Key takeaways

  • The Atlantic hurricane season runs June 1 to November 30, and NOAA's National Hurricane Center puts the peak at September 10. For 1991 to 2020 an average season had 14 named storms, 7 hurricanes and 3 major hurricanes, but individual seasons vary widely.
  • Ready.gov asks businesses to base IT recovery on a business impact analysis. The recovery time for an IT resource should match the recovery time objective of the business function that depends on it.
  • Cloud regions are separate geographic areas made of zones, and a zone is a single failure domain. Putting a workload in one zone protects against little. Spread across zones for building-level faults, and plan a second region for storms.
  • Google Cloud's published region list shows no location in Florida. The closest regions to Miami for a second site are in South Carolina (us-east1), Virginia (us-east4), Ohio (us-east5) and Texas (us-south1). Choose by latency, services and distance from the same weather system.
  • Florida Statutes section 501.171 requires reasonable measures to protect personal information, notice to the Department of Legal Affairs within 30 days for breaches affecting 500 or more Floridians, and notice to individuals within 30 days. A cloud provider that holds your data is a third-party agent with a 10-day duty to tell you.
  • The cloud does not fix the office. Staff still need power, internet and a way to sign in. Plan for connectivity and identity as carefully as for servers.

The problem is the building, the grid and the road

Many coastal companies, in Florida especially, still run their systems from a closet, a small server room or a rack in a suburban data center. The equipment is not the weak point. The building around it is. A hurricane brings flooding and wind damage, but the failure that most often stops work is simpler: the power goes out and stays out, the generator runs out of fuel, the internet circuit is cut, or staff cannot get to the site. A company with two server rooms a few miles apart has not removed that risk if both sit in the same evacuation zone and on the same grid.

Moving to the cloud is one answer, and often a good one. It is not automatic protection. A virtual machine placed in a single zone of a single region is still one thing that can fail. A migration that moves the same design to someone else's data center, without thinking about recovery, only changes who you call when it breaks. This playbook is written for owners and operations managers in Florida who want a plan, and for the technical staff who will carry it out. Our team has described one illustrative version of this move in the Experience section, a distributor leaving two server rooms for Google Cloud, and the steps below follow that reasoning.

What NOAA says about the season

The National Hurricane Center states that the Atlantic hurricane season runs from June 1 to November 30. The Atlantic basin includes the Atlantic Ocean, the Caribbean Sea and the Gulf of America. Using a 30‑year climate period from 1991 to 2020, an average season has 14 named storms, 7 hurricanes and 3 major hurricanes, meaning Category 3, 4 or 5 on the Saffir-Simpson Hurricane Wind Scale. In an average year the first named storm forms around June 20, the first hurricane in early to mid-August and the first major hurricane in late August or early September.

The center also says the peak of the Atlantic season is September 10, with most activity between mid-August and mid-October, and cautions that formation dates in any single season can differ a lot from the averages. Two planning lessons follow. First, the season is five months long, so a plan that lives in one manager's head is not enough. Second, averages say nothing about whether a given storm will reach Florida. A quiet season can still bring one damaging landfall, and an active season can pass you by. Plan for the event, not the forecast.

Start with a business impact analysis

Ready.gov, the preparedness site run by FEMA, describes a business continuity plan as the work of a team that identifies what must keep running, how long the business can be without it and what is needed to restore it. Its IT disaster recovery guidance says that priorities and recovery time objectives for information technology should be set during the business impact analysis, that IT priorities should be consistent with the recovery of business functions and that the recovery time for an IT resource should match the recovery time objective of the function that depends on it.

Ready.gov also lists what recovery strategies should anticipate losing: the computer room environment, including climate control and backup power; hardware; connectivity to a service provider; software applications; and data. Notice that three of the five are about the place and the pipe. The cloud takes the first two off your premises. It does not remove the third, which is why the plan below treats the office network as part of the system.

How Google Cloud is organized: regions, zones and resources

Google's documentation explains the geography. A region is an independent geographic area. Regions consist of zones, and a region has three or more zones housed in three or more physical data centers, with a few listed exceptions that Google says are being expanded. A zone is a deployment area within a region and should be considered a single failure domain. Google's guidance is to deploy fault-tolerant applications across multiple zones in a region, and to protect against the loss of an entire region by using more than one.

Resources differ in scope. A zonal resource, such as a Compute Engine virtual machine, lives in one zone, and a zonal outage can affect it. A regional resource is redundantly deployed across zones in a region. Multi-regional services are managed by Google to be redundant within and across regions. The practical meaning is that you pick the scope on purpose. A single virtual machine is zonal. A regional managed instance group spreads machines across zones. A Cloud SQL instance configured for high availability, which Google calls a regional instance, has a primary and a standby in different zones, with synchronous replication to each zone's disk so that a committed transaction is on both, and a failover if one zone fails. A Cloud Storage bucket can be regional, dual-region (a specific pair of regions) or multi-region, with its own replication behavior and price.

Where are the regions? Google's Compute Engine documentation lists regions and zones with their locations. The ones closest to Florida in the Eastern United States are us-east1 in Moncks Corner, South Carolina, us-east4 in Ashburn, Virginia, us-east5 in Columbus, Ohio and us-south1 in Dallas, Texas. We did not find a Florida location in that list. Names, locations and available machine types change, so check the live page when you plan. The primary region would normally be the one with the lowest latency for your staff and the services you need. The second region should be far enough away that one storm system is unlikely to affect both.

Cold, warm and hot: choosing a recovery pattern

Google's disaster recovery guide describes three patterns using a flat-tire analogy. In a cold pattern you have no spare: you must obtain and install replacement resources, and the trip stops until you do. In a warm pattern you have a spare and a kit: some resources are already prepared, and you need time to bring them into service. In a hot pattern the system keeps running with a second copy ready to take over. Cold is cheapest and slowest. Hot is fastest and costs the most, because you pay for capacity that sits ready.

