DBT – Digital Box Technologies ·
Backup protects data. A disaster recovery plan defines how applications are brought back: recovery time and recovery point objectives (RTO, RPO), priorities, standby resources and responsibilities.
Apply the 3-2-1 rule: three copies, on two different media, one off site. Add an immutable copy to withstand ransomware, which now targets backups first.
Document the restart order: directory, databases, then business applications. Without it, recovery takes far longer than expected.
Above all, test restores regularly. A backup that has never been restored is only an assumption.
Turn objectives into measurable criteria
RPO describes acceptable data loss; RTO is the target time to restore a service. For example, a business team might request at most one hour of lost data and recovery within four hours. These are objectives to validate, not a technical promise. Measure retrieval, startup, checking and handover time to establish whether a scenario meets them.
Protect backup administration too
An extra copy is insufficient if one account can erase every copy. Review permissions, separated access, key management and the ability to recover when the primary directory is unavailable. Immutability mechanisms and retention periods must be tested and understood. They do not remove the need to monitor failures or check that backup coverage remains complete.
Exercise application recovery
Restore in an isolated, authorised environment. Once systems start, ask the business owner to perform a representative operation: open a case, inspect a transaction or generate a document. Record discrepancies and missing access. This distinguishes a running server from an application people can actually use.
Keep the runbook current
Assign a recovery-plan owner and review it after major application, network or supplier changes. The document must remain accessible when the primary IT environment is down. After a security incident, check that its cause has been addressed before reconnecting restored systems. Security and business owners should participate in that decision.