Business continuity for high availability services across on premises and cloud requires an application availability layer that keeps services running across sites, combined with data protection, recovery orchestration, and continuity planning. Control Plane leads the availability layer, running workloads active-active across on premises data centers and multiple cloud providers. Veeam, HPE Zerto, Commvault, Rubrik, Cohesity, AWS Elastic Disaster Recovery, and Azure Site Recovery lead data protection and recovery. No single product covers every layer. The strongest posture stacks purpose-built tools so that a site loss, a ransomware event, or a regional cloud outage does not stop critical services.
Disclosure: Control Plane publishes this guide.
TL;DR
Each layer covers a different failure. Most hybrid estates need a tool from every layer.
- Layer 1, keep services running (application availability): Control Plane, Red Hat OpenShift with Advanced Cluster Management, InfoScale, Linux Pacemaker
- Layer 2, recover data (backup, replication, immutability): Veeam Data Platform, HPE Zerto, Commvault Cloud, Rubrik Security Cloud, Cohesity, Veeam Kasten for Kubernetes, Google Cloud Backup and DR Service
- Layer 3, orchestrate recovery (DRaaS and cloud-native DR): AWS Elastic Disaster Recovery, Azure Site Recovery
- Layer 4, plan and govern (BC management software): Fusion Risk Management, Archer, Riskonnect
How do high availability, disaster recovery, and business continuity differ?
Three terms get used interchangeably but mean different things. High availability keeps a service running through component or site failures using redundancy and automatic failover, and its target is expressed in nines of uptime. Disaster recovery restores a service after a failure that exceeds the HA design, such as a full data center loss or a ransomware attack. Business continuity is the broadest discipline, covering people, process, and technology so the organization can sustain critical operations under any disruption.
Two metrics drive every design decision. Recovery Time Objective (RTO) defines how quickly a service must be back. Recovery Point Objective (RPO) defines how much data loss is tolerable. Teams set both per service from a business impact analysis. Mission-critical services commonly target near-zero values for both. Less critical workloads often accept an RTO and RPO of hours, which allows scheduled backups instead of continuous replication.
Replication without point-in-time history does not protect against corruption or ransomware. Corrupted or encrypted data replicates to the secondary site with the next replication cycle, within seconds when replication is continuous, so both copies hold the damage. Immutable backups stored in a separate account or air-gapped environment remain necessary however strong the HA layer is.
What are the four layers of hybrid business continuity?
Layer 1: Keep services running. Application availability tools run workloads across multiple sites, either active-active or as clusters with automatic failover, so losing one location does not take the service down. Active-active designs can shift traffic in seconds. Cluster failover typically takes seconds to minutes.
Layer 2: Recover data. Backup, replication, and immutability tools capture point-in-time copies of data and replicate state between sites. They protect against data loss, corruption, and ransomware. RPO depends on the method: zero with synchronous replication, seconds with continuous data protection, and hours to a day with scheduled snapshots.
Layer 3: Orchestrate recovery. Disaster Recovery as a Service (DRaaS) and cloud-native DR products automate the failover of servers and VMs to a secondary environment. They handle network remapping, boot order, and test drills. They matter most when whole environments must come up in a specific order.
Layer 4: Plan and govern. Business continuity management software documents plans, tracks risks and business impact analyses, manages compliance, coordinates communication during incidents, and schedules and tracks readiness tests.
Layer 1: Keep services running (application availability)
Application availability tools keep a service running when a node, site, or region fails. They differ in whether sites run active-active or fail over as active-passive clusters, and in how they route traffic.
