Business Continuity Guide

Complete unavailability during Cloudflare infrastructure outage

Example: Cloudflare management systems unreachable; Global Disconnection unavailable but users need Internet access to maintain business operations.

External Emergency Disconnect

A customer-hosted HTTPS endpoint that clients poll for disconnect signals, operating independently of Cloudflare infrastructure.

Use when: Cloudflare's management systems are unreachable but you need to disconnect clients to restore Internet access.

Guidance: Pre-configure this mechanism before outages occur. During an incident, update your endpoint to return {"emergency_disconnect": true}.

Expected outcome: Clients disconnect within 1–2 polling intervals (configurable, default 60 seconds); users regain direct Internet access without security controls.

Prerequisites:

• Customer-hosted HTTPS endpoint (IPv4/IPv6 address, not domain)
• SHA-256 fingerprint of TLS certificate
• MDM deployment for group-differentiated responses

Limitations:

• Not available on iOS, Android, or ChromeOS
• Customer responsible for endpoint maintenance and certificate renewal
• No Cloudflare logging of disconnect events
• Split Tunnel configuration must not include the endpoint IP

Security impact: Loss of all Zero Trust controls (same as Global Disconnection).

Complete unavailability of client connectivity

Example: Client cannot establish secure tunnel; users unable to access protected applications or filtered Internet.

Global Disconnection

Instantly disconnect all Cloudflare One Clients from the secure tunnel via Dashboard or API.

Use when: You need immediate fleet-wide disconnection and Cloudflare's management systems are reachable.

Guidance: Check the Cloudflare status page first. If Cloudflare infrastructure is experiencing issues, this mechanism may be unavailable — use External Emergency Disconnect instead.

Expected outcome: All clients disconnect within seconds; users have direct Internet access without filtering, threat protection, or private application connectivity.

Prerequisites:

• Dashboard or API access
• Account administrator permissions

Limitations:

• Requires connectivity to Cloudflare's management systems
• Account-wide only (no group scoping)
• Unavailable during complete Cloudflare outages

Security impact:

• Loss of web filtering and malware protection
• Loss of data loss prevention (DLP) inspection
• Loss of access to private applications
• Unencrypted DNS queries (potential privacy exposure)

Individual device issue requiring immediate local override

Example: Single user locked out due to policy misconfiguration; client switch disabled but user needs emergency access.

Admin Override Codes

Time-limited, single-use codes allowing IT administrators to temporarily unlock client settings on a specific device.

Use when: An individual device requires immediate attention. This is the only option for iOS and Android users when External Emergency Disconnect is unavailable.

Guidance: Generate the code in the Dashboard, provide it to the user over a secure channel, and have the user enter it locally to temporarily bypass the locked switch.

Expected outcome: Temporary local override allowing the user to disconnect the client for one hour.

Prerequisites:

• Lock client device switch policy enabled
• Dashboard access to generate codes
• Direct communication with the end user

Limitations:

• One code per device per hour
• Manual IT intervention required
• Not scalable for fleet-wide scenarios
• Requires staffed IT during incidents

Security impact: Single device loses Zero Trust controls for one hour.

Degraded performance impacting user productivity

Example: High latency through client tunnel; intermittent connection drops affecting work quality.

Graduated response strategy

Use a combination of mechanisms based on scope and severity. Use Digital Experience (DEX) to determine scope and severity.

Guidance by scope:

• Single device: Admin Override Code → manual disconnect
• Group or department: External Emergency Disconnect with MDM-differentiated endpoints
• Organization-wide: Global Disconnection (if Cloudflare reachable) or External Emergency Disconnect

Decision factors: Balance user productivity needs against security requirements. For regulated industries, consult your compliance team before disconnecting.

Expected outcome: Restored user productivity with a documented security trade-off.

Prerequisites:

• Documented decision criteria for fail-open vs. fail-closed
• Pre-configured mechanisms before incidents occur
• Clear authorization matrix

Limitations:

• Each mechanism has different infrastructure dependencies
• Mobile platforms have limited options

Security impact: Scope-dependent — refer to individual mechanism entries above.

Management dashboard unavailable, traffic processing normally

Example: Dashboard and API unreachable; edge services and client connections remain functional with cached policies.

No action required

Edge services continue operating using cached configurations. New configuration changes will be unavailable until management systems recover.

Use when: Cloudflare's management systems are unavailable but user traffic continues processing normally.

Guidance: Monitor the Cloudflare status page. No customer action is typically required — edge services enforce cached policies until management systems recover.

Expected outcome: Existing configuration continues to apply; configuration changes resume when management systems recover.

Prerequisites:

• Monitoring of the Cloudflare status page
• Understanding that traffic processing and management are separate systems

Limitations:

• Cannot modify policies during the outage
• Cannot trigger Global Disconnection from Dashboard
• Real-time logs and analytics may be delayed

Security impact: None — security controls remain active.