Turn Your Vision into Success, Let It Fly with Us
Ensure Your Business Is Secure, Compliant & IT-Ready
IT Disaster Recovery Plan Example
Table of Contents
IT Disaster Recovery Plan
An IT Disaster Recovery Plan explains how an organisation will recover its technology, applications and data following an IT incident.
This example demonstrates how a small UK business could document recovery procedures for Microsoft 365 servers, backups, internet connectivity, cyberattacks and ransomware.
The example is fictional. Should be adapted to the organisations own IT environment.
IT Environment Example
A small UK business may depend on the following systems and services:
- Microsoft 365
- Email and calendars
- File storage
- Business applications
- Accounting software
- CRM
- Network infrastructure
- Internet connectivity
- Employee laptops
- Servers or hosted infrastructure
- Backup systems
Each critical system should have a documented recovery procedure.
1. Microsoft 365 Recovery
- Microsoft 365 may be essential for email, calendars, collaboration and access to business information.
- The IT Disaster Recovery Plan should identify:
- Microsoft 365 services used by the organisation
- Who administers the environment
- Who provides support
- How important business data is protected
- What alternative communication methods are available
- What the organisation will do during a service outage
- How recovery responsibilities are assigned
The organisation should also document support and escalation procedures.
2. Server Recovery
For each server or hosted system, document:
- Server name
- Server purpose
- Applications hosted on the server
- Location or hosting provider
- Backup arrangements
- Recovery priority
- Recovery procedure
- Responsible person
- External IT provider details
- System dependencies
The recovery procedure should contain enough information for the responsible IT team or provider to understand what needs to be restored.
3. Backup and Data Recovery
A reliable backup strategy is a part of disaster recovery.
The IT Disaster Recovery Plan should document:
Backup Frequency:
Record how critical systems and data are backed up.
Backup Location:
Record where backups are stored and whether alternative or off‑site storage is used.
Backup Retention:
Document how long different backup copies are retained.
Backup Protection:
Document how backups are protected from access, accidental deletion and incidents that could affect the primary environment.
Restoration Testing:
Backups should be tested through restoration checks to confirm that data can actually be recovered.
A successful backup job does not by itself prove that recovery will work.
4. Internet Failure
Internet access might be very important for cloud programs such as Microsoft 365 and for communicating with people.
If the main internet connection stops working, the recovery process should have these steps:
- Check if there is a problem with the internet.
- Check whether the problem is affecting everyone in the company or only a few people.
- Contact the company that provides the internet service.
- Record when the internet service is expected to be restored.
- Use another internet connection if that is possible.
- Make sure important people and computers receive help first.
- Tell employees about the impact the problem is having.
- Keep monitoring the situation until the internet is working again.
The actual plan must include the contact information for the internet service provider.
5. Cyberattack Recovery
If someone suspects a cyberattack, the company should follow its documented procedures for incident response and recovery.
The recovery process should include these steps:
- Identify the possible problem.
- Disconnect affected computers from the network if necessary.
- Notify the person responsible for incident management.
- Contact the internal IT team or external IT provider.
- Assess which computers and data have been affected.
- Protect unaffected computers and systems, and safeguard available backups.
- Identify suitable recovery points.
- Restore critical systems according to business priorities.
- Test restored systems before returning them to normal use.
Document what happened and review the recovery process afterwards.
6. Ransomware Recovery
Ransomware can prevent people from accessing their computers and data. This risk should be considered when creating an IT Disaster Recovery Plan.
The plan should explain how the company will:
- Identify which computers are affected.
- Disconnect affected devices from the network.
- Notify the relevant people about the incident.
- Protect computers and systems that are not affected.
- Safeguard backups and other recovery resources.
- Identify suitable recovery points.
- Restore the most critical systems first.
- Verify the integrity of recovered data.
- Keep relevant people informed about the recovery process.
- Review the incident after recovery is complete.
The exact recovery procedures will depend on the company's IT environment and infrastructure.
7. Recovery Priorities
Critical systems should be assigned recovery priorities.
| IT System | Priority | Example RTO |
|---|---|---|
| High | 4 hours | |
| File Storage | High | 4 hours |
| Accounting | High | 8 hours |
| CRM | Medium | 24 hours |
| Individual Devices | Medium | 24–48 hours |
These are example targets only. Each organisation should establish recovery targets based on its own operational requirements.
8. RTO and RPO
Recovery Time Objective (RTO)
RTO is the time limit within which a system must be up after an incident happens.
For example a company might set an RTO of four hours for its email service. That means the email system should be working again within four hours after the disruption.
Recovery Point Objective (RPO)
RPO shows how data loss the organisation is willing to accept.
For instance an RPO of 24 hours means the recovery process needs to restore data that’s no older than one day.
This helps decide how often backups should run.
Both RTO and RPO need to be written down for every important system in the business.
Having these targets helps teams act quickly and effectively during an emergency.
9. IT Recovery Team
The IT recovery team should consist of roles such as:
- Incident Lead
- IT Recovery Lead
- Internal IT Administrator
- Operations Manager
- Communications Lead
- External IT Provider
Each person on the team has specific duties during a crisis.
It's very important to define these responsibilities before any incident occurs.
Clear roles prevent confusion and improve response speed.
10. After Recovery
Once systems have been restored, the organisation must take the following steps:
- Confirm that critical systems are working properly.
- Check that all restored data is available and accurate.
- Make sure users can access the services they need.
- Monitor systems for any issues.
- Record every action taken during the recovery process.
- Review whether the original RTOs and RPOs were met.
- Note what went well and what could be improved.
- Update the Disaster Recovery Plan based on lessons learned.
Need a Complete Disaster Recovery Plan Template?
This page provides an IT-focused example. For a disaster recovery plan suitable for small to medium-sized businesses, explore our editable template and structured guidance to help you create a plan for your organisation.
View the Disaster Recovery Plan Template for SMEs → Practical guidance for UK small and medium-sized businesses.