Hot Site 400 Metres Away as a Hurricane Approaches

It is not a recovery site for this threat

A hot site is defined by readiness and geographic separation. The first attribute is present; the second is absent. Same park, same substation, same fiber entrance duct means the two sites share:

• A single electrical supply - one substation fault or one flooded switchgear room de-energizes both. The 72-hour generator fuel is irrelevant if the generators themselves are in the flood zone.
• A single telecommunications path - one duct, one backhoe, one flood.
• A single hazard footprint - wind, storm surge, and road closures affect both equally. Staff cannot reach either site if the access roads are impassable.
• Correlated contract failure - the contract is silent on park-wide events precisely because the vendor's own facility is in the park. The four-hour activation guarantee is not a promise the vendor can keep under this scenario.

Why this gap survived review

Distance was probably chosen to keep the site within a comfortable commute for staff. That is an operational convenience traded against the only property that makes a recovery site useful. A site 400 metres away is an alternate space, not an alternate site; it protects against a fire in one suite and almost nothing else.

What to tell the board

State plainly that for a hurricane the organization currently has no viable alternate site, and that activating the hot site now would move people and equipment into the hazard area while creating a false impression that recovery is handled. The correct interim posture is protection of people and data, plus out-of-region recovery for the systems that can be virtualized. The hot site question is a contract remediation item for the next 90 days, not an activation decision for tonight.

Use forecast triggers, not landfall

Activation is triggered by the forecast, because a 60-hour window disappears quickly once roads close and staff evacuate. Define the trigger explicitly to avoid a debate during the event: for example, declare alert when the forecast cone includes the site at Category 2 or above and landfall is within 48 hours. Here the trigger is already met, but the trigger fires an alert and data-protection phase, not a same-park failover.

Next 60 hours, ordered

1. People (0–6h). Release or relocate the nine evacuating staff and confirm who remains. Nobody should be asked to shelter in a facility in the forecast cone to babysit servers.
2. Data (0–24h). Take a final full backup, then move copies out of the region - cloud object storage with immutability, or physical media couriered to a distant vault today, before couriers stop running. Verify restoration of a sample at the destination; a backup that has never been restored is an assumption. Snapshot key SCADA configuration and billing state.
3. Systems (6–36h). Gracefully shut down or place non-critical systems in a controlled state rather than letting them fail hard. Secure or relocate transportable equipment. Document the as-configured state so rebuild is possible.
4. Continuity (parallel). Pre-agree the degraded-mode operation for water telemetry and billing - manual meter reads, extended payment terms, published customer notices. Notify regulators and key customers on a schedule, not ad hoc.
5. Fuel and facilities (12–48h). Confirm fuel contracts in writing and top off now; a 72-hour reserve with a five-day resupply expectation is a four-day gap, and pumps need power too.

What not to do

Do not activate the same-park hot site as a DR declaration. Doing so consumes the activation budget and staff attention while providing no hazard separation - and it creates a documented claim that recovery was invoked when it demonstrably could not succeed.

Structural changes

1. Impose a minimum separation standard. For any site counted as a recovery location: at least 300 km from the primary, on a different electrical grid and substation, served by a different telecommunications carrier with a physically separate entrance path, outside the same flood zone and watershed, and not forecast to be affected by the same weather system. Write it into the standard as a testable criterion, not an aspiration.

2. Shift Tier-1 recovery to out-of-region cloud or colocation. SCADA telemetry, billing, and customer service do not all need the same treatment: customer service and billing can run from cloud infrastructure outside the hurricane belt, while SCADA needs a hardened, highly available architecture close to the physical plant because latency and local control matter. Buy different mechanisms for different tiers.

3. Rewrite the activation section with event classifications (localized failure versus regional hazard), named triggers, declared decision authority, and a phase model - alert, data protection, relocation, recovery, restoration. "On loss of primary site, activate hot site" is not a procedure; it is a sentence.

4. Contract changes: remove the four-hour activation guarantee or make it explicitly inapplicable when the vendor's own facility is affected; add a correlated-failure disclosure obligation.

Verification

• A tested out-of-region restore of billing and customer service with measured elapsed time.
• A facilitated hurricane tabletop that exercises the trigger, the evacuation decision, and the fuel-resupply gap, with the board participating so decision authority is rehearsed rather than discovered.
• A contract review signed off by procurement confirming the correlated-failure clause exists.

A plan that cannot survive a storm affecting both sites is a plan for a fire in one room.