A disaster recovery site location is chosen to survive whatever disables your primary site. A good location sits far enough away to avoid shared hazards (common guidance starts at about 100 miles), draws on a different power grid and carrier paths, and stays close enough that staff and replacement hardware can still reach it.
How far should a DR site be from the primary site?
Far enough that one event cannot take out both. Industry guidance suggests at least 100 miles between primary and DR sites, though the right figure depends on your risk profile:
- Natural disasters: hurricanes, earthquakes and floods affect whole regions. The DR site should sit outside the probable impact zone of events that could strike the primary.
- Power grid dependencies: regional grids can fail together. Confirm the sites connect to independent grid sections.
- Weather patterns: seasonal storm paths, flood plains and other recurring weather risks.
More distance is not free. Synchronous replication, which your IT team runs, becomes impractical beyond certain distances because of latency. Staff may need to travel to the site mid-emergency, and large time zone differences complicate coordination. Geographic redundancy and site separation goes deeper on the trade-off.
How do you assess natural hazard risk for a location?
Score every candidate site against public hazard data before you visit it. The core categories are seismic activity, flooding, hurricanes and tornadoes, and wildfire.
For flooding, pull the address from the FEMA Flood Map Service Center and check both the mapped flood zone and historical flood data; a building just outside a mapped zone can still sit on a street that floods. For hurricane exposure, NOAA's tropical cyclone climatology shows where storms have historically tracked and when the season peaks.
Then look at the hazards the primary and DR sites share. Two sites on the same coastline, the same fault system, or the same river basin are not really separated, whatever the mileage says. If an existing site already sits in a risky zone, moving infrastructure out of a flood zone covers that decision.
What infrastructure does a DR site need?
A DR site must support your recovery objectives on its worst day, not its best. Check three areas.
Power: redundant utility feeds from independent substations, generator capacity for extended outages, fuel supply agreements and on-site storage, and uninterruptible power systems so the load rides through the transfer to generator. Fuel contracts matter more than generator size in a regional event (generator fuel for extended outages).
Network: multiple carriers on diverse physical paths, enough bandwidth for your IT team's replication and recovery traffic, low-latency links if synchronous replication is planned, and internet access that does not depend on the primary site.
Physical security: access controls that meet your compliance requirements, environmental alarms and fire protection, secured equipment areas with limited access, and surveillance with intrusion detection.
Verify each item with a site walk, not a data sheet.
What other location risks should you check?
Beyond weather and geology, three kinds of risk decide whether a location holds up over years.
Infrastructure stability: the age and condition of the local power grid, water availability for cooling, transportation access for equipment and people, and the maturity of local telecommunications.
Regulatory environment: data sovereignty requirements that limit where certain data may sit, industry-specific compliance needs, local emergency response capability, and building codes and safety standards.
Access during a regional event: a site that is fine on a normal day may be unreachable when roads close, fuel runs short, or curfews apply. Ask how equipment and crews would physically get in after a storm. Getting equipment into a disaster area describes what that takes in practice.
Weight these by the systems the site will protect. A site holding regulated data has a shorter list of acceptable regions than one holding development environments.
Is the site practical to staff and test?
A DR site must be operable, not just theoretically compliant. During a disaster, people may need to work from it.
Staff access: travel time from where employees live, nearby accommodations, local amenities for extended stays, and transportation options during a regional emergency.
Testing: regular DR testing is essential, but a site that is costly or disruptive to test will be tested less. Evaluate the cost and complexity of a test, the impact on other site operations, and whether you can simulate realistic failure scenarios. Realistic DR testing covers how to make tests reflect the real event.
Vendor and partner access: third parties who support your infrastructure need to reach the site during recovery. Check proximity to technical support resources, the availability of specialized contractors, and how equipment deliveries would actually arrive, including freight access, loading docks and elevators.
Should a DR site be colocation or an owned facility?
Most organizations choose colocation for speed and capital reasons, and owned facilities when control matters more than cost.
| Factor | Colocation | Owned facility |
|---|---|---|
| Capital expenditure | Low | High |
| Time to deploy | Faster | Slower |
| Control over environment | Shared, contract-bound | Complete |
| Customization | Limited by provider | Built to your needs |
| Scalability | Add cabinets or cages | Limited by building |
| Long-term cost | Recurring fees | Potential long-term savings |
| Third-party dependency | Yes | No |
Colocation also brings shared infrastructure expertise from the operator. Some organizations take a hybrid approach: an owned DR facility for critical systems and colocation for less sensitive workloads. Whichever you choose, the decision also sets your recovery tier. The hot, warm and cold site comparison explains how much equipment should be running at the DR site before an event.
What does a DR site really cost?
DR site costs extend well beyond the lease or construction budget.
Direct costs: facility construction or lease payments, equipment procurement and maintenance, connectivity services, and power consumption.
Indirect costs: staff travel for testing and maintenance, training and certification, insurance premiums, and ongoing compliance audits.
Opportunity costs: capital tied up in DR infrastructure, staff time spent maintaining it, and business constraints that come with DR commitments.
Model the total over the planning horizon. A cheap site that is expensive to reach for every test, or short on carrier options, can cost more over time than a pricier site with better access. Include the one-time cost of building the site out: delivering, installing and cabling the equipment. DataTech Logistics handles that physical work as part of a DR site buildout, from receiving and staging to rack and stack.
How do you make the final decision?
Use a weighted evaluation matrix so the choice is explicit and defensible. Score each candidate on:
- Geographic risk profile relative to the primary site
- Infrastructure capabilities and reliability
- Connectivity options and latency characteristics
- Operational practicality and accessibility
- Total cost of ownership over the planning horizon
- Scalability for future requirements
- Compliance with regulatory obligations
Set the weights with the people who own recovery objectives, and tie them to your contingency plan. NIST SP 800-34, the federal contingency planning guide, describes alternate site types and how to document them.
The ideal DR site balances protection against probable risks with practical operability and sustainable cost. Compromising too heavily in any one dimension creates a gap that tends to show up at the worst possible time.