What it covers
The systems in recovery order, with their RTO and RPO targets. Where recovery happens: a secondary site, another cloud region or rebuilt infrastructure. Step by step restore procedures, the location and protection of backups, roles and contact details, supplier contacts, and how to verify that restored systems are clean and working.
DRP and business continuity
The business continuity plan keeps the business operating during a disruption, including manual workarounds, communication and people. The DRP focuses on bringing technology back. Both are driven by the same business impact analysis.
Planning for ransomware
Traditional disaster recovery assumed a hardware failure or a fire. Ransomware changes the assumptions: backups and replicas may be encrypted, administrator accounts compromised and attackers still present. Plans should include immutable or offline backups, a clean recovery environment, rebuilding identity systems first and checking for persistence before reconnecting systems.
Testing
An untested plan usually fails when it is needed. Common tests include restoring individual systems, full failover exercises and tabletop exercises. ISO 27001 requires ICT readiness to be planned, implemented and tested (Annex A 5.30), and DORA requires financial entities to test their backup and recovery capabilities.
