DR Drills and Game Days

1. A Failover Path That Has Never Run Does Not Work

This is stated as a certainty rather than a probability, and the reason is that a failover path is not one mechanism. It is a long chain of permissions, images, secrets, capacity, routing and human steps, every link of which can rot independently while nothing fails.

A recovery plan is defined by the date of its last successful drill, not by the document.

The failure is also the worst-timed one available