A disaster does not have to be a flood or fire. A failed server, a ransomware attack or a mistaken deletion can stop a business just as effectively. A written plan turns a crisis into a checklist. Use this disaster recovery plan template as a structure, then fill in the details for your organisation.
The template
1. Purpose and scope
State what the plan covers: which systems, locations and scenarios. Name who approves it and when it was last reviewed.
2. Roles and contacts
List who declares a disaster, who leads recovery, who talks to staff and clients, and how to reach them if email is down. Include vendors and your IT provider.
3. System inventory and priority
List every system, what it does and who depends on it. Rank them: what must return first? Email and the accounting system may come before a marketing tool.
4. Recovery targets
Set an RTO and an RPO for each system. Understanding RTO vs RPO is essential: RTO (recovery time objective) is how long a system can be down, and RPO (recovery point objective) is how much recent data you can afford to lose. A system with a four hour RTO and a fifteen minute RPO needs a very different design from one with a two day RTO and a daily RPO.
5. Backup and replication
Describe what is backed up, how often, where copies are kept and who monitors them. Backup and disaster recovery work together: backups restore data, while recovery tooling restores services. Options include cloud backup for business and Azure Site Recovery for replicating servers.
6. Recovery procedures
Write step by step instructions for each priority system, with login details held securely and offline. Include dependencies and the order of restoration.
7. Communication
Prepare messages for staff, clients and regulators. Decide who speaks for the business.
8. Alternate working arrangements
How will people work if the office or systems are unavailable? Consider remote access, spare devices and manual workarounds.
9. Testing and review
Test the plan at least once a year with a real restore. Record what failed and fix it.
| Section | Key detail |
|---|---|
| Systems | Priority order and owner |
| RTO | Maximum acceptable downtime |
| RPO | Maximum acceptable data loss |
| Backups | Frequency, location, last test |
| Contacts | Names, numbers, backups for backups |
Disaster recovery vs business continuity
A business continuity plan is wider: it covers people, premises, suppliers and customers. Disaster recovery focuses on technology. Both matter, and each supports the other.
Mistakes to avoid
- Keeping the plan only on the server that fails
- Never testing restores
- Forgetting cloud data such as Microsoft 365
- Leaving out contact details for key people
- Not updating after changes
Read what can happen without one in what happens if you do not have a disaster recovery plan. Our disaster recovery team can build and test one with you, and our remote backup service covers the copies.
We help you set recovery targets, build the plan and test it.
Explore disaster recoveryFrequently asked questions
How often should we test the plan?
At least annually, and whenever systems change significantly.
What is a realistic RTO for a small business?
It depends on the system. Email may be hours, and specialised systems may be longer. Decide based on what downtime costs.
Where should the plan be stored?
Somewhere accessible when your systems are down, such as a secure cloud location plus a printed copy.
Related service: Disaster Recovery
Last updated
