What are the 5 steps of disaster recovery? Assess your risks, set recovery targets, list and back up your systems, write down who does what, and test the plan. This is our own five-step grouping for a small office. Where a point comes from Ready.gov, NIST or CISA, we say so.
Key takeaways
A disaster recovery plan answers one question: how do we get our systems and data back, and in what order?
The two numbers to set early are how long you can be down and how much data you can afford to lose.
Ready.gov says to test the plan periodically, so put the test on the calendar before you need it.
Disaster recovery is the part of your IT planning that covers getting back to work after a major failure or loss of facilities. NIST defines a disaster recovery plan as a written plan for recovering one or more information systems at an alternate facility.
Ready.gov tells businesses to develop an IT disaster recovery plan, and the five steps below are our way of organizing that work.
What are the 5 steps of disaster recovery? The short list
Here are the disaster recovery plan steps in order, with the question each one answers and what you should have in hand when it is done.
Disaster recovery plan steps at a glance
Step
Question it answers
What you end up with
1. Assess risk and impact
What could go wrong, and what would it cost us?
A ranked list of critical business functions
2. Set recovery objectives
How long can we be down, and how much data can we lose?
An RTO and an RPO for each critical system
3. Inventory and back up
What do we have, and is it protected?
An asset list and a backup strategy
4. Assign roles and write procedures
Who does what, and who do we tell?
A written plan with contacts and recovery steps
5. Test and update
Does it actually work?
Test results and a revised plan
The first three steps are about knowing your own business. The last two turn that knowledge into something your team can follow on a bad day.
Disaster recovery steps 1 to 3: know the risk, set targets, list your assets
Step 1: Assess risk and business impact
Start with a business impact analysis. Ready.gov explains that it predicts the consequences of a disruption to your business. Potential loss scenarios are identified during a risk assessment, so this is the time to ask what could take your systems down.
The useful output is an order of priority. Ready.gov says the business processes with the greatest operational and financial impacts should be restored first. Ask which functions your team cannot work without, such as email, your main business application, shared files or phones, and rank them. Write that ranking down. It guides every later choice.
Step 2: Set recovery objectives (RTO and RPO)
Two terms matter here, and they are simpler than they sound. NIST’s definition of the recovery time objective (RTO) is the overall length of time a system’s components can be in the recovery phase before the business is negatively affected. NIST defines the recovery point objective (RPO) as the point in time to which data must be recovered after an outage.
In plain terms: RTO is how long you can be down, and RPO is how much recent work you can afford to lose. If your accounting system can be offline for an afternoon but cannot lose a day of entries, that is your answer for that system. Set a pair of numbers for each critical system from step 1, and be honest about them.
Step 3: Inventory your assets and back them up
Ready.gov says an IT disaster recovery plan begins with an inventory of hardware such as servers, desktops, laptops and wireless devices. Add your software, cloud accounts, licenses and the people or vendors who support each one. You cannot recover what you forgot you had.
Then the plan needs a strategy that makes sure all critical information is backed up. CISA’s ransomware guidance adds that you should keep offline, encrypted backups of critical data and regularly test their availability and integrity.
Steps 4 and 5 of a disaster recovery plan: assign roles, then test
Step 4: Assign roles and write the procedures
Now put it on paper. Name who declares a disaster, who restores which system, and who calls customers and staff. Then ask whether your contact list would still be reachable if your network were down.
Ready.gov notes that the recovery time for an IT resource should match the recovery time objective. So every procedure should say which system it restores and by when. If a procedure cannot meet the target from step 2, either change the target or change the preparation.
Keep disaster recovery and business continuity apart in your head. NIST describes a business continuity plan as documented instructions for how mission and business processes are sustained during and after a significant disruption. Your recovery plan is the IT piece of that larger picture.
Step 5: Test the plan and update it
A disaster recovery plan has to be tested periodically to confirm it works.
When you test, check that your backups restore and that the contact details and roles in the plan are still right. CISA also advises testing backup procedures on a regular basis. After each test, write down what needs to change, and ask whether new servers, a move or a new vendor mean the plan needs another look.
