Some companies run their disaster recovery across availability zones. Each AZ is a separate datacenter, so three AZs are three sites. Others maintain a second region, because to them a recovery site belongs somewhere else entirely.
Both camps call it disaster recovery. Both have a point. And DORA, the regulation both camps worry about, does not pick a side.
DORA never mentions availability zones or multi-region. It asks a different question: for each application, how long can you afford to be down, how much data can you afford to lose, and can you prove it? That has a different answer per application. This article shows what each setup actually protects against and what the regulation actually requires, so you can answer it for yours.
The problem
Ask two engineering teams about disaster recovery and you get two confident, opposite answers.
