A resilient data center keeps critical services running through utility failures, equipment faults, network cuts and site-level disasters. That requires one engineered chain: ride-through power and generators, cooling that survives the transition, physically independent connectivity, and a tested disaster-recovery (DR) capability. Use the checklist below to identify single points of failure, set measurable recovery targets and prove that the design works under controlled failure.
What data center resilience means
Resilience is the ability to continue or restore an agreed service when normal conditions fail. It is broader than installing a second server or buying a larger uninterruptible power supply (UPS). Utility entrances, switchgear, batteries, generators, cooling loops, network paths, controls, staff, fuel, water, building access and the recovery site all have to support the same business priorities.
As an Amazon Associate I earn from qualifying purchases.
Start with the services rather than the equipment. For each application, record the maximum tolerable downtime, recovery time objective (RTO), recovery point objective (RPO), upstream and downstream dependencies, staffing requirements and acceptable degraded mode. Then map those requirements to power, cooling, telecommunications and recovery capacity. A design that protects servers but not the identity service, DNS, storage, or cooling controls is not resilient for the user.
1. Scope, risk and dependency checklist
Define business impact and recovery targets
- List critical business services, owners, users, peak operating periods and the consequences of an outage.
- Set an RTO for each service and verify that it is no longer than the service’s maximum tolerable downtime.
- Set an RPO that states how much data loss is acceptable. NIST defines the RPO as “the point in time, prior to a disruption or system outage, to which mission/business process data can be recovered.”
- Document dependencies such as identity and access management, databases, DNS, time services, certificate authorities, storage, monitoring, licensing servers and external APIs.
- Record who can authorize shutdown, load shedding, failover and return to normal operation, including alternates for every role.
Assess geographic and environmental hazards
Perform a location-specific risk assessment for earthquakes, tornadoes, hurricanes, floods, wildfire, severe weather and utility disruption. Include the hazards that can prevent people, fuel trucks, contractors or replacement parts from reaching the building. Check flood elevation for generators, fuel systems, switchgear, pumps and network entrances; a room that stays dry while the access road is closed is still an outage risk.
#1 Best Overall
- 425VA/260W Standby Uninterruptible Power Supply (UPS): Uses simulated sine wave output to provide battery backup power and to safeguard home office, home entertainment including computers, gaming consoles, and broadband routers
- 8 NEMA 5-15R OUTLETS: Four battery backup & surge protected outlets; Four surge protected outlets; INPUT: NEMA 5-15P right angle, 45 degree offset plug with five foot power cord
- ADDITIONAL FEATURES: LED status light indicates Power-On and Wiring Fault, transformer-spaced outlets
- GREENPOWER UPS HIGH EFFICIENCY DESIGN: Reduces power consumption by utilizing a compact charger and power inverter to create an ultra-efficient backup power system for home and office use
- 3-YEAR WARRANTY – INCLUDING THE BATTERY; 75K USD Connected Equipment Guarantee; UL SAFETY CERTIFIED: Product has been tested in a UL certified lab and listed with UL as meeting or exceeding safety standards
Map shared failure domains
Draw complete paths, not just device inventories. Trace each power train from utility entrance to rack, each cooling path from heat source to heat rejection, and each carrier circuit from the building entrance to the network device. Mark common conduits, risers, meet-me rooms, control networks, grounding points, maintenance bypasses and software controllers. Repeat the exercise for the alternate site. A nominally redundant pair can still fail together if both depend on one breaker, fiber duct, pump, controller or maintenance procedure.
2. Backup power: bridge the outage and sustain the load
UPS role and runtime
ASHRAE describes UPS power as standard practice for datacom equipment. The UPS bridges voltage disturbances and the interval between utility loss and generator output, or supports an orderly shutdown when generation cannot be established. It is not a substitute for generator-backed cooling or a DR plan.
ASHRAE reported in 2013 that the usual maximum for UPS-only operation is about 15–20 minutes before rising temperature causes shutdown. That is a general engineering observation, not a runtime promise for every facility. Calculate runtime from measured critical load, battery age and temperature, inverter efficiency, end-of-discharge settings and the load that must remain powered. High-performance computers can fail in minutes or seconds when cooling is interrupted, so a long battery runtime does not make an uncooled room safe.
