AWS backup and DR before hurricane season in Puerto Rico
Realistic RPO/RTO, cross-region replicas, and tested runbooks before June–November.
Hurricane season in Puerto Rico — June through November — does not forgive theoretical DR. Companies with workloads in AWS us-east-1 (N. Virginia) assume "in the cloud" means protected; when a storm displaces local operations, they discover single-AZ RDS and S3 without cross-region replication is not continuity planning. The AWS Security Blog emphasizes backup strategy as customer responsibility under the shared responsibility model.
Setting realistic RPO and RTO
Define honest RPO/RTO with business: how many hours of data can a Guaynabo clinic lose? How long can tourism ecommerce stay offline? CISA publishes BCP templates for seasonality — adapt to your sector. S3 cross-region replication (CRR) to us-west-2 or AWS Backup with multi-region copy jobs for RDS and EBS.
Tested runbooks: simulate full restore in sandbox account before June. Include scenario "San Juan office without power, staff remote from Orlando/Miami." Document who executes failover, how to communicate clients, and AWS Support contacts with appropriate support plan.
Hybrid backup with immutable copies
Hybrid on-prem: many Puerto Rico SMBs keep local file server plus AWS. Unified backup with agent uploading to S3 Glacier with Object Lock — local ransomware must not delete cloud copy. NIST SP 800-34 guides applicable contingency planning.
Post-Maria lesson: island connectivity affected for days. Keep runbook accessible offline (PDF on charged laptop, printed contacts). AWS DR for PR is not continental luxury; it is operational survival every Atlantic summer.
Writes about practical cybersecurity for SMBs in Puerto Rico and the Caribbean — no fluff, just what actually needs to get done.
