Skip to content
Knowledge Hub/Article
Article

What Is DRaaS? How Disaster Recovery as a Service Works

We explain how DRaaS works, its types, its effect on RPO and RTO, how it differs from BaaS and a recovery site, and what to ask a provider.

Oğuzhan Gerçek··10 min read
What Is DRaaS? How Disaster Recovery as a Service Works

Short answer: DRaaS (disaster recovery as a service) is a disaster recovery model in which servers and data are replicated to a provider's infrastructure and, when disaster strikes, the systems run there. In normal operation the target side holds just enough resources to keep replication going; in a disaster, servers are launched from a recovery point (failover), and once the problem is fixed, operations move back to the primary site (failback). BaaS protects only the data; because DRaaS also keeps servers ready, recovery can be measured in minutes. When choosing a provider, the deciding factors are where the data lives, bandwidth, test reports, the failback plan and a clean copy that ransomware cannot reach.

What is DRaaS?

In IBM's definition, DRaaS is a third-party solution that delivers data protection and disaster recovery capabilities on demand, over the internet and on a pay-as-you-go basis; it replicates and hosts both physical and virtual servers. According to Google Cloud, it is also the provider that implements the DR plan during a crisis.

Under the contingency planning guide of the US National Institute of Standards and Technology (SP 800-34 Rev. 1), an alternate site can be owned and operated by the organization itself or be a commercial site used under contract; DRaaS can be seen as the second option consumed as a service. You will find a short definition in our glossary, and the types of recovery sites in our disaster recovery article.

How does DRaaS work?

The service has three parts:

  1. Replication: In AWS Elastic Disaster Recovery, an agent on the source server copies the blocks written to disk, as soon as they are written, into a staging area in the target account. Azure Site Recovery replicates Azure and VMware virtual machines continuously and Hyper-V machines as often as every 30 seconds; with Veeam, a service provider can offer continuous data protection (CDP) alongside snapshot-based replication.
  2. A target on standby: According to AWS, the staging area keeps replication going with affordable storage and minimal compute, and you pay for fully provisioned servers only during drills and recovery.
  3. Recovery points: Servers can be launched from their most up-to-date state or from an earlier point in time. As of October 2026, AWS keeps daily recovery points for 7 days by default, and that period can be extended to 365 days.

Failover, failback and runbooks

In a multi-tier application, start-up order matters: in Microsoft's example, the SQL back end starts first, then the middleware, and finally the web front end. A recovery plan groups machines; steps are automated with runbooks or scripts, and manual actions are inserted for whatever cannot be automated. According to Microsoft, automation reduces RTO, and its Well-Architected guidance also asks you to capture post-failover tasks such as DNS updates and traffic routing.

During failback, data is replicated in the reverse direction. In Azure Site Recovery, failing back to the original machine sends only the changes; if the original machine no longer exists, you fail back to an alternate location and all of the data is copied again.

Isolated testing: the DR drill

According to Microsoft, a test failover affects neither ongoing replication nor production, and the test should run in a network isolated from the production recovery network. The test network also needs a copy of Active Directory and its own DNS settings. In AWS, a drill does not stop replication.

Because apps and their dependencies change frequently, Microsoft recommends a test failover for each app every quarter. For high-impact systems, NIST SP 800-34 calls for a full-scale exercise that includes a failover to the alternate location, and the results of each exercise are documented in an after-action report. We set out the test steps in our disaster recovery testing article.

How DRaaS affects RPO and RTO

In NIST's definitions, the RPO is the point in time to which data must be recovered after an outage, and the RTO is the overall length of time an information system's components can be in the recovery phase before the organization's mission or business processes suffer. According to AWS, the RPO of Elastic Disaster Recovery is typically sub-second, while its RTO is measured in minutes and depends heavily on operating system boot time. IBM notes that BaaS deployments measure RPO and RTO in hours and days, whereas DRaaS brings them down to minutes, sometimes seconds.

These are typical figures. Your own targets are derived from business cost (see how to calculate RPO and RTO), and only a drill shows whether they hold.