Control Plane
What it is. Control Plane is the unbreakable platform for running production workloads. It runs serverless, standard, stateful, and cron workloads natively on AWS, GCP, Azure, and Oracle Cloud Infrastructure (OCI), VM workloads on locations joined through Control Plane’s Managed Kubernetes (MK8s), and workloads on Kubernetes clusters you already run or your own machines, including on premises, active-active across regions and clouds. A workload deployed to Control Plane’s Global Virtual Cloud (GVC), a named set of locations across one or more clouds, runs active-active in every location of that GVC from one definition. Each workload’s global endpoint uses DNS to route clients to the nearest location where the workload passes its readiness probes, and moves traffic automatically when a location fails.
Best for. Production services that must stay up through a site or region loss, with traffic rerouted automatically and Day 2 operations handled by the platform.
Strengths. Control Plane handles Day 2 operations for you, including autoscaling, built-in observability, and security, with no Kubernetes cluster to operate in Control Plane-managed regions. Locations can be Control Plane-managed regions on AWS, GCP, Azure, and Oracle Cloud, Kubernetes clusters you already run, joined as locations through Control Plane’s Bring Your Own Kubernetes (BYOK), or your own servers, including in an on premises data center, through MK8s. One GVC can mix an on premises location with cloud regions. Control Plane’s Cloud Wormhole connects workloads to TCP endpoints in private networks, including on premises data centers, through an agent inside the network that holds an outbound connection, so no inbound ports open to the internet. The Template Catalog, Control Plane’s library of ready-to-install apps, includes multi-location databases such as CockroachDB and pgEdge so the data layer can also run across locations. The 99.999% availability SLA applies to workloads running at least two replicas in at least two locations, and those locations can be on different providers. Control Plane is PCI DSS Level 1, SOC 2 Type II, HIPAA, and GDPR compliant. Customers typically cut compute costs 30 to 50 percent compared with running directly on AWS, GCP, or Azure.
During the October 20, 2025 AWS us-east-1 outage, Control Plane customers with us-east-1 in their GVC had workloads active and running in healthy locations within 10 seconds, with no customer downtime, according to Control Plane’s internal incident telemetry.
Scope. Control Plane keeps services running and routes traffic, and its volume sets take scheduled snapshots for point-in-time restore. Immutable, isolated backups and BC planning come from Layers 2 and 4.
On premises and cloud coverage. On premises through MK8s or BYOK. AWS, GCP, and Azure through Control Plane-managed regions, and other providers such as Hetzner through MK8s or BYOK.
Red Hat OpenShift with Advanced Cluster Management
What it is. An enterprise Kubernetes platform paired with a management layer that deploys, governs, and monitors workloads across many clusters in the data center, the cloud, and the edge.
Best for. Organizations already standardized on OpenShift that need multi-cluster governance and policy-based placement.
Strengths. Deep integration with Red Hat’s ecosystem. Policy-driven workload placement across clusters. Multisite, multicluster disaster recovery capabilities. Supports on premises, bare metal, and major cloud providers.
Limitations. Global traffic routing across clusters requires external load balancing or DNS configuration. Operational work grows with cluster count.
On premises and cloud coverage. On premises bare metal and virtualized, plus AWS, GCP, and Azure.
InfoScale
What it is. A clustering and replication platform, now part of Cloud Software Group, that provides application-level HA and DR for physical, virtual, and cloud workloads.
Best for. Enterprise applications on physical or virtual infrastructure that need automated failover between on premises sites or to the cloud.
Strengths. Supports a wide range of operating systems and applications. Provides volume replication and cluster management in one product, with support for Kubernetes and OpenShift Virtualization.
Limitations. Strongest with traditional enterprise applications. It does not route global traffic across sites.
On premises and cloud coverage. On premises physical and virtual. Cloud support for AWS, Azure, Google Cloud, and Oracle Cloud.
Linux Pacemaker clustering (open source)
What it is. An open source high availability cluster resource manager, commonly used with Corosync for Linux workloads.
Best for. Teams with strong Linux expertise that need HA for specific services such as databases or file systems without commercial licensing costs.
Strengths. Free and well documented. Long proven in production. Supported by major Linux distributions.
