What a recovery plan should cover

The questions it answers

• What matters most? A list of systems, ranked by how badly the business needs them: email, accounting, the shared drive, phones, the line-of-business system.
• How fast? For each, the longest the business can be without it, called the recovery time.
• How much loss is acceptable? How much recent work the business could re-enter if it had to: an hour, a day? This is the recovery point, and it decides how often backups run.
• From where? Which backup is used, where it is kept, and what happens if the office itself is unavailable.
• Who does what? Who declares an emergency, who restores, who talks to staff and clients, and their phone numbers outside of company systems.
• How do we keep working meanwhile? Paper forms, a different office, people working from home.

What makes it useful

• It is short. People need to follow it under stress.
• It is stored somewhere you can reach when company systems are down, including a printed copy.
• It is tested. A restore test proves the backups work. A walk-through proves people know the plan.
• It is updated when systems, vendors or people change.

A plan that has never been tested is a guess written down.