Sizing the degraded mode
The badly framed question
"Should the recovery site be identical to production?" The answer is almost always no, and framing it that way doubles the cost for no reason.
The right question is: what capacity is needed to sustain the MBCO?
If the MBCO is "process payments above €100,000", the relevant volume may be 8% of transactions. Recovery must carry 8% of the load, plus margin — not 100%.
The sizing calculation
| Element | How to obtain it |
|---|---|
| Nominal load | Measured in production, at peak |
| Share retained by the MBCO | Business decision from the BIA |
| Catch-up load | Volume accumulated during the disruption, absorbed on top of current flow |
| Operating margin | Typically 30%, because degraded mode is less efficient |
The catch-up load is the most frequently forgotten item. After four hours of disruption, the system must process the normal flow plus the four accumulated hours. Recovery sized at 50% of production takes eight hours to clear four hours of backlog — during which the service remains degraded from the client's viewpoint.
The three dependencies that make failovers fail
Identity. If the directory is unavailable or compromised, nothing authenticates. A directory replicated to the recovery site is necessary; a directory isolated and independently restorable is just as necessary, for the compromise scenario.
Name. Redirecting traffic requires a DNS change. If record lifetime is 24 hours, failover takes 24 hours however fast the infrastructure. Lowering it to 300 seconds before the incident is free; doing it during the incident is useless.
Network. Partner links, allow-lists held by third parties, client certificates: everything declared at a third party points to the primary site's address. An inventory of those declarations, and pre-registration on the recovery side, saves several hours of negotiation mid-crisis.
The complete costing
A credible costing has five items, not one:
- Hardware and software investment;
- Duplicate licences — often 20 to 30% of the total, regularly omitted;
- Hosting, power, network links;
- Upkeep: updates, synchronisation with production;
- Annual testing: team mobilisation, outage window, providers.
Items 4 and 5 represent roughly 25% of total cost over five years. Omitting them produces a budget that will be exceeded in year two — and it is generally upkeep that gets sacrificed.
Key takeaways
- Recovery does not replicate production: it sustains the MBCO
- An accepted 40% capacity beats a theoretical 100%
- Sizing must include the catch-up load