Inventory and verify the electrical chain
- Record utility entrances, independent feeds, automatic-transfer equipment, switchgear, distribution paths, grounding and protection coordination.
- Verify UPS topology, rated critical load, battery strings, battery condition, bypass operation, maintenance bypass and monitoring. Confirm that a bypass can be operated without creating an unprotected state.
- Measure actual load and growth headroom on each UPS and downstream panel; do not size from nameplate ratings alone.
- Confirm that monitoring generates actionable alarms for utility loss, battery degradation, overload, bypass, inverter failure, breaker position and high temperature.
- Document every single point of failure, including a shared control card, battery breaker, static-transfer switch, bus tie or maintenance step.
Generators and transfer sequences
Size generators for the IT load plus the cooling, pumps, controls, fire protection and life-safety loads required during transition. Document generator start time, automatic-transfer sequence, breaker interlocks, fuel autonomy, refueling contracts, fuel quality program, exhaust, ventilation and flood elevation. Large compressors can impose high starting current; verify that generator capacity and sequencing can accept those steps without dropping the bus.
Rank #2
- 1500VA/1000W PFC Sinewave Uninterruptible Power Supply (UPS): Uses sine wave output to provide battery backup power for Active PFC & conventional power supplies; Safeguards computers, workstations, network devices, and telecom equipment
- 12 NEMA 5-15R OUTLETS: 6 battery backup & surge protected outlets, 6 surge protected outlets; INPUT: NEMA 5-15P right angle, 45 degree offset plug with 5 foot power cord; 2 USB charge ports (1 Type-A, 1 Type-C) quickly charge phones and tablets
- MULTIFUNCTION, COLOR LCD PANEL: Displays immediate, detailed information on battery and power conditions; Color display alerts users to potential issues before they can affect critical equipment and cause downtime; Screen tilts up to 22 degrees
- AUTOMATIC VOLTAGE REGULATION (AVR): Corrects minor power fluctuations without switching to battery power; UL SAFETY CERTIFIED: Product has been tested in a UL certified lab and listed with UL as meeting or exceeding safety standards
- 3-YEAR WARRANTY – INCLUDING THE BATTERY; $500,000 Connected Equipment Guarantee; FREE PowerPanel Management Software (Download)
Test the complete sequence under controlled conditions: utility loss, UPS ride-through, generator start, transfer, cooling restart, alarm delivery, load shedding and return to utility. Record measured transfer times and the loads that were actually online. Include black-start capability where the design requires it, and define priorities for shedding noncritical loads. A return-to-utility test should confirm stable retransfer, cooldown and generator run-on rather than relying on a switch position alone.
Choose a redundancy model that matches the business
| Model | Meaning | Maintenance and fault implications | Typical decision questions |
|---|---|---|---|
| N | Capacity exactly meets the required load. | One component or maintenance event can remove required capacity; concurrent maintenance is generally not available. | Can the business tolerate a planned outage or manual shutdown? |
| N+1 | Required capacity plus one spare component. | One component can fail or be maintained while capacity remains, but a shared path may still be a single point of failure. | Is one failure enough protection, and can maintenance occur without taking the train offline? |
| 2N | Two independent systems, each capable of carrying the full required load. | A complete train can be lost while the other carries the load if paths are genuinely independent. | Are both trains separately fed, controlled, tested and maintainable? |
| 2(N+1) | Two independent full-capacity systems, each with an additional spare component. | Provides the greatest component and maintenance margin, with higher capital, space and operating complexity. | Do the service impact and concurrent-maintenance requirement justify the lifecycle cost? |
N+1 or 2N labels do not prove resilience. Mismatched breaker ratings, a common fuel system, one control network, shared cooling, or an unsafe switching procedure can reintroduce a single point of failure. Evaluate each option for concurrent maintainability, fault tolerance, independence of paths, capacity after a failure, generator and cooling transition time, fuel and water autonomy, testability, operational complexity and total lifecycle cost. The Uptime Institute Tier model likewise evaluates maintenance, power, cooling and fault capabilities together rather than treating a device count as a guarantee.
