Disaster recovery plan examples and best practices

5 disaster recovery plan examples

Disaster recovery planning should include multiple types of disasters to maximize the protection of your business operations. Here are examples of the most prevalent types, but you may need to plan for additional types depending on your business's unique characteristics.

Cybersecurity breach recovery plan

When starting your cybersecurity disaster recovery plan, you should carefully assess the risk and effect of a cybersecurity breach. A great cybersecurity plan includes the following elements:

• Your plan should establish recovery objectives by specifying the time needed to restore basic and then full operations or by indicating the maximum acceptable amount of data loss. These are known respectively as recovery time objectives (RTOs) and recovery point objectives (RPOs).
• It should detail your business’ data backup and protection measures, as well as your recovery strategies and solutions. 
• It should describe what the recovery team should communicate to those affected and involved and how they should disseminate that information. 

• It should include information about relevant documentation, maintenance activities, employee and stakeholder training, and regular testing of the plan itself.

Supply chain disruption recovery plan

PPRR, prevention, preparedness, response, and recovery, is a popular supply chain risk management approach. Your supply chain disruption recovery plan must address all four elements for maximum effectiveness and minimal business disruption.

To address prevention and preparedness, you should map each critical supply chain, highlighting which suppliers have alternatives in place and which do not.  Where you can access alternatives, your plan must detail how to invoke those alternatives and which stakeholders to notify.

Where no alternatives are available, you and your colleagues must ensure that your plan details which operations and teams are affected. You must also ensure your plan includes steps to inform those affected and advise them of specific actions to take in response to the disruption. Your plan should also guide rapid recovery once you have restored a supplier connection.

Infrastructure failure recovery plan

Your IT infrastructure failure recovery plan should mirror and complement your cybersecurity breach recovery plan. It must identify your critical infrastructure elements and include up-to-date, accurate, and complete details about hardware, software, and network configurations.

This plan should include information about alternatives, workarounds, and employees' actions when infrastructure fails. You should also include information about recovery from the failure of physical, non-IT infrastructure.

Data center outage recovery plan

Enterprises often designate critical data centers as automatically invoked "hot spare" or manually accessible "warm spare" backups. Your data center outage recovery plan must detail available backups for your critical data centers and explain how to access those backups.

Natural disaster recovery plan

Every natural disaster recovery plan should begin with detailed information about how and where critical data backups are stored and updated. Your company should store at least one backup offsite, preferably far enough away that a natural disaster affecting your business does not also affect your backup. You need to be able to securely access your offsite backups remotely, as natural disasters can hamper travel.

You should determine the types of natural disasters most likely to affect your business and plan for them. Local government agencies and online weather and climate resources can be valuable sources of information for the planning process.

Best practices for disaster recovery planning

Regardless of the plan you are creating, you should build it on these best practices.

• Identify and prioritize the disasters and threats your business is most vulnerable to.
• Prioritize your most critical operations so your recovery efforts focus on restoring those operations first.
• Define acceptable recovery objectives. You can express these in terms of acceptable data loss and operational disruption (recovery point objective) or time to restore operations (recovery time objective).
• Implement robust backup and recovery processes for critical business data. Keep at least one backup in a secure, offsite location and align access and recovery processes with your recovery objectives.
• Assemble a team to implement each recovery plan. Ensure that each team includes people with the necessary skills to achieve rapid, effective recovery from even the most serious disasters. Also include people who can communicate with and reassure stakeholders throughout recovery.

• Test and update your plans regularly. A disaster recovery plan that sits on a shelf will likely fail to meet your recovery objectives. Review and test your plans regularly to keep them current with evolving threats and business needs. Also, include plans for frequent and regular stakeholder education and training efforts as appropriate.

Use Jira Service Management for disaster recovery planning

As you've read above, disaster recovery planning is a challenging, critical, multifaceted element of business continuity planning. Multiple Jira Service Management features can simplify disaster recovery planning and make it more effective for you, your colleagues, and your business.

Jira Service Management provides a central platform to track tasks, incidents, and requests related to the disaster recovery process. This can speed collaboration among your disaster recovery team members and improve stakeholder communication. Issue tracking and reporting features help you monitor each recovery effort and modify them if and as needed. Jira Service Management also allows you to create disaster recovery information knowledge bases, allowing all team members to access the information quickly.

How do you write a disaster recovery plan?

Below are some basic steps to create a recovery plan for each disaster type relevant to your business.

1. Work with IT decision-makers and other stakeholders to identify, assess, and prioritize possible disasters and their associated risks.
2. Align these with your most critical business operations—document recovery objectives for each.
3. Describe how backup and recovery address these risks and objectives. Highlight any known gaps or shortcomings in current backup and recovery practices or solutions.
4. List and briefly describe the members of the disaster recovery team and the role each member plays.
5. Describe the testing schedule for the recovery plan and how you will measure each plan's test performance.
6. Share the plan with all stakeholders and seek input and feedback during and after plan creation, testing, and implementation.

What should a disaster recovery plan include?

At a minimum, you should include the following elements in every disaster recovery plan.

• Create a prioritized list of your most critical business operations and the disaster-related threats each face.
• Write a brief description of your current backup and recovery policies, processes, and technologies, highlighting any known shortcomings or gaps.
• Describe how current practices and solutions address the identified vulnerabilities.
• Create a disaster recovery team membership roster with a brief description of each member and their role.
• Write a schedule for regular plan testing and briefly describe how you will address any identified issues.

• Invite questions, comments, and suggestions from key stakeholders.

What kind of events should a disaster recovery plan cover?

Disaster recovery plans should address as many disaster scenarios threatening your business operations as possible. This article addresses areas you and your colleagues should consider mandatory for your business. Depending on the specific characteristics of your business and markets, you may also need to plan for additional disaster types.