3. What test would prove the chosen strategy before it is relied on in a contract?
Read the worked answer
- A full failover to the alternate region with production-like data, measured end to end, including DNS, identity, third-party integrations, and staff availability - not just server startup.
- Validate transaction processing and data integrity after restore, and measure achieved RTO and RPO against the 4-hour and data-loss targets.
- Run during business hours with customer-facing verification, and include the people who must make the failover decision.
- Document gaps and repeat annually and after major architecture changes.
- A tabletop or a partial component test is not evidence; only a measured recovery demonstrates the capability being sold.