AUTHOR
Francesco Randisi
Data Protection Specialist
ARTICLE
In Switzerland, where many companies operate with lean IT structures while increasingly relying on digital systems, cloud services and international supply chains, even a few hours of downtime can have significant consequences: disrupted processes, unavailable data, service delays and a loss of customer trust.
Cyberattacks, human error and infrastructure failures are no longer remote possibilities. At the same time, the growing focus on data protection and digital resilience is prompting organisations to rethink their approach to business continuity, also in light of the Swiss regulatory framework and international standards. In this context, disaster recovery can no longer be regarded solely as a technical solution to be activated in an emergency. It is a business-driven strategy that determines which processes should be restored first, how quickly they must be recovered and how much data loss is acceptable.
Today, the question is no longer simply how to protect systems and data, but how quickly the business can resume operations.
Business continuity as a strategic and, in some sectors, regulatory requirement
The ability to ensure service continuity is no longer simply an IT best practice. It has become a central element of corporate risk management.
In Switzerland, data protection legislation, obligations concerning critical infrastructure and provisions applying to regulated sectors are increasing the focus on system security, availability and resilience. These requirements are complemented by international standards, contractual obligations and, for companies belonging to international groups or supply chains, the potential impact of European regulations.
Disaster recovery and business continuity are therefore essential for safeguarding business operations and strengthening reliability and trust among customers, partners and stakeholders.
Recovery metrics must reflect business value
Every effective disaster recovery strategy begins by defining clear and measurable objectives, particularly in terms of recovery times and acceptable data loss. These parameters cannot be established generically or from a purely technical perspective; they must reflect the criticality of individual business processes. Not all systems have the same value to the business, nor do they all require the same levels of availability and protection. Identifying which activities are truly business-critical makes it possible to design appropriate solutions while avoiding both excessive investment and insufficient protection.
A hybrid model can enable greater resilience and flexibility
There is no single infrastructure model suitable for every company. Depending on the criticality of its processes, data protection requirements, performance needs and recovery objectives, a hybrid architecture can provide an effective balance between control, flexibility, compliance and cost.
Integrating on-premises infrastructure, data centres and cloud platforms enables organisations to adopt advanced strategies such as geographical replication, distributed failover and the use of the cloud as a recovery environment. However, the effectiveness of this model depends on the ability to manage and orchestrate the different environments consistently, while avoiding operational complexity, dependencies and new vulnerabilities.
The real value therefore lies not in any single technology, but in designing a resilience strategy aligned with business priorities.
The expert’s perspective
In practice, the difference between a disaster recovery plan that is theoretically sound and one that is genuinely effective lies in its ability to adapt to the company’s specific characteristics and priorities.
There is no single infrastructure model suitable for every organisation. Exclusively on-premises or fully cloud-based approaches may not optimally address every requirement relating to resilience, performance, control and compliance, particularly when heterogeneous systems, workloads with different levels of criticality or specific data protection requirements are involved.
In these scenarios, a hybrid approach can offer greater flexibility by integrating data centres, on-premises infrastructure and cloud platforms within a consistent ecosystem. With this model:
-
the most critical workloads can remain on-premises or within dedicated data centres, ensuring greater control and performance
-
the cloud can be used as a platform for extension, replication and recovery
-
geographical and technological distribution helps reduce the risk of a single point of failure
-
resources and protection levels can be tailored to the criticality of individual business processes
This approach enables the development of more flexible and sustainable disaster recovery strategies capable of addressing both localised failures and more widespread incidents, while maintaining a balance between costs, service levels and recovery times.
However, the effectiveness of this model depends on the ability to manage and orchestrate the different environments correctly. This increased complexity must be addressed through clear responsibilities, documented procedures, continuous monitoring and regular testing of recovery plans. The key lesson is that value does not lie in selecting a single technology or infrastructure model, but in the ability to build a resilience strategy that reflects the priorities of the business.
Effective disaster recovery is therefore not simply a technology solution, but an ongoing process that combines infrastructure, governance, expertise and regular testing to ensure genuine business continuity.
Key takeaways
-
Business continuity is a strategic priority, not merely a technical concern
-
Recovery decisions must be guided by the value and criticality of business processes
-
When aligned with an organisation’s needs, a hybrid model can balance control, performance, cost and resilience
-
The ability to manage and orchestrate different environments determines the true effectiveness of disaster recovery
-
Technology is only one component: governance, clear responsibilities and regular testing make the difference between a plan that exists on paper and one that truly works