A disaster recovery plan does not need to be a 60-page document. For most small businesses, a few clear pages that people can actually find and follow are far more useful. This template covers what to include, and explains the two terms you will see everywhere: RTO and RPO.
RTO and RPO in plain English
- Recovery Time Objective (RTO): how long you can live without a system before the damage becomes serious. “We need email back within four hours.”
- Recovery Point Objective (RPO): how much data you can afford to lose, measured in time. “We can lose at most one day of accounts data.”
Your RPO decides how often you back up. Your RTO decides how you back up and recover: restoring terabytes from a slow connection might take days, which is no good if your RTO is hours.
The template
1. Purpose and scope
One paragraph: which systems and sites the plan covers, and who owns it.
2. Contacts
Names and phone numbers for the people who make decisions, your IT provider, your internet provider, key software suppliers, your insurer and your bank. Keep a printed copy: if email is down, you will not be able to look it up.
3. Critical systems list
A table with each system, what it is used for, its RTO, its RPO, where it is backed up and who can restore it. Typical entries are Microsoft 365 email and files, accounts software, line-of-business applications, phones, internet connection and the website.
4. Scenarios
Short action lists for the incidents you are most likely to face:
- Ransomware or a compromised account.
- Loss of internet or phone lines.
- Loss of the office (fire, flood, no access).
- Failure of a key server or cloud service.
- A key person being unavailable.
5. Recovery steps
For each critical system: where the backups are, how to restore them, how long it takes, and how to check that the restored data is correct.
6. Communication
Who tells staff, customers and suppliers, using which channels, and what you will say. Include your legal duties, such as reporting a personal data breach to the ICO within 72 hours where required.
7. Testing and review
When the plan was last tested, what went wrong, and when it will be reviewed next.
Test it, or it is just a document
Run a tabletop exercise at least once a year: sit down with the key people and talk through a scenario step by step. Pick a realistic scenario, such as ransomware or a lost laptop, and walk through who does what. Also test actual restores. A backup you have never restored from is a hope, not a plan.
Common gaps we see
- Backups that are connected to the network all the time, so ransomware encrypts them too.
- No offline copy of contact details or the plan itself.
- Nobody knows the admin passwords for the internet router, domain or Microsoft 365.
- Microsoft 365 data assumed to be backed up by Microsoft (see does Microsoft back up your 365 data?).
When to speak to BMT
If you want help writing or testing a plan, our disaster recovery and managed backup services are built around realistic RTOs and RPOs for small businesses. Call us on 0161 672 7461 or 01706 391 047, or get in touch online.
Related reading
Disaster recovery planning for small businesses · Don’t pay the ransom: plan your recovery · Disaster recovery