Disaster Recovery Plan (DRP)

Disaster recovery focuses on technology. The plan lists which systems come back first, where backups are held, how failover to a secondary site or cloud environment works, and who authorises it. Its targets come from the business impact analysis: the recovery time objective says how fast a system returns, and the recovery point objective says how much recent data can be lost. Disaster recovery risk is the chance that these arrangements fail when needed, for example because backups are corrupt, the standby site is under-sized or staff do not know the steps. The plan is therefore tested, through failover tests and restores from backup. It forms part of business continuity but does not cover people, premises or suppliers. Auditors ask for the result of the last restore test rather than the plan document, since a failed test is cheaper to find in rehearsal than in an outage.

A logistics company hosts its order system in one data centre. Its DRP says that if the site fails, the system starts in a second region from replicated data, with a target restore time of four hours and no more than 15 minutes of lost orders. In a yearly test, the failover takes seven hours because a network setting was missed, and the team corrects it.