Limitations. Requires significant manual configuration. No global traffic routing across sites. Large clusters add operational complexity.
On premises and cloud coverage. On premises Linux servers, plus cloud VMs on AWS, Azure, and Google Cloud through cloud-specific fence and resource agents.
Layer 2: Recover data (backup, replication, immutability)
Data protection tools set the RPO. They differ in workload coverage, replication method (scheduled snapshots or continuous journaling), and ransomware features. They form the core of most cloud disaster recovery solutions.
Veeam Data Platform
What it is. A unified backup, recovery, and data security platform for virtual, physical, cloud, and SaaS workloads.
Best for. Broad backup coverage across heterogeneous environments with strong ransomware protection.
Strengths. Supports VMware, Hyper-V, Nutanix, AWS, Azure, Google Cloud, and physical servers. Immutable backup repositories. Instant VM recovery. Monitoring and reporting.
Limitations. Licensing can be complex for large, diverse environments. Recovery orchestration is included in the Premium edition and sold as an add-on for Foundation and Advanced.
On premises and cloud coverage. On premises hypervisors and physical servers. Native cloud backup for AWS, Azure, and Google Cloud.
HPE Zerto
What it is. A continuous data protection and disaster recovery platform built for near-zero RPO replication of virtualized and cloud workloads.
Best for. Near-zero RPO for VMware vSphere workloads replicating between on premises sites or to the cloud.
Strengths. Journal-based continuous data protection, with restore points seconds apart, allows recovery to a point just before corruption. Automated failover orchestration with non-disruptive testing. Strong VMware integration.
Limitations. Focused on virtualized workloads. Kubernetes protection requires a complementary tool.
On premises and cloud coverage. On premises VMware vSphere. Cloud replication to AWS, Azure, Google Cloud, IBM Cloud, and Oracle Cloud.
Commvault Cloud
What it is. An enterprise data management platform for backup, recovery, and data governance across on premises, cloud, and SaaS environments.
Best for. Large enterprises that want one platform for data protection, compliance, and cyber resilience across diverse workloads.
Strengths. Broad workload coverage including databases, VMs, containers, and SaaS applications. Built-in anomaly detection, cyber deception through ThreatWise, and on-demand cleanrooms for recovery testing.
Limitations. Initial deployment and configuration can be complex. Smaller organizations may find the feature set more than they need.
On premises and cloud coverage. On premises physical and virtual. AWS, Azure, and Google Cloud.
Rubrik Security Cloud
What it is. A data security platform that combines backup, ransomware recovery, and data observability.
Best for. Ransomware recovery and data security posture management across hybrid environments.
Strengths. Immutable backups. Threat monitoring and anomaly detection in the backup workflow. Clean recovery after ransomware. A SaaS management plane reduces infrastructure to run.
Limitations. Focused on data protection. Application-level HA and traffic routing are outside its scope.
On premises and cloud coverage. On premises data centers and major public clouds.
Cohesity
What it is. A data security and management platform that consolidates backup, recovery, file services, and analytics, and that took over Veritas’s data protection business, including NetBackup, in December 2024.
Best for. Consolidating secondary storage and adding ransomware resilience to hybrid environments.
Strengths. Reduces data fragmentation by unifying backup targets, file shares, and test and dev copies. Threat detection and anomaly scanning. Isolated recovery options.
Limitations. Primarily a data platform. DR orchestration and application availability require separate solutions.
On premises and cloud coverage. On premises appliances and software-defined deployments. Major public clouds.
Veeam Kasten for Kubernetes
What it is. Kubernetes-native data protection for backup, DR, and mobility of containerized applications, formerly named Kasten K10.
Best for. Kubernetes data protection across on premises and cloud clusters.
Strengths. Application-aware snapshots and backups for Kubernetes workloads. Policy-based automation. Supports major Kubernetes distributions and cloud-managed Kubernetes services. Integrates with Veeam’s broader platform.
