IT Disaster Recovery Plan (DRP)
  • 13
    Jun

IT Disaster Recovery Plan (DRP)

Many of our clients ask us to help with IT disaster recovery plans. This guide explains what a plan is, what it should contain and how to build and test one for a small or medium-sized business.

What is an IT disaster recovery plan (DRP)?

An IT disaster recovery plan is a documented set of actions to take before, during and after an event that stops your IT working: a ransomware attack, a failed server, a fire or flood, a power or internet outage, a deleted or corrupted data set, or a supplier going down. The aim is to get the business running again quickly, with as little data loss as possible, and with everyone knowing what to do without having to work it out in the middle of a crisis.

Its main objectives are to:

  • minimise disruption to business operations
  • limit data loss
  • make sure backups are reliable and can actually be restored
  • keep your systems and data secure while you recover
  • restore operations in a known order, as quickly as possible

Good planning rests on three ideas: prevention (avoid the disasters you can), anticipation (plan for the ones you cannot) and mitigation (limit the damage when one happens).

Two numbers to agree first

  • Recovery time objective (RTO): how long the business can cope without a system before the impact becomes unacceptable.
  • Recovery point objective (RPO): how much recent data you can afford to lose. If the answer is “no more than an hour”, a nightly backup is not enough.

These numbers drive everything else, including which systems you back up, how often, and how much you spend.

Six steps to create a disaster recovery plan

  1. Form a recovery team. Decide who is responsible for what, with a named deputy for each role. In a small business that is usually the owner or a director, a senior member of staff from each key area, and your IT provider.
  2. Assess the risks. List the realistic threats (ransomware, hardware failure, theft, fire and flood, power and internet outages, human error, loss of a key supplier or cloud service) and what each would stop. This is a simple risk and business impact analysis; it does not need to be complicated.
  3. Prioritise your systems and processes. Rank them as essential, important or non-essential, and give each an RTO and RPO. Email, the line-of-business application, accounting and the phones are typical top-tier items.
  4. Collect the information you will need. This includes an inventory of equipment, software and licences, where your data lives (on-site, in the cloud and in backups), supplier and support contact numbers, key staff and customer contacts, and the admin credentials and recovery keys needed to rebuild systems. Keep a copy somewhere that will still be reachable if your network is down, such as a printed copy or a secure offline copy.
  5. Write the plan. Use a clear, standard format with step-by-step procedures for each scenario: who to call, what to do first, how to restore each system in priority order and how to communicate with staff and customers. Include how often the plan is reviewed and who owns it.
  6. Test the plan. A plan that has never been tested is a guess. Tests range from a simple checklist review to a walk-through of a scenario, a simulation, a parallel test (restoring systems alongside live ones) and a full interruption test. Start small, and always include a real restore of backup data, then update the plan with what you learn.

Backups are the foundation

Most recovery plans depend on backups, so check the basics:

  • Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site.
  • Keep at least one copy that ransomware cannot reach, such as an offline or immutable backup, because attackers often target the backups first.
  • Do not assume a cloud service is backing up your data for you. Check what your provider actually covers and for how long, and back up important cloud data (such as email and files) separately if needed.
  • Test restores regularly. A backup you have never restored is not proven to work.

A good disaster recovery plan limits the financial loss and disruption of an incident, helps you recover in an organised way, and protects the business’s data and reputation. If you need help with your business’s IT disaster recovery plan, please get in touch.

Need a hand? Lennox IT provides IT support for businesses in Derby, Nottingham and the East Midlands, and supports customers and sites across the UK. Get in touch or see our IT support plans.

Last reviewed: October 2026.

Leave a Reply