## 8.14 Redundancy of information processing facilities

| Control type | Information security properties | Cybersecurity concepts | Operational capabilities      | Security domains        |
| ------------ | ------------------------------- | ---------------------- | ----------------------------- | ----------------------- |
| #Preventive  | #Availability                   | #Protect               | #Continuity #Asset_management | #Protection #Resilience |

**Control**
Information processing facilities should be implemented with redundancy sufficient to meet availability requirements.

**Purpose**
To ensure the continuous operation of information processing facilities.

**Guidance**
The organization should identify requirements for the availability of business services and information systems. The organization should design and implement systems architecture with appropriate redundancy to meet these requirements.

Redundancy can be introduced by duplicating information processing facilities in part or in their entirety (i.e. spare components or having two of everything). The organization should plan and implement procedures for the activation of the redundant components and processing facilities. The procedures should establish if the redundant components and processing activities are always activated, or in case of emergency, automatically or manually activated. The redundant components and information processing facilities should ensure the same security level as the primary ones.

Mechanisms should be in place to alert the organization to any failure in the information processing facilities, enable executing the planned procedure and allow continued availability while the information processing facilities are repaired or replaced.

The organization should consider the following when implementing redundant systems:

a\) contracting with two or more suppliers of network and critical information processing facilities such as internet service providers;
b\) using redundant networks;
c\) using two geographically separate data centres with mirrored systems;
d\) using physically redundant power supplies or sources;
e\) using multiple parallel instances of software components, with automatic load balancing between them (between instances in the same data centre or in different data centres);
f\) having duplicated components in systems (e.g. CPU, hard disks, memories) or in networks (e.g. firewalls, routers, switches).

Where applicable, preferably in production mode, redundant information systems should be tested to ensure the failover from one component to another component works as intended.

**Other information**
There is a strong relationship between redundancy and ICT readiness for business continuity (see 5.30) especially if short recovery times are required. Many of the redundancy measures can be part of the ICT continuity strategies and solutions.

The implementation of redundancies can introduce risks to the integrity (e.g. processes of copying data to duplicated components can introduce errors) or confidentiality (e.g. weak security control of duplicated components can lead to compromise) of information and information systems, which need to be considered when designing information systems.

Redundancy in information processing facilities does not usually address application unavailability due to faults within an application.

With the use of public cloud computing, it is possible to have multiple live versions of information processing facilities, existing in multiple separate physical locations with automatic failover and load balancing between them.

Some of the technologies and techniques for providing redundancy and automatic fail-over in the context of cloud services are discussed in ISO/IEC TS 23167.
