In today’s always‑on business environment, any disruption – whether a system outage, cyber incident, hardware failure, or natural disaster – can ripple across an organisation in seconds. For companies operating complex ecosystems of applications, platforms, suppliers, and customers across vast geographies, disaster recovery (DR) is no longer a technical afterthought. It’s a core capability that underpins business continuity, customer trust, and long‑term organisational resilience.
At its heart, disaster recovery ensures the timely restoration of technology that s critical business functions, regardless of whether the interruption stems from an emergency event or a large‑scale technology failure. This principle sits at the centre of some project work Millpond has delivered over the years – helping organisations address risks that are too often only taken seriously after something goes wrong.
Disaster Recovery vs. Business Continuity vs. Emergency Management
While these terms are often used interchangeably, we can distinguish them:
- Business continuity focuses on keeping a business operational during a disruption, protecting processes, people, information, and capability.
- Emergency management is about supporting the broader business and customer community during widespread crises.
- Disaster recovery concerns the restoration of technology platforms and applications – an independent but closely related function requiring rapid action and technical precision.
This distinction is echoed in the Microsoft Azure Well‑Architected Framework, which emphasises that disaster recovery plans must be structured, tested, and aligned with business‑level recovery objectives.
Why Recovery Time and Recovery Point Objectives Matter
Two metrics dominate modern disaster recovery planning:
- Recovery Time Objective (RTO): The time it takes to recover or failover an application to a disaster recovery environment and make it available to the business again.
- Recovery Point Objective (RPO): The maximum acceptable data loss measured in time.
- Maximum Tolerable Downtime (MTD): The maximum acceptable downtime before business impact becomes critical.
These aren’t just technical parameters, they are strategic decisions.
While global averages are high, the Australasian picture is even more sobering:
- High impact outages can cost ANZ organisations million per hour
- Nearly one third of ANZ organisations report hourly outage costs of US$1–3 million.
- Australian organisations lose an average of AU$7,011 per minute during customer facing digital incidents.
Cybersecurity: Why operational resilience has shifted from the IT desk to the boardroom
These numbers illustrate why right‑sizing RTOs and RPOs is not optional—it’s an economic imperative.
Industry evidence shows that downtime costs Australian organisations an estimated AU$86 billion annually, including lost revenue, recovery work, regulatory penalties, and reputational damage, [interactive.com.au], and unplanned downtime from cyber and system outages costs New Zealand businesses up to NZ$75 billion annually. [splunk.com]
Beyond the above, RTO is just one part of a broader Maximum Tolerable Downtime (MTD) window, which also includes investigation, decision making, testing, and release processes. Mapping these timelines upfront helps set realistic expectations and clarifies investment needs.‑making, testing, and release processes. Mapping these timelines upfront helps set realistic expectations and clarifies investment needs.
A Structured Approach: A Discovery Model used at a recent client engagement
The below discovery framework reflects an industry leading approach to DR readiness. It includes:
- Comprehensive cataloguing of applications and processes
- Business impact analysis and recovery threshold identification
- Alignment of recovery priorities with different market groups
- Technical interviews to understand support models and recovery timeframes
- Review of existing DR documentation
- Evidence based gap analysis‑based gap analysis
This mirrors the rigorous methodologies recommended by global resilience experts. For example, Forbes’ business continuity planning guidance stresses the importance of impact analysis, executive alignment, documentation, training, and regular testing. [forbes.com]
Beyond Backups: High Availability vs. True Disaster Recovery
We need to distinguish between:
- High Availability (HA): Real‑time replication to minimise downtime
- Disaster Recovery (DR): Restoring systems and data from backups
This is a critical difference: HA reduces the likelihood of a failure being noticed, while DR ensures the business can recover when the worst does happen.
In Australia and New Zealand, organisations are experiencing:
- Major cyber related outages such as the 2024 CrowdStrike incident, which alone is estimated to have cost the Australian economy up to AU$1 billion.
- Broad operational shutdowns—from retail to banking—due to IT outages with economists estimating national losses in the billions of dollars.
- Weekly high business impact outages for 25% of ANZ organisations.
High availability alone can’t mitigate these risks; robust DR preparedness must sit alongside it. This ensures companies still have access to their data if their production environments are compromised.
A Mindset shift and the Cost of Getting It Wrong
…or the Value of Getting It Right
Disaster recovery often loses in the budget conversation because, when it’s done well, nothing “happens” – no visible win, no new revenue line, just quiet continuity. That mindset is risky.
We’re aware of a New Zealand-wide organisation that, only months before the Canterbury earthquakes of 2010 and 2011, senior leaders declined a proposal to improve resilience in their IT infrastructure. The result was prolonged operational disruption across the country for months afterwards.
In another case, one of our clients managed to avoid any major impact from natural events for years, largely through good fortune rather than DR-ready design and validation. They deferred meaningful improvements because the work didn’t feel tangible or value-generating.
The statistics are sobering, however.
Recent regional research paints a stark picture:
Annual economic cost
- Australia: Downtime costs organisations AU$86 billion annually.
- New Zealand: Unplanned downtime carries a national cost of NZ$75 billion.
Why Downtime Has Become A Major Cybersecurity Threat in ANZ – SMBtech
Operational impact
- Average outage duration in Australia is 109.6 minutes, with 7.4 days required for full operational recovery.
- Only 9% of ANZ organisations recover from ransomware within 24 hours, despite most believing they could.
The true cost of data centre downtime in Australia: Why smart hands act as Insurance | Interactive Australia
Business disruption
- Manufacturing outages can cost AU$260,000 per hour.
- Data centre outages can reach $9,000 per minute.
Calculating the cost of downtime | Atlassian
Human and organisational toll
- 38% of Australian organisations report staff burnout tied to outages.
Cybersecurity Index reveals dangerous employee disconnect - 30% report share price impacts after customer‑facing outages.
Australian firms face $24 million yearly hit from IT outages
These figures show that the cost of failure reaches far beyond revenue—it affects reputation, workforce wellbeing, regulatory exposure, and long term competitiveness.
DR is like cyber security or insurance: it’s an investment in staying in business. Under-investing doesn’t save money, it concentrates risk, and when disruption hits, the cost shows up rapidly as lost revenue, customer impact, and damaged trust. The goal is balance: deliberate choices about risk and reward, backed by clear recovery objectives and tested plans.
Building a Culture of Preparedness
As technology evolves, so do our growing reliance on ERP, loyalty, POS, supply chain and many more systems and platforms, demonstrating the broader trend: technology modernisation and disaster recovery readiness must go hand in hand to support growth, agility, and market responsiveness.
We want to emphasise disaster recovery must be:
- Defined early
- Documented clearly
- Tested thoroughly before go live of new systems/applications
- Continually improved
With organisations across Australasia facing increasing operational, environmental, and cyber risks, adopting this mindset is essential.
Final Thoughts
Australasian organisations face some of the highest outage costs and fastest growing operational risks in the world.
Disaster recovery is no longer just a technical safeguard; it’s a strategic investment in resilience. By following a structured, evidence-based approach like the above, organisations can move from reactive firefighting to proactive resilience, protecting not just systems but the people, customers, and communities they serve.
Not quite what you’re looking for?
Other blogs
of interest
