Plan regional evacuation with explicit RPO, RTO, and authority transfer

• Define RPO and RTO per business journey, not as one marketing number. Identify dependencies, data sets, and external contracts that cannot move and decide who has authority to declare evacuation.

• Calculate replication lag, DNS and client-cache delay, cold-start time, backlog, and passive capacity under peak primary load. The standby must absorb traffic plus replay and repair work.

• Fence the failed writer, preserve the stated loss bound, restore critical journeys first, communicate degraded features, and produce evidence from regular exercises. Return home is a separate migration with its own gates.

• Maintain warm regional infrastructure, replicated configuration and secrets, tested data promotion, global traffic control, and a failover coordinator that records an ownership epoch. Catalog every external dependency and preapprove standby identities.

• Continuously replicate durable state with lag telemetry and immutable checkpoints. On evacuation, stop or fence writes, promote from a known position, switch traffic by cohort, and reconcile ambiguous requests using operation IDs.

• Choose asynchronous replication only if the one-minute data-loss risk is accepted; otherwise coordinate the critical write subset. The promotion epoch prevents the old region from accepting writes after network recovery.

• Prepare for partial evacuation, stale DNS, duplicated webhooks, and a primary that is isolated rather than dead. Keep enough capacity for rollback or controlled fail-forward and avoid automatic failback.

• Preprovision certificates, keys, allowlists, and least-privilege identities in standby; break-glass actions expire and are audited. Residency rules may forbid a nominal failover target.

• Measure real replication lag, promotion phase duration, traffic by region, error and correctness SLOs, backlog, and dependency readiness. Time every quarterly exercise against declared objectives.

• Warm standby is an insurance product; choose reserved critical capacity plus autoscaling for optional tiers. Track the gap between paid standby and actually exercisable throughput.

• Active-active reduces evacuation work but creates continuous consistency and cost complexity. Warm active-passive is often enough if promotion, capacity, and external dependencies are genuinely rehearsed.

• Start with dependency inventory and read-only traffic, then practice service cohorts, write promotion, and full regional loss. Fix each exercise finding before broadening the public RTO claim.

• Staff candidates make RPO and RTO test results, not architecture adjectives. They cover fencing, ambiguous writes, third parties, capacity, communications, and the dangerous return-home phase.

Interviewer evaluation rubric