Disaster recovery plan: what an SMB really needs to prepare

A disaster recovery plan is not a fifty-page document. It is the written answer to a simple question: if our IT stops right now, what do we do, in which order, and how long until we are back?

Two numbers to decide first

• RTO (recovery time): how many hours of downtime can you accept? A clinic says “two hours”, an accounting firm “one day”, except in tax season.
• RPO (acceptable data loss): how many minutes or hours of work can you lose? This number sets backup frequency.

These two values dictate the budget. A two-hour RTO requires standby servers ready to start; a 48-hour RTO is satisfied by good backups and replacement hardware on hand.

Scenarios to cover

Hardware failure, ransomware, fire or water damage, extended power cut, human error, departure of an administrator. Each scenario has a different answer. Ransomware, for instance, requires immutable backups and a network that can be isolated within minutes.

The plan itself, on one page

Who decides to trigger the plan. Who calls whom, with numbers. Where the backups are and how to reach them without the company network. In which order to restore: identity, network, email, ERP, files. How to inform customers and suppliers.

The test, or nothing

A DRP that has never been tested is a hypothesis. With our clients we run a timed full restore at least once a quarter, in an isolated environment, and update the document at every gap found.

The DRP is part of our cybersecurity service and of our high-availability virtualisation architectures.