After reading, you can choose recovery means that match your targets, and prove they work with a real restore.
Definition
NIST SP 800-34 describes a disaster recovery plan as directing the recovery of information systems at an alternate site after a major disruption. ISO/IEC 27002 addresses the same ground in control 5.30, ICT readiness for business continuity.
It is one part of business continuity. Recovery brings the systems back, and the business plans cover how people keep working until then.
Why it matters
Most business processes stop when their system stops, so the recovery time of IT often sets the recovery time of the business.
Until someone has actually restored them, backups are only a hope. Plenty of companies have discovered on the worst possible day that theirs could not be used.
How it works
Take your recovery targets from the business impact analysis and rank the systems accordingly, taking dependencies into account.
Then choose the means: backups, replication, a cold, warm or hot alternate site, or another cloud region. Protect the backups as well, because attackers go after them first.
Write the steps in order and name who carries them out. Then restore for real, time it, and compare the result with your target.
A worked case
A company sets a 4-hour target for its order system. Its first restore test takes 9 hours, because the database cannot start before the identity service, which nobody had planned to bring back first.
The plan gets a new order of steps and a standby identity server. The next test takes 3 hours 40 minutes.
Good practices
- Keep one copy of your backups offline or immutable.
- Map dependencies down to identity, DNS and network. These are what usually hold up the restore.
- Keep the plan outside the systems it restores.
- Read your cloud contract to see what the provider covers and what stays with you.
Common mistakes
- Believing that replication is a backup. It faithfully copies corruption and encryption to the other site.
- Testing with a single file. Restoring a whole system in the right order is a very different exercise.
- Protecting backups with the same administrator accounts as production, so that one stolen password reaches both.
- Assuming a cloud service recovers your data by itself.
Questions
- What is the difference between hot, warm and cold sites?
- A hot site can take over almost at once, a warm site needs some preparation, and a cold site offers little more than space and power. Cost falls and recovery time rises in that order.
- What is the 3-2-1 rule for backups?
- Three copies of the data, on two types of media, with one off-site. It is a widely used practice, and no standard requires it.
- What is disaster recovery as a service?
- A provider replicates your systems and starts them on its own infrastructure when needed. Setting targets and testing remain your responsibility.
- Is a disaster recovery plan required by law?
- Some texts require one, such as DORA for financial entities. GDPR Article 32 requires the ability to restore the availability of personal data in a timely way.
- How often should a restore be tested?
- In proportion to how critical the system is. Critical systems are usually tested at least once a year, and after major changes.