3. Cooling resilience: keep heat removal available
Why cooling belongs in the power plan
Cooling and power resilience are coupled. ASHRAE notes that high-performance computers can fail in minutes or seconds when cooling is interrupted, while a usual UPS-only window of 15–20 minutes may end with a thermal shutdown. UPS capacity is generally a poor way to run large compressors: their high draw and inrush make it costly and difficult to support them from batteries. Design the transition so generators start the cooling plant, or so an engineered thermal buffer and orderly load reduction protects equipment until cooling is restored.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsInventory the complete heat-removal path
- List CRAC and CRAH units, chillers, pumps, cooling towers, heat exchangers, piping loops, valves, controls and liquid-cooling equipment.
- Identify which electrical train powers each item and whether controls, sensors and actuators remain available during transfer.
- Verify redundant capacity, diverse distribution paths, isolation valves and the ability to remove one unit or loop for maintenance.
- Check spare parts, water treatment, chemical monitoring, leak detection, drain capacity and safe maintenance access.
- For liquid-cooled racks, document coolant quality, quick-disconnects, manifolds, pumps, leak sensors and procedures for isolating a rack without losing the room.
Monitor conditions and prove restart
Trend rack inlet temperature, humidity, differential pressure, airflow, flow rate and hot-spot alarms with real-time sensors. Set escalation thresholds by equipment and operating mode, with named responders and time limits. During an integrated power test, prove that critical racks retain cooling while generators start and that the full cooling plant restarts in the required order. Test failure of a pump, fan, chiller, control panel and networked controller separately; a redundant mechanical unit is ineffective if its common controller cannot be replaced or rebooted.
Rank #3
- KEEP WORKING WHEN THE POWER GOES OUT: 850VA/450W provide up to 35 minutes of runtime at 100W to save work, shut down safely, or ride out short outages. Protect desktops, monitors, NAS, and modems from data-corrupting power cuts
- PROTECTS YOUR WHOLE HOME OFFICE SETUP: Battery backup keeps your computer, router, modem, NAS, and smart home gear running during outages. Surge-only outlets handle printers and monitors. One unit, entire workspace covered
- 9 OUTLETS + 2 USB-A CHARGING PORTS: 6 battery-backup and 3 surge-only NEMA outlets, plus 2 USB-A ports (5V/2.4A shared) to charge phones and tablets without sacrificing a protected outlet
- EASY TO MONITOR, EASY TO MAINTAIN: Silenceable alarm and LED indicators give instant status at a glance. Battery is User-replaceable in minutes with no technician needed. Replacement battery model RBC17 sold separately
- 3-YEAR WARRANTY + EQUIPMENT PROTECTION: APC covers up to $75,000 in damage to connected devices harmed by a power event. One of the strongest protection policies in the category
4. Connectivity: separate carriers and failure domains
Document every communications dependency
Record carriers, building entrance facilities, meet-me rooms, risers, conduits, fiber routes, cross-connects, network power, DNS, management paths and out-of-band access. Include circuits used by generators, UPS monitoring, building management, security and the recovery site. A second circuit in the same conduit or a second carrier entering through the same duct is not geographically diverse.
Design and test physical diversity
- Use physically diverse entrance routes and, where justified by the service impact, diverse telecommunications carriers.
- Verify that primary and alternate services do not share a common street cut, building entry, riser, meet-me room, power dependency or upstream aggregation point.
- Keep an out-of-band management path that remains usable when the production network, authentication service or normal monitoring platform is unavailable.
- Maintain alternate telecommunications agreements with restoration priorities, contacts and escalation times.
- Test failover to the recovery site, including DNS changes, routing convergence, firewall policy, certificate validity and application dependencies.
NIST contingency controls call for alternate telecommunications services and geographically separated alternate processing and storage capabilities. Geographic separation should be chosen against the site’s hazard profile, not by an arbitrary distance: two buildings in the same floodplain or utility corridor may share the same disaster.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Disaster recovery, backups and alternate processing
Set service-level RTO and RPO targets
Use a business-impact analysis to rank services and translate the ranking into measurable RTO and RPO targets. A database with a four-hour RPO cannot be paired with backups that are verified only weekly. Conversely, a service with a 15-minute RTO may require pre-provisioned compute, replicated data, automated DNS and staff who can execute the runbook immediately.
Make backups recoverable, not merely present
- Encrypt backups in transit and at rest, restrict administrative access and separate backup credentials from production identity.