A disaster recovery plan template you can copy
Use this as a starting template. Fill in each line for your own office.
List your critical business functions in the order they must come back.
Write an RTO and an RPO beside each critical system.
Record every server, device, cloud account and license you depend on.
Confirm where backups live and that at least one copy is offline.
Name the person who declares a disaster and a backup person.
Collect contact details for staff, customers, vendors and your IT provider.
Schedule a restore test and put the date on the calendar.
Review the plan after every change to your systems.
Not sure your backups are ready?
Tell us about your office, and we will walk you through the options.
How to create a disaster recovery plan: common questions
How do you create a disaster recovery plan for a small business?
Work through the five steps above in order. Rank your critical functions, set an RTO and RPO for each, inventory your assets and backups, write down roles and procedures, then test. The Ready.gov IT recovery plan page is a good public reference to check your plan against.
What is the difference between backup and disaster recovery?
A backup is a copy of your data. Disaster recovery is the plan that uses that copy, plus the people, order and targets, to get the business running again. You need both. Backups without a plan leave you guessing about what to restore first, and a plan without good backups has nothing to restore.
What is the difference between RTO and RPO?
RTO is how long a system can stay in recovery before the business is hurt. RPO is the point in time to which your data must be recovered. For example, if a system must be back within two hours and may lose at most a day of data, its RTO is two hours and its RPO is one day. Set both for every critical system.
How often should you test a disaster recovery plan?
Ready.gov says to test the plan periodically, and CISA says to test backup procedures on a regular basis. Pick a rhythm you can keep, write it into the plan, and ask your IT provider what fits your systems.
What is the difference between disaster recovery and business continuity?
Disaster recovery restores IT systems and data. Business continuity is wider: FEMA describes continuity as the ability to provide uninterrupted critical services, essential functions and support. Disaster recovery is the IT part of that larger effort.
The Bottom Line: What Are the 5 Steps of Disaster Recovery?
Start with what matters most. A business impact analysis sets the order in which functions are restored, so you spend effort where an outage costs the most.
Set your RTO and RPO before you buy anything. How long you can be down and how much data you can lose decide what your backups and recovery setup need to do.
Know what you own and where it is backed up. An inventory and a backup strategy, with an offline copy, are the base of the whole plan.
Write down who does what. Roles, contacts and procedures on paper mean nobody has to improvise.
Test it, then keep it current. Test the plan, and review it whenever your systems change.
Your next step: turn the five steps into a plan that works
The five steps are easy to read and take real time to do. If nobody in your office has that time, ask your IT provider how they can help.
What Are the 5 Steps of Disaster Recovery? A Plain Guide
What are the 5 steps of disaster recovery? Assess your risks, set recovery targets, list and back up your systems, write down who does what, and test the plan. This is our own five-step grouping for a small office. Where a point comes from Ready.gov, NIST or CISA, we say so.
Key takeaways
In this guide
What is disaster recovery?
Disaster recovery is the part of your IT planning that covers getting back to work after a major failure or loss of facilities. NIST defines a disaster recovery plan as a written plan for recovering one or more information systems at an alternate facility.
Ready.gov tells businesses to develop an IT disaster recovery plan, and the five steps below are our way of organizing that work.
What are the 5 steps of disaster recovery? The short list
Here are the disaster recovery plan steps in order, with the question each one answers and what you should have in hand when it is done.
The first three steps are about knowing your own business. The last two turn that knowledge into something your team can follow on a bad day.
Disaster recovery steps 1 to 3: know the risk, set targets, list your assets
Step 1: Assess risk and business impact
Start with a business impact analysis. Ready.gov explains that it predicts the consequences of a disruption to your business. Potential loss scenarios are identified during a risk assessment, so this is the time to ask what could take your systems down.
The useful output is an order of priority. Ready.gov says the business processes with the greatest operational and financial impacts should be restored first. Ask which functions your team cannot work without, such as email, your main business application, shared files or phones, and rank them. Write that ranking down. It guides every later choice.
