Disaster recovery restores systems and data after a major incident. A ransomware attack encrypts the file server. A fire destroys the data center. A flood takes out the backup generator. The recovery plan says how to bring everything back, in what order, and from what backups. It is the technical counterpart to business continuity, which keeps the organization running while recovery happens.

The plan covers backups, alternate sites, hardware replacement, and data restoration. Backups are the foundation. They need to be tested, encrypted, and stored offsite or in immutable storage. Ransomware groups target backups first because without them, the victim has no choice but to pay. The 3-2-1 rule is a common baseline: three copies of data, on two different media, with one copy offsite. Recovery time objectives set the target for how fast systems must come back. A hospital system might need to restore in hours. A small business might tolerate days. The plan should match the risk. A recovery plan that has never been tested is a hope, not a plan.

Recovery essentials

• Backups — regular, tested, encrypted, offline
• 3-2-1 rule — three copies, two media, one offsite
• Recovery time objective — how fast systems must return
• Recovery point objective — how much data loss is acceptable
• Testing — prove the plan works before you need it

Disaster recovery is expensive until the disaster happens. Then it is the cheapest thing you ever bought.