A major outage has lasted four hours. Engineers disagree about whether to fail over to the disaster recovery site, and nobody knows who can make the decision. What should have been defined in advance to prevent this?

Invoking a disaster recovery plan has significant business consequences: cost, possible data loss back to the last recovery point, operational disruption and later fail-back. For that reason, the plan should define in advance the criteria for declaring a disaster, such as an outage expected to exceed a set duration relative to the recovery time objective, and the roles authorized to make the declaration, with alternates. Clear criteria and authority turn a debate among engineers into a timely decision. The fail-back procedure is needed after the primary site is restored, but it does not help decide whether to fail over in the first place. The service-level agreement with the recovery site provider governs what the provider delivers once invoked; it says nothing about who within the organization decides to invoke. A list of engineers permitted to access the recovery site addresses execution after the decision, not the decision itself. Exam caveat: the authority to declare usually sits with a business or crisis management role, informed by technical assessment, because the decision is a business trade-off. Operational check: confirm the plan states declaration criteria tied to the recovery time objective, names the authorized role and alternate, and that an exercise has practiced the decision.