DCTR-08

Is the service hosted in a high-availability environment?

Explanation

This question is asking whether your service is hosted in an environment designed to minimize downtime and service disruptions. A high-availability (HA) environment includes redundant components, systems, and infrastructure to ensure continuous operation even when individual components fail. Why it's asked in security assessments: 1. Service reliability is a key aspect of security - availability is one of the three pillars of the CIA triad (Confidentiality, Integrity, Availability) 2. Assessors want to understand your resilience against outages that could impact customers 3. High-availability environments typically include redundancy that protects against both hardware failures and regional disasters 4. Downtime can lead to security risks if recovery processes aren't properly secured To best answer this question: - Describe your specific high-availability architecture (e.g., redundant servers, load balancers, multi-zone or multi-region deployment) - Mention any uptime guarantees or SLAs you provide - Include details about how you handle failover between components - Note any automated monitoring and recovery systems - If you use a cloud provider, specify which of their HA features you utilize

Example Responses

Example Response 1

Yes, our service is hosted in a high-availability environment We utilize AWS's infrastructure across multiple Availability Zones (AZs) in the US-East-1 and US-West-2 regions Our application tier uses auto-scaling groups that span multiple AZs with a minimum of three instances running at all times Database services use Amazon RDS with Multi-AZ deployments for automatic failover We employ Elastic Load Balancers to distribute traffic and handle instance failures Our architecture is designed to maintain 99.99% uptime, with automated monitoring through CloudWatch and automated recovery procedures for common failure scenarios We conduct regular disaster recovery testing to ensure our HA capabilities function as expected.

Example Response 2

Yes, our service operates in a high-availability environment using Microsoft Azure We deploy across paired Azure regions (East US and West US) with active-active configuration Our infrastructure includes redundant application servers in availability sets, Azure Traffic Manager for global load balancing, and Azure SQL Database with geo-replication All critical components have N+1 redundancy at minimum We use Azure Site Recovery for automated failover and Azure Monitor for continuous health checks Our environment is designed to withstand single-component failures and entire regional outages with minimal service disruption We contractually guarantee 99.95% uptime in our customer SLAs and have maintained 99.99% actual availability over the past 12 months.

Example Response 3

No, our service is not currently hosted in a high-availability environment We operate from a single data center with daily backups to an offsite location While we use redundant power supplies and RAID storage configurations for our servers, we do not have automatic failover capabilities or multi-region deployment In the event of hardware failure, our operations team would need to manually restore service, potentially resulting in several hours of downtime We recognize this as a limitation in our infrastructure and have a roadmap to implement high-availability features over the next 12 months, including deploying to multiple availability zones in Google Cloud Platform and implementing automated failover procedures.

Context

Tab
Infrastructure
Category
Datacenter

ResponseHub is the product I wish I had when I was a CTO

Previously I was co-founder and CTO of Progression, a VC backed HR-tech startup used by some of the biggest names in tech.

As our sales grew, security questionnaires quickly became one of my biggest pain-points. They were confusing, hard to delegate and arrived like London busses - 3 at a time!

I'm building ResponseHub so that other teams don't have to go through this. Leave the security questionnaires to us so you can get back to closing deals, shipping product and building your team.

Signature
Neil Cameron
Founder, ResponseHub
Neil Cameron