Types of DRaaS: self-service, assisted and managed

IBM describes three types, depending on how much the provider takes on:

  • Self-service: The provider supplies the tools and resources, and the organization builds and runs its own plan; this suits technically advanced organizations with in-house IT teams.
  • Assisted: The provider helps build, test and refine the plan; this suits organizations that want to balance control with strong outside support.
  • Managed: Development and implementation of the plan pass entirely to the provider; according to IBM, this is often the most expensive type as well.

Whatever the type, who declares a disaster must be written down: NIST wants the agreement to define the circumstances that constitute a disaster and the notification procedures.

DRaaS vs BaaS vs your own recovery site

  • BaaS (backup as a service): According to IBM, BaaS protects only data, while DRaaS protects the infrastructure too; since you do not pay for replication software and compute, BaaS costs significantly less (see our BaaS article).
  • Your own disaster recovery site: The facility is yours, and Google Cloud describes a second physical data center as costly to build and maintain.
  • DRaaS: The second site belongs to the provider; according to IBM, because it is in another physical location, it is far less likely to be hit by the same incident that threatens the organization.

We discuss the choice between building your own disaster recovery site and using DRaaS in our enterprise disaster recovery strategy article.

Questions to ask a DRaaS provider

The items NIST SP 800-34 lists for an alternate site agreement, combined with the questions the cloud adds, come down to the following:

  1. Where does the data live? The country and facility holding the replicas and recovery points should be in writing. NIST wants the alternate site in an area unlikely to be affected by the same hazard as the primary site, and according to Google Cloud, compliance regulations apply to the recovered environment too. If the copy sits outside Türkiye, we cover the transfer conditions under the KVKK (Türkiye's personal data protection law) in a separate article.
  2. Is the bandwidth sufficient? According to AWS, the link must exceed the combined write throughput of all servers replicating over the same path; AWS recommends at least 20% headroom and measuring write speed for at least 24 hours.
  3. How often are tests run, and who produces the report? NIST wants test scheduling and duration written into the agreement; the report should show the measured RPO and RTO and the steps that failed.
  4. How will failback work? The link, the duration and the sign-off for the return should be written down as clearly as those for failover.
  5. Is there a clean copy? According to CISA, many ransomware variants try to find and then delete or encrypt any backups they can reach. Microsoft recommends requiring an out-of-band step such as MFA before online backups can be modified and, for the strongest protection, keeping them in immutable storage or fully offline. Choosing the right recovery point is covered in our ransomware recovery playbook.
  6. Who shares the capacity, and how do you exit? NIST's list includes other clients subscribing to the same resources as well as the termination conditions of the agreement. In Veeam, a provider can subscribe several tenants to the same set of resources (a hardware plan), and each tenant can use the whole set.

Limits and trade-offs

  • It does not replace backup: According to Microsoft, replication doesn't protect you against data loss or corruption, and a deletion is replicated to every replica (see our replication article). Long history is the job of backup.
  • An ongoing cost: AWS bills hourly per replicating server, and the staging disks and snapshots are billed separately.
  • Connectivity and security: According to Google Cloud, your connection to the cloud may become unavailable in a disaster, so you need a second path; the security controls you apply in production must also apply to the recovered environment.
  • It stops at IT: Google Cloud treats disaster recovery as the subset of business continuity that focuses on IT systems; everything else belongs in the business continuity plan.

We cover the design of the setup in our disaster recovery and continuity engineering service, backup and replication operations in our backup, replication and recovery service, and measuring readiness in our replication and recovery readiness service.

Frequently asked questions

What does DRaaS mean? It stands for disaster recovery as a service. Servers and data are replicated to a provider, and in a disaster the systems run there.

What is the difference between DRaaS and BaaS? BaaS backs up only data, and getting back can take hours or days. DRaaS also keeps servers ready, so recovery is measured in minutes, but it costs more.

What RPO and RTO can DRaaS achieve? With continuous replication, RPO can drop to seconds and RTO to minutes. What counts is the time you measure in a drill.

What does DRaaS pricing depend on? It depends on the number of protected servers, disk volume, the retention period and the resources that run during drills or recovery. The smaller the targets, the higher the cost tends to be.

How do you compare DRaaS providers? Use the same criteria for each: where the data lives, the RPO and RTO measured in drills, test reports, the failback plan, a clean copy and the exit terms.

Sources