A county’s HA program documents only application failover. Database failover is assumed to ‘just work’ and has never been tested. What operating practice should architects enforce?

A county HA program that documents only application failover while assuming database failover just works leaves a critical gap. Architects should maintain separate application and database failover runbooks and test both on a schedule so each tier's ownership, timing, and validation steps are proven. Merging app and database failover into one untested checklist executed only during real outages maximizes confusion under stress. Documenting application failover only and treating the database as out of scope for HA drills ignores where state lives. Relying solely on vendor marketing slides instead of runbooks or game days is not an operating practice. Exam caveat: database failover may change endpoints or replicas—applications need reconnect logic covered in the joint exercise. Operational check: run a scheduled DB failover drill with the app team on the bridge, execute both runbooks, validate reads/writes, and record actual RTO per tier. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.