Disaster recovery planning: a practical guide for UK businesses

Ask most businesses whether they have a disaster recovery plan and they'll say "we have backups". Backups are essential, but a backup you've never restored, with no plan for who does what, is a hope rather than a plan.

What a disaster recovery plan covers

A disaster recovery (DR) plan sets out how your business gets its IT systems and data back after a serious disruption, such as:

• A cyber attack or ransomware
• Hardware or cloud service failure
• Fire, flood or loss of a building
• Accidental deletion or corruption of key data
• Loss of a key supplier or internet connection

It answers three questions: what needs recovering, in what order, and how quickly.

Step 1: Work out what matters most

Start with a simple business impact assessment. For each key system, email, accounts, job management, ERP, file storage, phones, ask:

• What happens if this is unavailable for an hour? A day? A week?
• Who depends on it, inside and outside the business?
• What would it cost in lost work, missed orders or penalties?

Step 2: Set your recovery targets

Two terms do most of the work in disaster recovery:

• RTO (Recovery Time Objective): how long you can tolerate a system being down
• RPO (Recovery Point Objective): how much data you can afford to lose, measured in time (e.g. "no more than 4 hours of work")

Shorter targets cost more. The aim is to agree targets that match the real business impact, not to make everything instant.

Step 3: Make backups that survive an attack

Ransomware deliberately looks for backups to encrypt or delete. The NCSC advises that all businesses take regular backups of their important data and make sure those backups are recent and can be restored. In practice, we look for:

• Multiple copies in different locations, including at least one offsite or in the cloud
• At least one copy kept separate from your main network and accounts, so an attacker can't reach it
• Backups of cloud services too: Microsoft 365 and similar platforms are not a full backup by default
• Monitoring, so you know when a backup fails

Step 4: Write the plan down

A DR plan should be short enough to use under pressure. Include:

• Contact details for staff, IT partners, suppliers and insurers
• Who has authority to declare a disaster and make decisions
• Step-by-step recovery order for each critical system
• Where backups are and how to restore them
• How you'll communicate with staff and customers
• Printed or offline copies, you can't open a plan stored on the server that's down

Step 5: Test it

An untested plan will fail at the worst moment. At least once a year:

• Restore real data from backup and check it's complete
• Walk through a scenario: "ransomware hits on Monday morning, what now?"
• Update the plan with what you learned

Disaster recovery vs business continuity

Disaster recovery focuses on IT systems and data. Business continuity is wider: how the whole business keeps operating, people, premises, suppliers and customers. A good DR plan is a core part of business continuity, and the two should be written together.

How we can help

We design and test disaster recovery for businesses of all sizes, drawing on experience protecting hyperscale data centres where downtime is not an option. That includes the business impact assessment, backup and recovery design, the written plan and a tested recovery, so you know it works before you need it.