Cyber protection automation with intermittent consistency

A system for automated orchestration of cyber protection for a set of storage volumes using intermittent consistency, comprising:

• one or more processors and one or more storage devices storing instructions that are operable, when executed by the one or more processors, to cause the one or more processors to perform operations comprising:
• defining a cascaded remote data forwarding facility, the cascaded remote data forwarding facility including a first leg on which asynchronous remote data forwarding is used to mirror data of a set of storage volumes from a first data center to a second data center, the cascaded remote data forwarding facility also including a second leg on which adaptive copy data forwarding is used by the second data center to mirror the data of the set of storage volumes that is received by the second data center on the first leg of the cascaded remote data forwarding facility from the second data center to a cyber recovery vault;
• transmitting data on the first leg of the cascaded remote data forwarding facility from the first data center to the second data center;
• transmitting the data on the second leg of the cascaded remote data forwarding facility from the second data center to the cyber recovery vault;
• monitoring, on the second data center, a number of invalid tracks of the data owed by the second data center to the cyber recovery vault on the second leg of the remote data forwarding facility, the number of invalid tracks identifying tracks of data that have been received by the second data center on the first leg of the cascaded remote data forwarding facility and not mirrored by the second data center to the cyber recovery vault on the second leg of the cascaded remote data forwarding facility;
• in response to a determination that the number of invalid tracks owed by the second data center to the cyber recovery vault on the second leg of the remote data forwarding facility is less than or equal to a maximum threshold value, suspending transmission of data on the first leg of the remote data forwarding facility while continuing to transmit data on the second leg of the remote data forwarding facility;
• determining a consistent state of data on a set of storage volumes at the cyber recovery vault;
• in response to the determined consistent state of the data, creating, by the cyber recovery vault, a snapset of the storage volumes in the cyber recovery vault from the data that has been mirrored by the second data center to the cyber recovery vault on the second leg of the cascaded remote data forwarding facility;
• and
• after creation of the snapset of the storage volumes by the cyber recovery vault, resuming transmission of data on the first leg of the cascaded remote data forwarding facility.