An IT disaster recovery plan (DRP) answers one question: if your tools stop responding tomorrow morning, how do you get back to work? It sets out what to restore first, how quickly, from which copies, and who takes charge. For a business of five to fifty people it fits in a few pages, and it is only worth something once it has been tried.
What a recovery plan covers, and what it leaves to continuity
Disasters come in several shapes. Ransomware encrypts the files. An administrator account is compromised and someone deletes mailboxes. A server fails and won’t restart. A leak floods the comms cupboard.
The business continuity plan aims to keep going, or to run the essentials in a reduced way. The recovery plan takes over once things have stopped: it describes the way back. The incident management plan organises the first minutes (who to call, what to check). A small business can keep all three in one document, as long as each part answers its own question.
How to build an IT disaster recovery plan
List what keeps the business running
Start from what the business does: invoicing, answering clients, paying suppliers, delivering the work. For each, note the tools it depends on: email, shared files, accounting software, a hosted business application, online banking. Then add what always gets forgotten: the domain name and who it is registered with, administrator accounts, licences, the logins for online services.
Set two figures for each tool
The first is how long you can be without it, the recovery time objective (RTO). Email might cope with half a day; invoicing three days at month end, two weeks the rest of the time.
The second is how much recent work you can afford to lose, the recovery point objective (RPO). Restore last night’s copy and you lose a day. Can the accounts live with that? The client files?
Those two figures drive everything else. A nightly backup can’t meet a one-hour target. A server that has to be bought and rebuilt won’t be back in four hours.
Check the copies exist, and would survive
For each tool, note where its copy lives, how often it is taken and how long it is kept. Keeping copies too briefly is a classic trap: the mistake comes to light three weeks later and the oldest copy is a fortnight old. We explain this in the difference between retention and backup.
Attackers go after backups too. France’s national cybersecurity agency, ANSSI, puts it plainly in its golden rules for backup (in French): take offline backups regularly, disconnected from your systems, and define a restore strategy tied to the recovery plan. In practice, at least one copy must be impossible to delete from your everyday accounts.
Microsoft 365 has limits worth knowing before the day comes. A file deleted from SharePoint or OneDrive stays in the recycle bin for 93 days, then disappears. A mailbox emptied by a compromised account, or an encrypted library, needs a dedicated backup.
Write down the order of recovery and who does what
The plan states the order: accounts and email first, so people can talk and clients can be told, then files, then business applications. It also says who decides (usually the person who runs the company), who carries it out (your provider, a member of staff) and who speaks to clients.
Add a contact list that doesn’t depend on your email: provider, insurer, bank, the supplier of your business software, with phone numbers. Keep the plan outside the systems it is meant to restore, on paper and in a separate space.
Plan the reduced mode
While recovery runs, the business carries on as best it can. Decide in advance what is acceptable: invoices by hand for two days, replying to clients from phones, read-only access to the files that matter most. ANSSI advises involving management in these choices, because they touch your relationship with clients.
Testing a disaster recovery plan without stopping the business
A plan nobody has tried rests on assumptions, and the test that checks them can stay simple.
Start with a real restore: a SharePoint folder, a mailbox, the accounting database, brought back into a test space. Time it and compare it with the target you set. This is often where you find a copy is incomplete, an encryption password is known only to someone who left, or a restore takes a day where you hoped for an hour.
Then run a tabletop exercise, an hour around one scenario: “Monday, 8am, nobody can sign in.” Walk through the plan out loud, step by step. The gaps show quickly: a missing contact, access only the provider holds, a decision nobody feels able to take.
After an attack there is one more precaution: your backups may contain whatever let the intruder in. Restore from trusted sources, and change credentials before people go back to work.
Write down what was missing, fix it and date the test. A test a year and a quarterly review of contacts and access keep the plan current.
What going without one costs
Without a plan, recovery is invented in the middle of the crisis. Decisions get made under pressure and often in the wrong order: rebuilding before the attack is understood, restoring a copy that was already affected, discovering the backup never covered the software that matters most. Each day of downtime is paid for in lost revenue, work done twice and clients’ confidence.
What InfraPro does
We build the plan with you: the inventory of what matters, the two figures for each tool, the copies that meet them, the order of recovery. For your data we set up backup for the whole company, with a copy out of reach of your everyday accounts, and we test restores for real. When servers or business applications need to be able to restart elsewhere, that is what our Off-site offer is for. 24/7 monitoring, which shortens the time between an attack and its detection, we discuss case by case. If your business doesn’t have a written plan yet, it’s a conversation worth having before you need one.
