In about 6 out of 10 estates the standby or mirror site carried no license at all, on the belief that disaster recovery is free
Nobody sets out to buy a second full set of licenses, and almost nobody plans to be told they already needed one.
Prepared by Redress Compliance · August 19, 2026 · Oracle disaster recovery reviews. 30 to 40 estates, 2024 to 2025.
Executive summary
In about 6 out of 10 estates the standby or mirror site carried no license, on the belief that disaster recovery is free.
Teams stretched the failover concession to cover routine drills, which the wording does not clearly allow and which nobody had confirmed in writing.
Where the concession did apply, the cluster failed the shared storage condition, so the relief was not actually available in the first place.
In 7 estates the standby was licensed for the database but not for the options running on it. A smaller finding nobody had budgeted for either.
How narrow is the failover concession?
It is a single, tightly conditioned allowance for unplanned failover inside one cluster. It is not a disaster recovery exemption, and reading it as one is the most expensive mistake in this subject.
Five conditions that must all hold at once
- Shared storage: the failover node and the production node attach to the same disk array.
- One node: only a single spare in the cluster qualifies, however many are configured.
- Whole day counting: any part of a day the node runs counts as a full day.
- Failover only: the node runs because production failed, not because you wanted somewhere to run reports.
- Return to normal: when the primary is back, the workload comes off the spare.
The published figure is ten separate days a year
It is set out in the software investment guide. Read the current version against your own ordering documents before relying on it, because policy documents are not contracts and the wording has been revised more than once.
Where does the concession stop applying?
Past the annual allowance, the failover node needs a full license for the database and for every option running on it. The concession is also silent on several things buyers assume it covers.
| Configuration | Covered by the concession | What it actually needs | Why buyers get it wrong |
|---|---|---|---|
| Spare node, shared storage, unplanned failover | Yes, within the allowance | Nothing extra inside the limit | This is the only covered case |
| Second site | No | Full license for database and options | It is read as disaster recovery relief |
| Standby copy on its own storage | No | Full license, because it fails shared storage | The node looks passive, so it looks free |
| Node used for batch, reporting or development | No | Full license for every day of the year | The spare is treated as spare capacity |
The drills question nobody answers straight
The guide carries a narrow backup testing provision, commonly read as permitting a small number of short tests a year on an unlicensed machine. The treatment of planned failover drills has been read both ways by reasonable people.
Do not resolve that ambiguity in your own favour
Ask for written confirmation of the treatment of planned drills, keep the reply, and design the runbook around the conservative reading until you have it.
The Oracle CIO complete playbook
The governance, renewal and recovery site moves that hold cost across a five year horizon.
Get the brief →What 30 to 40 Oracle estates showed
Across roughly 30 to 40 Oracle estates Fredrik Filipsson reviewed in 2024 and 2025, disaster recovery was the most misunderstood area of the licensing. The most common single finding was a fully replicated standby treated as exempt. Four patterns recur.
- In about 6 out of 10 estates, the standby or mirror site carried no license, on the belief that disaster recovery is free.
- Teams stretched the failover concession to cover routine drills, which the wording does not clearly allow.
- Where the concession did apply, the cluster failed the shared storage condition, so the relief was not available.
- In 7 estates the standby was licensed for the database but not for the options running on it.
Disaster recovery is where this licensing costs the most money for the least deliberate reason.
- Your agreements decoded into plain English before the auditor interprets them for you
- Entitlements, caps and protections verified across your whole contract portfolio
- A defensible position paper generated in minutes rather than weeks
Does a replicated standby need its own license?
Yes, in almost every real configuration. A standby holds its own copy of the data on its own storage, so it fails the shared storage condition before you reach any other test.
The trigger is installation and capability, not activity
Software installed on a server that can run it is licensable, which is why a standby sitting quietly in mount mode still counts. Nothing about the node being idle changes the position.
The options are what people miss
A standby applying redo needs the same edition license as the primary, and the replication technology itself is included in that edition. But if the primary runs a priced option, the standby carries those objects and needs the option too.
That is the line worked through in the active standby guide, and the technology is documented at the replication product pages.
Watch the briefing · 4:17How to Negotiate Your Oracle SaaS Renewal: The Five Moves at the TableScope before price, killing the escalator, and closing on their clock rather than yours.
What evidence closes the question early?
A configuration record that answers each condition before anybody asks. The conditions are objective, so the evidence can be assembled once and maintained.
Four things to be able to produce on request
- The storage topology, showing which nodes attach to the same array.
- The count of spare nodes in each cluster.
- A day log of every date the spare ran, counted as whole days.
- The option inventory on the standby against the primary.
The high availability architecture is public
The configurations and their names are documented at the high availability pages and the licensing treatment in the licensing information manual. Matching your architecture to those names is what turns an argument into a reading.
Where the common advice on recovery licensing is wrong
The common advice is that disaster recovery is covered by the failover concession, so a standby site is free. We disagree.
The concession covers one node, not one site
In about 6 out of 10 estates the standby carried no license at all on that belief, and in the estates where the concession was invoked, the cluster usually failed the shared storage condition anyway.
The buyer side move is to classify every recovery node against the five conditions, license the ones that fail, get the drills treatment in writing, and reconcile the option inventory on the standby against the primary. The Oracle practice runs that classification before an auditor opens the question.
What the reviews measured, 2024 and 2025
Two cuts of the review file, one large and deliberate, one small and unbudgeted.
Where the standby or mirror site carried no license at all, on the belief that disaster recovery is exempt.
Where the standby carried partitioned or otherwise optioned objects that nobody had entitled separately.
The first is the expensive finding. The second is the one that survives the first remediation, because everybody fixes the database line and stops.
Your first five moves
- Classify every recovery node against the five concession conditions, because the concession covers one node in one cluster rather than a site.
- Check the storage topology first, since a standby with its own copy of the data fails the shared storage condition before any other test applies.
- Keep a whole day log of every date a spare node ran, as any part of a day counts as a full day against the published ten day allowance.
- Get the treatment of planned drills confirmed in writing, and design the runbook around the conservative reading until that reply exists.
- Reconcile the option inventory on the standby against the primary. The Oracle practice assembles the configuration record before it is requested rather than after.
Frequently asked questions
Is disaster recovery free?
No, and about 6 out of 10 estates reviewed were operating on that belief with a standby or mirror site carrying no license at all.
What does the failover concession cover?
One otherwise unlicensed node in the same cluster, running the database for a limited number of separate days a year after an unplanned production failure.
What is the published allowance?
Ten separate days in a calendar year, and any part of a day the node runs counts as a full day against it.
What conditions have to hold?
Shared storage with the production node, a single qualifying spare, whole day counting, unplanned failover only, and the workload returning when the primary is back.
Does a replicated standby qualify?
Almost never. It holds its own copy of the data on its own storage, so it fails the shared storage condition before any other test is reached.
Does an idle standby count?
Yes. The trigger is installation and capability rather than activity, so a standby sitting in mount mode is still licensable.
Are drills covered?
The wording is genuinely ambiguous and has been read both ways. Get the treatment of planned drills confirmed in writing and work to the conservative reading until you do.
What about the options?
They are the finding that survives the first remediation. If the primary runs a priced option, the standby carries those objects and needs the option too.
Is the policy document binding?
It is a policy document rather than a contract, and the wording has been revised more than once. Read the current version against your own ordering documents.
What closes the question early?
A configuration record: the storage topology, the spare node count, a whole day log, and the option inventory on the standby against the primary.