The summary.
A PASSIVE NODE THAT HAS NEVER SERVED MAY NOT WORK WHEN NEEDED
Test failover deliberately, under load, repeatedly. Two-node clusters need a third arbitrator, or split-brain is inevitable.
REPLICATION IS NOT A BACKUP
Deletion and corruption replicate immediately. Keep copies on more than one medium, one elsewhere, and one offline or immutable so ransomware cannot reach them.
DEFINE HOW LONG YOU CAN BE DOWN AND HOW MUCH DATA YOU CAN LOSE
Those two figures drive every technical decision and every cost. Choose the cheapest option that meets them.
MEASURE HOW LONG A RESTORE ACTUALLY TAKES
That figure is your real recovery time, whatever the plan claims. And test restoring a single file — it is the commonest real request.
New systems are routinely added without being added to backup.
KEEP MONITORING AND THE RECOVERY PLAN OUTSIDE YOUR OWN INFRASTRUCTURE
An outage otherwise takes both with it.
Monitor business outcomes too — every technical check can pass while nothing useful is happening.
MOST INCIDENTS FOLLOW A CHANGE
Ask what changed, revert first and investigate second, and separate the person diagnosing from the person communicating.