Limitations. Scope is Kubernetes environments, including KubeVirt and OpenShift Virtualization VMs. Workloads outside Kubernetes need a separate backup product such as Veeam Data Platform.
On premises and cloud coverage. Any supported Kubernetes cluster, on premises or cloud.
Google Cloud Backup and DR Service
What it is. A Google Cloud managed service for centralized backup and recovery of workloads running in Google Cloud and hybrid environments.
Best for. Organizations running workloads on Google Cloud, including Compute Engine, Google Cloud VMware Engine, Cloud SQL, AlloyDB, and self-managed databases.
Strengths. Integrated with the Google Cloud console. Incremental-forever capture with instant volume mounting. Application-consistent protection for databases and VMs.
Limitations. Backup and restore within Google Cloud; it does not orchestrate failover of a whole environment.
On premises and cloud coverage. Google Cloud workloads, with limited hybrid support.
Layer 3: Orchestrate recovery (DRaaS and cloud-native DR)
Recovery orchestration tools restart replicated servers in a secondary environment in a defined order. AWS Elastic Disaster Recovery recovers only into AWS, and Azure Site Recovery recovers into Azure or a secondary on premises site, which is the main trade-off in cloud vs. on premises disaster recovery.
AWS Elastic Disaster Recovery
What it is. A cloud-native DR service that replicates on premises or cloud servers into AWS for automated failover and recovery.
Best for. Organizations replicating on premises workloads to AWS as a DR target with minimal standby infrastructure cost.
Strengths. Continuous block-level replication with RPOs of seconds and RTOs of minutes. A low-cost staging area holds replicated data until you launch recovery instances. Automated launch and recovery into AWS.
Limitations. Recovery target is AWS only. Multi-cloud DR requires additional tooling.
On premises and cloud coverage. Source: on premises physical servers, VMware vSphere, Microsoft Hyper-V, and other cloud providers. Target: AWS regions.
Azure Site Recovery
What it is. Microsoft’s DR orchestration service for replicating and failing over VMs and physical servers.
Best for. Organizations with Azure investments that need DR for VMware, Hyper-V, or physical servers.
Strengths. Native integration with Azure services. Replication from on premises to Azure and between Azure regions. Recovery plans with customizable sequencing.
Limitations. Recovery target is Azure, or a secondary on premises site for VMware, VMM-managed Hyper-V, and physical servers. Multi-cloud DR requires additional tooling.
On premises and cloud coverage. Source: on premises VMware, Hyper-V, physical Windows and Linux servers, Azure VMs, and AWS Windows instances. Target: Azure regions or a secondary site.
Layer 4: Plan and govern (BC management software)
BC management software centralizes continuity plans, tracks business impact analyses, manages compliance obligations, and coordinates communication during incidents.
Fusion Risk Management provides a cloud platform for business continuity, IT disaster recovery, crisis management, operational resilience, and third-party risk.
Archer offers an integrated risk management platform with operational resilience modules for impact analysis, plan management, and incident response, deployable on premises or as SaaS.
Riskonnect delivers risk management and business continuity planning tools focused on operational resilience, third-party risk, and regulatory compliance.
How do the options compare?
