What if things go wrong? If you are managing Health or Financial data, you need to meet HIPAA, PCI or other regulations. You've done all the right things, checked all the right checklists. But in the real world things can still go wrong. The concept of 'Safe Harbor' is about achieving such high security that you can still recover reasonably even if things do go wrong.