Disaster recovery plan: writing one for an SME

A disaster recovery plan (DRP) sets out what to do, in what order and by whom, when a major incident makes IT unavailable. For an SME, a short document that is actually used is worth more than a complete binder that nobody has read.

Identify what is critical

• List the essential activities: invoicing, production, customer reception, payroll.
• Match each one with the systems it depends on: e-mail, ERP, file server, telephony, Internet.
• Estimate the impact of an interruption lasting an hour, a day, a week.
• Derive the order of priority for bringing systems back into service.

Set realistic objectives

For each critical system, set the acceptable downtime (RTO, recovery time objective) and the acceptable data loss (RPO, recovery point objective). These objectives must be consistent with the backups actually in place and with the budget: a one-hour objective for everything is rarely realistic.

What the plan contains

• The scenarios: server failure, ransomware, loss of the premises, Internet outage, unavailability of a cloud service.
• The contacts: management, IT provider, insurer, bank, carriers, key suppliers.
• The restore procedures, system by system.
• Degraded mode: how to keep working without the system (phone, paper, emergency access).
• Communication: who informs employees, customers and partners, and with what messages.

Make it accessible on the day

A plan stored only on the server that has failed is of no use. Keep a printed copy and a copy outside the company network, available to the people who will need it.

Test and update

• A tabletop exercise once a year: walk through a scenario and check that everyone knows what to do.
• Regular restore tests.
• An update with every significant change: new system, new provider, new premises.