Choosing a DR pattern
There are five common ways to set up disaster recovery. They differ in how much data you can lose, how quickly you come back, and how much you pay to keep the DR site ready. Most organisations end up using two or three of them at once, one for each tier of applications.
The five patterns side by side
| Pattern | What is ready at the DR site | Typical RPO | Typical RTO | Relative cost | Usually fits |
|---|---|---|---|---|---|
| Backup & restore | Backup copies only. Servers are rebuilt after the disaster. | Hours (time since last backup) | Hours to days | Low | Internal tools, archives, dev and test |
| Pilot light | Data is replicated. Core services such as the database and directory run small. Application servers are off. | Minutes | A few hours | Low to medium | Business systems that can be down for half a day |
| Warm standby | The full stack runs at reduced size and is scaled up on failover. | Seconds to minutes | Under an hour to a few hours | Medium to high | ERP, hospital systems, customer portals |
| Active-passive | A full-size copy is ready to take over. | Near zero (synchronous) to minutes (asynchronous) | Minutes | High | Core banking, payments, billing |
| Active-active | Both sites serve users at the same time. | Near zero | Near zero for users | Very high, plus application changes | Services built for two sites from day one |
These are typical ranges. Your real numbers depend on the replication method, data volume, distance between sites, and how well the runbook has been rehearsed.
Each pattern in detail
Every pattern has its own page with an interactive disaster simulation, a reference architecture, a failover runbook and the tools typically used.
Backup and restore
Only backup copies at DR. Servers are rebuilt after the disaster.
See how it works → Pattern 2 · cost 2 of 5Pilot light
Data and a small database run at DR. Servers start from templates.
See how it works → Pattern 3 · cost 3 of 5Warm standby
The full stack runs at DR at reduced size and is scaled up on failover.
See how it works → Pattern 4 · cost 4 of 5Active-passive
A full-size synchronised copy takes over within minutes.
See how it works → Pattern 5 · cost 5 of 5Active-active
Both sites serve users. Losing one is close to invisible.
See how it works →Four questions to pick the right one
- What does one hour of downtime cost? Lost revenue, penalties, patient safety, citizen services. If nobody can put a number or a consequence on it, it probably does not need the expensive patterns.
- How much recent data can be re-entered by hand? If staff can re-key the last 30 minutes from paper or email, an asynchronous pattern is usually enough.
- Does a regulator or contract set the number? Banks, insurers, market intermediaries and many government systems have business continuity requirements written down. Start from those.
- Can the application be changed? If not, active-active is usually off the table, and active-passive or warm standby is the realistic ceiling.
Most organisations land on three tiers: active-passive or warm standby for a handful of critical systems, pilot light for important business applications, and backup and restore for everything else. The hospital group use case shows what that looks like in practice.
Not sure where your DR stands?
Send us your application list and a short note on how backups work today. We will come back with a plain gap review: which systems are exposed, what a realistic recovery time looks like, and what it would take to close the gap.