Glossary

Cloud DR glossary: infrastructure recovery terms explained

Short answer

Short definitions of the terms used across this site, from recovery objectives to infrastructure-as-code vocabulary. Where a term comes from a standard or an official source, the definition links to it. Terms are listed alphabetically with an A to Z jump bar.

By The Rebuild Desk · Cloud Resilience Compare · Re-checked October 2026

Business impact analysis (BIA)

An analysis of how losing an information system affects the business, used to set recovery priorities and objectives. NIST's glossary takes its definition from ISO/IEC 27031.

Source: NIST glossary: business impact analysis · Read 27 Sep 2026

Clean room

An isolated environment used to investigate an attack and confirm what is safe before recovery. Cohesity calls its version a Minimum Viable Recovery Environment.

Source: Cohesity: clean room · Read 27 Sep 2026

ClickOps

Informal name for changes made by hand in a cloud console instead of through code. ClickOps resources are often missing from templates, which makes them hard to rebuild.

Cloud disaster recovery (cloud DR)

The ability to bring cloud services back after a disruptive incident, including the infrastructure, configuration and data they need. This site writes cloud DR rather than disaster recovery to mean IT incidents, not natural disasters.

Cloud recovery posture management

Continuous assessment of whether a cloud environment can be recovered: what is backed up, what is in code, what has drifted. Sometimes called cloud resilience posture management.

Codification

Generating infrastructure-as-code definitions from resources that already exist in a cloud account. Firefly and StackGuardian both describe codifying unmanaged resources.

Configuration drift

A difference between a resource's live settings and the settings its template or last known-good snapshot describes. Drift is the usual reason a rebuilt environment does not behave like the original.

Configuration snapshot

A point-in-time record of resource settings, as distinct from a copy of data. A rebuild from a configuration snapshot restores how the environment was set up.

Core resource

Arpio's pricing unit: server-like components such as VMs, databases and file systems. Its Standard tier covers 25 and Premium 50.

Source: Arpio pricing · Read 27 Sep 2026

Cross-account recovery

Recovering into a different cloud account or subscription from the one that failed or was compromised, often to get a clean target after an attack.

Cyber resilience posture management (CRPM)

Continuous assessment of whether systems and data can be recovered after an attack, including backup coverage, drift and restore points. Gambit Security and Firefly both use the term.

Source: Gambit Security: Balens · Read 11 Oct 2026

Cyber resiliency

The ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems. NIST's glossary uses the definition from SP 800-160 Volume 2.

Source: NIST glossary: cyber resiliency · Read 27 Sep 2026

Dependency mapping

A record of which resources each resource needs, such as a subnet, role or security group, used to rebuild them in the right order.

DORA

The EU Digital Operational Resilience Act, Regulation (EU) 2022/2554, which has applied since 17 January 2025 and requires financial entities to withstand, respond to and recover from ICT disruptions.

Source: EIOPA: Digital Operational Resilience Act · Read 27 Sep 2026

Failback

Returning service from the recovery environment to the primary one after a failover, including changes made in the meantime.

Failover

Switching service to a copy that was prepared in advance in another location, such as another region or account.

Golden image

A known-good machine image of a critical system, kept so it can be redeployed after an attack. The CISA #StopRansomware Guide recommends maintaining them.

Source: CISA #StopRansomware Guide · Read 27 Sep 2026

Immutable backup

A backup that cannot be changed or deleted for a set period, including by an administrator, so an attacker who gains access cannot destroy it.

Infrastructure as code (IaC)

Describing cloud resources in files, such as Terraform or OpenTofu configuration, that a tool applies to create them. AWS recommends it for redeploying environments in a recovery region.

Source: AWS whitepaper: disaster recovery options in the cloud · Read 27 Sep 2026

Isolated recovery environment

A separate network, account or region used as the recovery target so restored systems do not reconnect to a compromised environment.

Machine image

A template for a virtual machine's disk, such as an Amazon Machine Image. Images stored in one region must be copied to be used in another.

Source: AWS whitepaper: testing disaster recovery · Read 27 Sep 2026

Maximum tolerable downtime (MTD)

The longest a business process can be disrupted before the impact becomes unacceptable. NIST's glossary uses the definition from SP 800-34.

Source: NIST glossary: maximum tolerable downtime · Read 27 Sep 2026

Multi-site active/active

The most expensive AWS recovery strategy: the workload runs in more than one region at once, so a region loss shifts traffic rather than starting a recovery.

Source: AWS whitepaper: disaster recovery options in the cloud · Read 27 Sep 2026

NIS2

The EU Directive 2022/2555 on cybersecurity across 18 critical sectors, with a transposition deadline of 17 October 2024. It requires appropriate cybersecurity risk-management measures and incident notification.

Source: European Commission: NIS2 Directive · Read 27 Sep 2026

OpenTofu

An open-source infrastructure-as-code tool compatible with Terraform configuration. Firefly and StackGuardian both list it as an output format.

Pilot light

An AWS recovery strategy in which core data is replicated and minimal infrastructure is kept ready in the recovery region, then scaled up during an incident.

Source: AWS whitepaper: disaster recovery options in the cloud · Read 27 Sep 2026

Point-in-time recovery

Restoring to the state at a chosen moment before an incident, such as just before a bad change or an attack.

Recovery orchestration

Software that runs the steps of a recovery in order, such as creating resources, restoring data and switching traffic, instead of people following a runbook.

Recovery point objective (RPO)

The maximum amount of recent data or change, measured in time, that you accept losing in an incident. Arpio publishes RPO targets by tier.

Recovery region

The cloud region where an environment is restored or failed over to when the primary region is unavailable.

Recovery time objective (RTO)

The maximum time a service may be unavailable after an incident before recovery must be complete. Firefly states an RTO under 1 hour.

Runbook

A written procedure for people to follow during an incident: who decides, in what order systems return, and how to confirm the recovery.

Service quota

A per-account, per-region limit on how many of a resource you can create. A recovery region with lower quotas than production can stop a rebuild.

Source: AWS whitepaper: testing disaster recovery · Read 27 Sep 2026

Terraform provider

The plugin that lets Terraform manage a given cloud or service. Firefly's docs state that its restores depend on Terraform provider support.

Source: Firefly docs: Backup and DR · Read 27 Sep 2026

Warm standby

An AWS recovery strategy that keeps a scaled-down but fully working copy of the workload running in the recovery region.

Source: AWS whitepaper: disaster recovery options in the cloud · Read 27 Sep 2026

Frequently asked questions

What is the difference between RTO and RPO?

RTO is how long a service may be down; RPO is how much recent data or change you may lose. A tool can meet one and not the other, which is why the estimator checks them separately.

Is cloud recovery posture management the same as cloud DR?

No. Posture management assesses whether you could recover; cloud DR is the recovery itself. Some tools do both.