What a DRP is
A disaster recovery plan (DRP) is a document on how to restore IT infrastructure, systems and data after a failure, an accident or a cyberattack. A DRP answers the question “how do we get the technology and data back?”, while a BCP answers “how do we keep the whole business going?”
DRP and BCP: the difference
| BCP | DRP | |
|---|---|---|
| What it restores | Whole business processes | IT systems and data |
| Who is responsible | Business + management | IT / information security |
| Example | How to replace a supplier that has dropped out | How to bring servers back up from a backup |
A DRP is usually the technical part of a BCP. More about the levels in the article “BCM, BCP, DRP: the difference”.
What a DRP includes
- A list of critical systems and their recovery priorities.
- RTO and RPO for each system.
- Backup: what, where and how often, plus isolated (offline) copies against ransomware.
- Backup infrastructure: spare capacity, cloud, sites.
- Step-by-step recovery procedures and the people responsible.
- Testing of recovery from backups on a regular basis. Do not wait until “disaster strikes”.
You can test whether a system restores from a backup within the stated time in a ransomware readiness check.
Frequently asked questions
Are a DRP and a BCP the same thing?
No. A DRP is about restoring IT systems and data. A BCP is about the continuity of the whole business (processes, people, suppliers, communications). The DRP is usually the IT part of the BCP.
How often should a DRP be tested?
At least once a year, and more often for critical systems. The test must include an actual restore from a backup. Checking that the backup exists is not enough.
How do you protect backups from ransomware?
Keep isolated (offline or immutable) copies separated from the main network, and test restoring from them regularly.
Check your recovery numbers
The assessment shows where the recovery times the business needs do not match what the technology can deliver. After that, either your specialist calculates these numbers, or we do.