- Monitor job completion, retention, capacity, immutability or write protection and anomalous deletion.
- Keep recoverable copies at a location outside the primary threat domain, with documented ownership and access procedures.
- Perform test restores of files, databases, virtual machines and application configurations; verify data integrity and usable recovery time.
- Record dependencies such as encryption keys, secrets, licenses, operating-system images, DNS records and identity services.
Prepare the alternate site
An alternate processing or storage site needs adequate power, cooling, telecommunications, physical security, staffing and current runbooks. Define whether it is a hot, warm or cold capability in operational terms: what is already running, what must be provisioned, who performs the work and how long each dependency takes. Document failover authority, user communication, data reconciliation and the process for returning operations to the primary site.
Rank #4
- 1500VA / 900W RELIABLE BACKUP POWER: The highest VA capacity available for home use; delivers short-term battery power to keep essential devices powered during blackouts, surges, and unexpected power interruptions
- TEN PROTECTED OUTLETS: Power your entire setup with 5 battery backup outlets for essential devices, and 5 surge-only outlets for peripherals. Plus built-in coaxial and Ethernet surge protection for added peace of mind
- AUTOMATIC VOLTAGE REGULATION (AVR): Corrects low voltage brownouts (88V+) and surges (+/-13%) without draining battery. Boosts or trims to stable 120V. Extends runtime for blackouts; Active PFC compatible for gaming PCs
- REPLACEABLE BATTERY & ENERGY STAR UPS: User-replaceable battery (APCRBC124, sold separately) for zero-downtime swaps. ENERGY STAR certified for 92%+ efficiency, cutting energy costs vs standard UPS units
- LCD DISPLAY PANEL: Features an intuitive LCD screen that displays real-time status information including battery charge level, estimated runtime, load capacity, and input voltage for easy monitoring of your power protection system
Exercise the plan end to end
Exercises should restore applications, identity services, DNS, network routing, backup data and communications rather than stopping at a successful server boot. Include a scenario in which the primary site is inaccessible and staff must use alternate credentials, contact lists and out-of-band channels. Record actual RTO and RPO results, failed steps, missing permissions, vendor response and corrective actions. Retest after architecture, vendor, staffing or hazard changes.
6. Operations, testing and evidence
Use a recurring assurance schedule
- Continuously: monitor UPS state, generator alarms, fuel level, temperature, humidity, flow, network paths, backup jobs and security events.
- After every change: update diagrams, dependency maps, capacity figures, runbooks and escalation contacts; review whether a new shared component was introduced.
- At planned intervals: inspect and test batteries, generators, transfer equipment, cooling equipment, leak detection, diverse circuits and backup restores according to manufacturer and facility requirements.
- At least annually or as risk requires: run an integrated power-and-cooling exercise and a full DR exercise with business owners.
Keep evidence that operators can use
Store one controlled set of single-line electrical diagrams, cooling schematics, network route maps, rack elevations, asset owners, maintenance windows, fuel and water assumptions, alarm thresholds, contact lists and recovery runbooks. Each test record should include the scenario, start and end times, measured transfer and restoration results, alarms observed, loads shed, exceptions and assigned corrective actions with due dates.
7. A practical acceptance checklist
- Approve service priorities, maximum tolerable downtime, RTO and RPO with business owners.
- Complete geographic hazard and access assessments for the primary and alternate sites.
- Trace every power, cooling, network and recovery path and mark shared components.
- Measure actual UPS and generator loads; verify battery condition, fuel autonomy and cooling capacity at failure.
- Demonstrate utility loss, UPS ride-through, generator transfer, cooling restart, alarms, load shedding and retransfer.
- Fail each carrier and confirm physically diverse connectivity, out-of-band access and recovery-site routing.
- Restore representative backups and applications, including identity, DNS, keys and external dependencies.
- Run a site-loss exercise, compare measured RTO/RPO with targets, and assign corrective actions.
- Repeat the assessment whenever architecture, vendors, staffing, regulations or hazards change.
Resilience is achieved when the whole chain can be maintained, operated and recovered under the conditions the business actually faces. A UPS that bridges a disturbance, cooling that restarts on generator power, independent communications and a rehearsed alternate site provide that chain; any untested shared dependency can still determine the outage.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
