Limits of intra-site redundancy

A redundant architecture, N+1 or dual-path 2N power, duplicated cooling, multiple generators, protects against the failure of a component inside one building. It does not protect against an event that affects the entire site: fire, flood, natural disaster or total loss of utility power. An operator can therefore hold a high Tier certification, a mark of resilience to component failures, and still be exposed to a total loss if the entire building is compromised. The peril makes no distinction between primary systems and backups co-located in the same place. Outside a small circle of specialized engineers, the distinction is often poorly understood. It explains why a site rated very highly on everyday operational availability can still suffer a total loss in a major disaster. Insurers therefore have to assess resilience to routine failures, which Tier classification captures well, separately from resilience to catastrophic losses. That second kind depends entirely on whether a recovery architecture exists on a geographically distinct site.