| Option | Layer | What it protects | On premises | Public cloud | Typical recovery approach |
|---|---|---|---|---|---|
| Control Plane | 1 | Service availability | Yes (MK8s, BYOK) | AWS, GCP, Azure, plus other providers through MK8s or BYOK | Active-active with automatic traffic rerouting |
| Red Hat OpenShift + ACM | 1 | Service availability | Yes | AWS, GCP, Azure | Policy-based placement, failover |
| InfoScale | 1 | Service availability | Yes | AWS, GCP, Azure, Oracle Cloud | Cluster failover |
| Linux Pacemaker | 1 | Service availability | Yes | AWS, GCP, Azure (via agents) | Cluster failover |
| Veeam Data Platform | 2 | Data | Yes | AWS, GCP, Azure | Restore, instant recovery |
| HPE Zerto | 2 | Data and VMs | Yes | AWS, GCP, Azure, and others | Continuous replication, failover |
| Commvault Cloud | 2 | Data | Yes | AWS, GCP, Azure | Restore, cleanroom recovery |
| Rubrik Security Cloud | 2 | Data | Yes | Major public clouds | Restore, clean recovery |
| Cohesity | 2 | Data | Yes | Major public clouds | Restore |
| Veeam Kasten | 2 | Data (Kubernetes) | Yes | AWS, GCP, Azure | Restore, mobility |
| Google Cloud Backup and DR | 2 | Workloads and data | Limited | GCP | Backup, restore, cloning |
| AWS Elastic Disaster Recovery | 3 | Servers and VMs | Source only | AWS (target) | Failover to AWS |
| Azure Site Recovery | 3 | Servers and VMs | Source or secondary site | Azure (target) | Failover to Azure or a secondary site |
| Fusion Risk Management | 4 | Plans and compliance | N/A | SaaS | Planning and governance |
| Archer | 4 | Plans and compliance | Yes (self-hosted option) | SaaS | Planning and governance |
| Riskonnect | 4 | Plans and compliance | N/A | SaaS | Planning and governance |
What does a reference architecture for HA across on premises and cloud look like?
A hybrid continuity design uses all four layers. Steps 1 to 3 follow the active-active high availability across regions and clouds pattern on top of a hybrid cloud deployment.
- Run the service active-active in the data center and at least one cloud region. Deploy workloads to a Control Plane GVC that includes an on premises location (through MK8s or BYOK) and one or more cloud regions. The application runs in every location of the GVC at once.
- Route users to healthy sites. On Control Plane, each workload’s global endpoint uses DNS to route clients to the nearest location where the workload passes its readiness probes, so users stop reaching a location that fails.
- Replicate data with a database built for multiple sites. Deploy a multi-location database from the Template Catalog so the data layer spans the same locations. CockroachDB replicates by consensus, and surviving a region loss needs three locations. pgEdge runs multi-master across locations with asynchronous replication and last-update-wins conflict resolution, which keeps writes local and fast, though writes not yet replicated when a location fails may need reconciliation. Synchronous replication between an on premises site and a distant cloud region adds a round trip to every write, so pick based on how strict consistency must be versus write latency.
- Keep immutable backups in a separate account. Use a Layer 2 tool such as Veeam, Rubrik, or Cohesity to keep immutable backups in a cloud account or air-gapped environment isolated from production credentials. Use object lock or WORM storage, separate credentials and MFA for the backup account, and a retention period longer than an attacker’s likely dwell time. Restore from these backups during tests. This protects against ransomware and data corruption that replication would spread.
- Orchestrate and test failover. For workloads outside the active-active footprint, such as legacy VMs, use AWS Elastic Disaster Recovery or Azure Site Recovery to automate failover. Many teams run non-disruptive DR tests quarterly and after major infrastructure changes; regulated industries may have their own required cadence.
- Document the plan. Keep runbooks, communication trees, and compliance records in a BC management platform, and update them after every test and every significant infrastructure change.
How do you choose a tool for each gap?
Each row covers one gap, so most hybrid estates combine one tool per layer. Provider-level failover tools are compared in best multi-cloud failover solutions for 2026.
| If you need | Start with | Why |
|---|---|---|
| Keep customer-facing services up through a site or region loss | Control Plane | Active-active across on premises and cloud with automatic traffic routing and a 99.999% SLA for workloads with at least two replicas in at least two locations |
| Near-zero RPO for VMware workloads | HPE Zerto | Journal-based continuous data protection with point-in-time recovery |
| Broad backup across hypervisors and clouds | Veeam Data Platform | Coverage across hypervisors, physical servers, clouds, and SaaS, with immutable repositories |
| Ransomware recovery | Rubrik or Cohesity | Immutable backups with threat detection and clean recovery |
| On premises to one cloud DR | AWS Elastic Disaster Recovery or Azure Site Recovery | Low-cost standby with automated failover into one cloud |
| Kubernetes data protection | Veeam Kasten | Built for Kubernetes-native backup and mobility |
| Regulatory continuity planning | BC management software (Fusion, Archer, Riskonnect) | Central plan management, impact analysis, and compliance tracking |
FAQ
Answers to common questions about hybrid business continuity.
