8.14 Redundancy of Information Processing Facilities

Information processing facilities should be implemented with redundancy sufficient to meet availability requirements.

Redundancy of information processing facilities in information security refers to the practice of having multiple, independent systems in place to ensure that critical information processing functions can continue in the event of a failure or disruption. The goal of redundancy is to ensure that there is no single point of failure in the system, and that the risk of data loss or service interruption is minimized.

Several types of redundancy can be implemented in an information security system, including:

• Hardware redundancy: This involves having multiple, independent hardware components in place that can take over the processing functions in case of a failure. For example, having multiple servers with different configurations, using RAID storage and, having multiple power supplies.
• Software redundancy: This involves having multiple, independent software components in place that can take over the processing functions in case of a failure. For example, having multiple operating systems, applications, or databases that can be used to process data in case of a failure.
• Network redundancy: This involves having multiple, independent communication pathways in place that can be used to transmit data in case of a failure. For example, having multiple ISPs, network paths, or wireless networks available.
• Power redundancy: This involves having multiple, independent power sources in place that can be used to provide power to the system in case of a failure. For example, having an uninterruptible power supply (UPS) system and a generator.
• Location redundancy: This involves having multiple independent information processing facilities located in different geographic locations. This ensures that the system can continue to function even if one location is unavailable due to a disaster or other disruption.
It's important to note that redundancy alone is not enough to ensure the security and availability of the data, it should be combined with other security measures, such as access controls, monitoring, and incident response.