What is an IT disaster recovery plan?

IT disaster recovery plans provide step-by-step procedures for recovering disrupted systems and networks, and help them resume normal operations. The goal of these processes is to minimise any negative impacts to company operations. The IT disaster recovery process identifies critical IT systems and networks; prioritise their recovery time objective; and delineates the steps needed to restart, reconfigure, and recover them. A comprehensive IT DR plan also includes all the relevant supplier contacts, sources of expertise for recovering disrupted systems and a logical sequence of action steps to take for a smooth recovery.

Assuming you have completed a risk assessment and have identified potential threats to your IT infrastructure, the next step is to determine which infrastructure elements are most important to the performance of your company’s business. Also assuming that all IT systems and networks are performing normally, your firm ought to be fully viable, competitive and financially solid. When an incident — internal or external — negatively affects the IT infrastructure, the business could be compromised.

According to National Institute for Standards and Technology, Contingency Planning for Information Technology Systems, the following summarises the ideal structure for an IT disaster recovery plan:

  • Develop the contingency planning policy statement. A formal policy provides the authority and guidance necessary to develop an effective contingency plan.
  • Conduct the business impact analysis (BIA). The business impact analysis helps to identify and prioritise critical IT systems and components.
  • Identify preventive controls. These are measures that reduce the effects of system disruptions and can increase system availability and reduce contingency life cycle costs.
  • Develop recovery strategies. Thorough recovery strategies ensure that the system can be recovered quickly and effectively following a disruption.
  • Develop an IT contingency plan. The contingency plan should contain detailed guidance and procedures for restoring a damaged system.
  • Plan testing, training and exercising. Testing the plan identifies planning gaps, whereas training prepares recovery personnel for plan activation; both activities improve plan effectiveness and overall agency preparedness.
  • Plan maintenance. The plan should be a living document which is updated regularly to remain current with system enhancements.