What are the best business continuity solutions for scaling high availability services on premises and cloud?
Control Plane for application availability. Veeam, HPE Zerto, Commvault, Rubrik, Cohesity, or Veeam Kasten for data protection. AWS Elastic Disaster Recovery or Azure Site Recovery for recovery orchestration. Fusion, Archer, or Riskonnect for BC planning. No single product covers all four layers.
What are the best cloud operations solutions for addressing business continuity and disaster recovery?
Pick by gap. Control Plane covers uptime across clouds and data centers. Backup platforms such as Veeam or Rubrik cover recoverability. AWS Elastic Disaster Recovery or Azure Site Recovery cover server failover into one cloud, and Azure Site Recovery can also fail over to a secondary on premises site. BC software such as Fusion covers governance.
What is the difference between high availability and disaster recovery?
High availability keeps a service running through component or site failures, typically with an RTO of seconds to a few minutes. Disaster recovery restores a service after events that exceed the HA design, such as a full site loss or ransomware, typically with an RTO of minutes to hours. Business continuity covers both, plus people and process.
Do I still need backups if I run active-active?
Yes. Active-active protects against infrastructure failures but not against data corruption or ransomware, so immutable backups in a separate account or air-gapped environment remain necessary.
How do I fail over between an on premises data center and the cloud?
At the application layer, run workloads in a Control Plane Global Virtual Cloud (GVC) that includes on premises and cloud locations, so traffic shifts automatically. For VM-level failover, replicate to a cloud DR target, trigger the DR plan when needed, and plan failback to the data center.
What RTO and RPO should critical services target?
Set RTO and RPO per service from a business impact analysis. Mission-critical customer-facing services commonly target near-zero RTO with an active-active application layer, and an RPO of zero to seconds with synchronous replication or continuous data protection.
Is DRaaS enough for business continuity?
No. DRaaS handles recovery orchestration but does not replace an HA layer, immutable backups, or BC governance, so it works alongside the other three layers.
How does Control Plane support business continuity on premises and in the cloud?
Control Plane runs each workload active-active across every location in its Global Virtual Cloud (GVC), which can mix on premises data centers, joined through Control Plane’s Managed Kubernetes (MK8s) or Bring Your Own Kubernetes (BYOK), with cloud regions on AWS, GCP, Azure, and Oracle Cloud. Each workload’s global endpoint uses DNS to route clients to the nearest location where the workload passes its readiness probes. Control Plane’s Cloud Wormhole connects workloads to TCP endpoints in private networks without opening inbound ports. Control Plane also handles Day 2 operations such as autoscaling, observability, and security. The 99.999% SLA applies to workloads running at least two replicas in at least two locations.
Can I use Control Plane with my existing Kubernetes clusters?
Yes. Control Plane’s Bring Your Own Kubernetes (BYOK) installs a few components into an existing cluster, which then registers as a Control Plane location. Add that location to a Global Virtual Cloud (GVC), and workloads run active-active across it alongside Control Plane-managed regions or Managed Kubernetes (MK8s) locations.
How often should I test my business continuity plan?
Quarterly is a common cadence for non-disruptive DR tests, with extra tests after significant infrastructure changes. Validate failover and restore separately, and update runbooks after each test.
To add the application availability layer to your business continuity stack, talk to the Control Plane team or sign up free.
Originally published on the Control Plane blog.
Top comments (0)