Step 2: Set recovery objectives (RTO and RPO)
Two terms matter here, and they are simpler than they sound. NIST’s definition of the recovery time objective (RTO) is the overall length of time a system’s components can be in the recovery phase before the business is negatively affected. NIST defines the recovery point objective (RPO) as the point in time to which data must be recovered after an outage.
In plain terms: RTO is how long you can be down, and RPO is how much recent work you can afford to lose. If your accounting system can be offline for an afternoon but cannot lose a day of entries, that is your answer for that system. Set a pair of numbers for each critical system from step 1, and be honest about them.
Step 3: Inventory your assets and back them up
Ready.gov says an IT disaster recovery plan begins with an inventory of hardware such as servers, desktops, laptops and wireless devices. Add your software, cloud accounts, licenses and the people or vendors who support each one. You cannot recover what you forgot you had.
Then the plan needs a strategy that makes sure all critical information is backed up. CISA’s ransomware guidance adds that you should keep offline, encrypted backups of critical data and regularly test their availability and integrity.
Steps 4 and 5 of a disaster recovery plan: assign roles, then test
Step 4: Assign roles and write the procedures
Now put it on paper. Name who declares a disaster, who restores which system, and who calls customers and staff. Then ask whether your contact list would still be reachable if your network were down.
Ready.gov notes that the recovery time for an IT resource should match the recovery time objective. So every procedure should say which system it restores and by when. If a procedure cannot meet the target from step 2, either change the target or change the preparation.
Keep disaster recovery and business continuity apart in your head. NIST describes a business continuity plan as documented instructions for how mission and business processes are sustained during and after a significant disruption. Your recovery plan is the IT piece of that larger picture.
Step 5: Test the plan and update it
A disaster recovery plan has to be tested periodically to confirm it works.
When you test, check that your backups restore and that the contact details and roles in the plan are still right. CISA also advises testing backup procedures on a regular basis. After each test, write down what needs to change, and ask whether new servers, a move or a new vendor mean the plan needs another look.
A disaster recovery plan template you can copy
Use this as a starting template. Fill in each line for your own office.
Not sure your backups are ready?
Tell us about your office, and we will walk you through the options.
Request a Free Network Audit
How to create a disaster recovery plan: common questions
How do you create a disaster recovery plan for a small business?
Work through the five steps above in order. Rank your critical functions, set an RTO and RPO for each, inventory your assets and backups, write down roles and procedures, then test. The Ready.gov IT recovery plan page is a good public reference to check your plan against.
What is the difference between backup and disaster recovery?
A backup is a copy of your data. Disaster recovery is the plan that uses that copy, plus the people, order and targets, to get the business running again. You need both. Backups without a plan leave you guessing about what to restore first, and a plan without good backups has nothing to restore.
What is the difference between RTO and RPO?
RTO is how long a system can stay in recovery before the business is hurt. RPO is the point in time to which your data must be recovered. For example, if a system must be back within two hours and may lose at most a day of data, its RTO is two hours and its RPO is one day. Set both for every critical system.
How often should you test a disaster recovery plan?
Ready.gov says to test the plan periodically, and CISA says to test backup procedures on a regular basis. Pick a rhythm you can keep, write it into the plan, and ask your IT provider what fits your systems.
What is the difference between disaster recovery and business continuity?
Disaster recovery restores IT systems and data. Business continuity is wider: FEMA describes continuity as the ability to provide uninterrupted critical services, essential functions and support. Disaster recovery is the IT part of that larger effort.
The Bottom Line: What Are the 5 Steps of Disaster Recovery?
Your next step: turn the five steps into a plan that works
The five steps are easy to read and take real time to do. If nobody in your office has that time, ask your IT provider how they can help.
At CFL Technology Source, we are in Winter Park and support businesses across Orlando and Central Florida. Our backup and disaster recovery services cover local and offsite backup, monitoring of backup routines, and recovery after a failure, an accidental deletion or a disaster. If you want the background first, read our guide on what disaster recovery means for a small business, or browse more backup and disaster recovery articles.
Questions about backup and recovery for your office?
Share what you have today, and we will talk through the options.
Talk to a Local IT Expert
Archives
Categories
Archives
Recent Post
Categories
Portfolio
Meta
Calender