A scale-out storage system includes a plurality of computer nodes each of which has a memory and a processor, and a storage apparatus. The computer nodes have one or more redundancy groups each of which is a group for metadata protection. Each of the one or more redundancy groups includes two or more of the computer nodes including a primary node being a primary computer node and a secondary node being a secondary computer node, and a failover is performed from the primary node to the secondary node. The memory of the primary node has stored therein metadata related to the redundancy group and to be accessed for control. The metadata is redundantly stored in the memory of the primary node and the memory of the secondary node.