Frequently because there is nowhere to put it that satisfies the same requirement. If the obligation is that data remains within the jurisdiction, a second site has to be within the jurisdiction too, and on an island of this size the genuinely independent options are few and sometimes none. The textbook answer is unavailable rather than expensive.

That is exactly the question the obligation turns on, and it is not ours to answer for you. Where the requirement is jurisdictional, a mainland site may not satisfy it regardless of how good it is, which is why organisations here end up solving resilience within one room rather than across two.

That every component whose failure would stop the system can be replaced while it runs. That means redundancy at the component level — dual power supplies, protected volumes, redundant paths — and, critically, the matching spare physically present, because redundancy only buys the time in which a replacement is fitted.

For a total site loss, yes, and it is worth being honest about that rather than pretending otherwise. For every other failure mode, which is the overwhelming majority of what actually happens, a well-stocked single site recovers faster than a second site would take to fail over.