Backup services fit the cold and warm patterns. AWS Backup, Google Cloud's Backup and DR Service, Azure Backup and OCI Block Volume backups with backup policies each copy workloads to storage outside the failing system, and several offer immutable or isolated vaults. Pair them with keys held in AWS Key Management Service (AWS KMS), Google Cloud KMS, Azure Key Vault or Oracle Cloud Infrastructure Vault (OCI Vault), so a restore in another region does not wait on a lost key.

What Florida law adds

Florida Statutes section 501.171, Security of confidential personal information, applies to covered entities, a defined term covering commercial entities that acquire, maintain, store or use personal information, along with government entities for certain purposes. We read the current 2026 text on the Florida Senate site. Subsection (2) requires each covered entity, governmental entity or third-party agent to take reasonable measures to protect and secure data in electronic form containing personal information. The statute defines a third-party agent as an entity contracted to maintain, store or process personal information on behalf of a covered entity, which is exactly what a cloud provider or a managed service provider becomes.

A breach of security is defined as unauthorized access of data in electronic form containing personal information. If a breach affects 500 or more individuals in Florida, the covered entity must notify the Department of Legal Affairs as expeditiously as practicable and no later than 30 days after determining the breach or having reason to believe it occurred. Individuals must be notified without unreasonable delay and no later than 30 days, unless a delay is authorized by law enforcement or a waiver applies. If more than 1,000 individuals must be notified at one time, the covered entity must also notify nationwide consumer reporting agencies. A third-party agent must notify the covered entity no later than 10 days after determining a breach of a system it maintains. Penalties for failing to give required notice are civil, up to $500,000, and violations are treated as unfair or deceptive trade practices.

How does this connect to hurricanes? Storms damage equipment and cause sudden moves of devices, backups and paper. A lost or removed laptop, a looted site or a tape in the back of a car are all situations where unencrypted personal information could be accessed. The statute's definition of personal information excludes information that is encrypted or otherwise rendered unusable. Encrypting laptops, backups and cloud storage therefore lowers the chance that a disaster turns into a notifiable breach. Counsel decides whether an event is a breach. Our checklist article on the Florida information protection act covers the notice steps in detail.

The cloud also adds contract work. Make sure the agreement with each provider states how and when it will tell you about an incident and that it can meet the 10‑day duty. Know where your data is stored. And remember that the shared responsibility model puts configuration, access control and backups of your data largely on you, even though the provider runs the building.

A step-by-step plan for the move

  • Inventory everything. List servers, databases, file shares, applications, licenses, printers and phone systems, who depends on each, and which are already end-of-life. Discovery tools can help, but nothing replaces asking the people who use the systems.
  • Run the business impact analysis. Assign each system an RTO and an RPO and agree them with the owners of the business functions. Put the numbers in writing.
  • Decide the fate of each workload. Retire it, replace it with software as a service, move it as is, move it with small changes to a managed service, or rebuild it later. Do the least work that meets the deadline and the recovery targets.
  • Design the landing zone first. Choose the primary and recovery regions, the network layout, the identity system with multi-factor authentication, logging, encryption keys and the account structure that keeps production and test apart.
  • Plan the connection. Staff need reliable internet at every site or at home. Use two carriers where you can, consider software-defined networking to steer traffic, and decide whether a private link is worth the cost. See our articles on backbone choices and on keeping a business working if the internet fails.
  • Move in waves. Start with low-risk systems to learn, then move groups of related systems together so that dependencies stay close. Keep a rollback for each wave.
  • Copy backups out of the production account. Use the 3-2-1 idea from our backups article: three copies, two media types, one offsite, and make one immutable. A compromised account can delete backups stored inside it.
  • Rehearse. Fail over a tier-one system to the second region before the season starts, and again after any large change. Time it against the RTO.

What the cloud does not fix

Three things stay on your side. The first is the office. Without power and internet, nobody reaches the cloud. A small uninterruptible power supply for the network closet, a generator plan for the site if the office must stay open, a cellular backup circuit and the ability to work from home are cheap compared with the systems they protect. The second is identity. If everything depends on one directory and one second factor, losing access to it stops all work, so keep emergency access accounts and document how to use them. The third is dependence on one provider. A multi-cloud design is expensive and hard to run, but a copy of critical data outside the main provider, and a written exit plan, are reasonable for most firms.

Connectivity is the other half. Each large provider sells a private link from your office or colocation cage to its cloud: AWS Direct Connect, Google Cloud Interconnect (Dedicated and Partner), Microsoft Azure ExpressRoute and Oracle Cloud Infrastructure (OCI) FastConnect. A private link does not replace the ordinary internet path, and Microsoft recommends two circuits in two peering locations for maximum resilience with ExpressRoute. Plan the second path, and test the failover, before the season starts.

Cost needs a plain comparison over three years: staff time, hardware replacement, power, licensing, backups and the cost of the last outage. We quote no savings, because they depend on the workload. Clayton Cybernetics plans and carries out these migrations for Florida companies.

Sources

This article is general information, not legal advice, and it is not an engineering design for your company. We read the NOAA, Ready.gov, Florida Senate and Google Cloud pages cited above on 2026-11-08. Google Cloud region names, locations, zones, services and prices change; the region list was read from the Compute Engine documentation on that date and should be re-checked, and nothing here states a price. Section 501.171 is summarized, not quoted in full, and its application to a given event is a legal question for your counsel. We do not state loss or savings statistics. Migration results depend on the workloads and the team. Last reviewed .

Keep reading

Need help with this?

Cloud cost review and management, without compromising on quality or security.

Cloud Management