A disaster recovery plan is useful only if people can follow it when systems are down and stress is high. Use this checklist to find gaps.
Foundations
- A business impact analysis that ranks systems by criticality
- Agreed recovery time and recovery point objectives per system
- A current inventory of systems, dependencies and owners
Protection
- Backups that follow the 3-2-1-1-0 rule, with an immutable or offline copy
- Replication for systems with tight objectives
- Documented network, DNS and identity recovery
Response
- Named roles and contact lists, including out-of-hours
- Decision criteria for declaring a disaster
- Communication templates for staff, customers and regulators
Proof
- Scheduled restore tests with recorded results
- A full recovery exercise at least once a year
- Plan updates after every significant change
Keep a printed or offline copy of the plan. If your plan lives only on the systems that are down, it will not help.