Picture a normal Tuesday. Email is flowing, orders are coming in, and then the file server stops responding. Maybe it is ransomware. Maybe a drive failed, a pipe burst above the server room, or someone deleted a shared folder. The cause matters less than what happens next. In a business without a disaster recovery plan, the next few hours are spent working out who to call, what is backed up, and whether the backups even work.
What the first 48 hours look like without a plan
- Nobody is sure who is in charge. Decisions stall or contradict each other.
- Nobody knows what matters most. Every system seems urgent, so none is restored in a sensible order.
- Contact details are on the machine that is down. Supplier numbers, passwords and licence keys sit on the very system you cannot reach.
- Backups turn out to be incomplete or untested. The backup job ran every night, but the restore has never been tried.
- Customers hear nothing. Silence does more damage to trust than the outage itself.
The cost is not only IT time. It is lost sales, staff sitting idle, missed deadlines and, for regulated businesses, possible reporting duties.
What a disaster recovery plan actually is
A plan is a short, written document that answers four questions: what are we protecting, how quickly must it come back, how do we bring it back, and who does what. It sits under a broader business continuity plan, which covers how the business keeps operating, including people, premises and suppliers, while IT recovers.
Step 1: List what matters
Rank your systems by how much it hurts when they are down. Email, customer data, accounting and a line of business application usually come first. A printer does not.
Step 2: Set recovery targets
Two terms do most of the work. RTO (recovery time objective) is how long you can be without a system. RPO (recovery point objective) is how much recent data you can afford to lose. Understanding RTO vs RPO is the key to choosing the right backup method and budget.
| Term | Plain meaning | Example |
|---|---|---|
| RTO | How fast we must be back | Email restored within 4 hours |
| RPO | How much data loss is acceptable | No more than 1 hour of work |
A business that can lose a day of work needs a different solution from one that cannot lose an hour. Tighter targets cost more, so set them by business need, not by instinct.
Step 3: Back up properly
Follow the 3-2-1 approach: three copies of your data, on two different types of storage, with one copy off site or in the cloud. Make at least one copy immutable or offline so that ransomware cannot encrypt it. Good backup and disaster recovery also covers Microsoft 365, which is not backed up in the way many people assume. See our guide to cloud backup for what to look for.
Step 4: Write down the response
Record who declares an incident, who calls the IT provider and insurer, who speaks to customers, and where the printed contact list lives. Pair it with an incident response plan for security events, so a cyberattack is handled with the same discipline as a hardware failure.
Step 5: Test it
An untested plan is a hope. Restore a real file, then a whole system, and time it. Run a short tabletop exercise once or twice a year: “It is 9 a.m. and the server is encrypted. What do we do?” Update the plan after every test.
A quick self check
If you want a wider view first, our free IT risk assessment covers backups alongside other risks.
- Can you name your top five systems and their recovery order?
- Do you know your RTO and RPO for each?
- Have you restored from backup in the last six months?
- Is at least one backup copy out of reach of an attacker?
- Is the plan printed and stored somewhere not dependent on your network?
If you answered no to two or more, you have a gap worth closing now. Our disaster recovery team builds plans for Toronto businesses and tests them with you.
We will review your backups, set realistic targets and test a restore with you.
Talk to our recovery teamFrequently asked questions
How long should a disaster recovery plan be?
A few clear pages is better than a long document nobody reads. Keep it practical and keep it current.
Is a backup the same as a disaster recovery plan?
No. A backup is a copy of data. A plan covers how and how quickly you restore, in what order, and who does it.
How often should we test?
Test restores at least twice a year and after any major change to your systems.
Does cyber insurance require a plan?
Many insurers ask about backups, testing and incident response when you apply or renew, so documenting them helps.
Related service: Disaster Recovery
Last updated
