Disaster Recovery Plan

A plan that has never been tested is not a plan

Almost every organisation has backups. Very few know how long it would take to be operational if nothing started tomorrow, in what order systems must come back, who decides and who executes, or whether those backups are genuinely restorable. You only find that out by testing it, and the day of the incident is too late.

What regulation requires it

• NIS2: business continuity, backup management and disaster recovery are explicitly required measures.
• DORA: digital continuity policy and mandatory periodic testing for the financial sector.
• ISO 22301: the international business continuity standard.

What we do

Business impact analysis (BIA). Which processes cannot stop, what each hour of downtime costs and which systems support them. Without this, prioritising is guesswork.

RTO and RPO definition per service. How long it can take to come back and how much data you can afford to lose. Agreed with the business, not imposed by IT.

Recovery strategy design. Backup architecture, replication, alternative sites and third-party dependencies.

Plan authoring. Procedures that can be executed by whoever is on call at three in the morning, with roles, call tree and activation criteria.

Real testing. From tabletop walkthroughs to full simulation with actual restoration. What is not tested does not count.

What you get

• Business impact analysis report with the criticality of each process.
• RTO and RPO matrix agreed with management.
• Documented, ready-to-execute recovery plan.
• Test results report with the real measured times.
• Testing and review calendar.

Frequently asked questions

We already have backups. Is that not enough? Backups are an ingredient. The plan is the recipe: in what order, in how long, with which resources and who is in charge while the crisis lasts.

How long does it take? The impact analysis and the plan, four to eight weeks depending on size. Testing is scheduled separately.

Do systems need to be stopped to test? Not necessarily. Testing can restore into an isolated environment without touching production.