SC-36 Distributed Processing and Storage says to distribute chosen processing and storage components across multiple locations or logical domains. The guidance says this gives redundancy and raises the work an adversary needs to disrupt you. It does not assume one primary location.
NIST SP 800-53 binds US federal systems, and reaches contractors and cloud providers through contract terms such as FedRAMP. For everyone else it is a reference catalog.
What it means in practice
You select the components. A database replicated across two regions, backups in a second account, or a job queue with workers in more than one zone all count. SC-36.1 covers polling techniques and SC-36.2 covers synchronization between the copies.
Distribution also changes how you think about attackers. A single primary location is an obvious target. When no one location is primary, an attacker has to hit several, and your recovery plan becomes a normal operation instead of a rare event.
Keep the data protection side in view. More copies mean more places to apply encryption and access control. Check that the second region has the same settings as the first.
Evidence to collect
- The named components and the locations or domains each runs in.
- Replication configuration and lag metrics.
- A failover test result with date and outcome.
Common gaps
Everything is in two zones of one account, so one credential compromise reaches both. Copies drift out of sync and nobody notices.
How to implement it
Separate by account or domain, not just by zone. Monitor replication health and run a failover drill at least once a year.
Quick check
Are two availability zones enough?
They help with availability. For adversary resistance, also separate accounts or credentials.
