IT glossary
Disaster recovery plan
A disaster recovery plan is a written, tested document saying how your organization gets its systems and data back after an outage, and who does what.
The word “disaster” makes people picture a flood. In practice the plan gets used for far more ordinary events: a failed server, a cloud provider having a bad afternoon, a fibre cut outside the building, a database that will not come back up after an update.
Why it matters to you
Because the decisions are much harder to make while everything is down. Under pressure, with staff waiting and clients calling, nobody wants to be working out which system to restore first, who is authorised to approve a rollback, or where the vendor support number is when the intranet holding it is offline.
A plan converts that into a checklist. It is not glamorous, and that is exactly the point.
What has to be in it
- The recovery order. Which systems come back first, decided in advance by what the business genuinely needs, not by what is easiest
- RTO and RPO per system, how long each can be down, and how much data can be lost
- Named roles, with a deputy for each, and phone numbers that do not depend on your network
- Step-by-step restore instructions specific enough for someone who did not build the system
- Communication: who tells staff, who tells clients, and what the first message says
- The dependencies, the systems that are useless without another one running
The part that decides whether it works
Testing. A plan that has never been run is an essay. The test does not have to be elaborate, restoring one important system to a separate environment and timing it tells you most of what you need, including the parts of the document that turn out to be wrong.
The findings are almost always the same and almost always surprising: the restore took three times longer than expected, one system needed a licence key nobody could find, and the plan referenced a person who left in the spring.
A common gap worth checking
Cloud services are not automatically covered. Microsoft 365 keeps your service running and protects you from their infrastructure failing; it does not protect you from a mailbox being deleted, a file being encrypted, or an account being taken over. Retention windows are shorter than most people assume. If your plan says “it is in the cloud”, find out for how long, and what happens after that.