Disaster recovery (DR)

Disaster recovery is the IT side of surviving a bad day. It covers what you back up, where those backups live, who restores what in which order, and how long it should take. A backup is a copy of data; disaster recovery is the tested process of turning that copy back into a working office.

A useful DR plan is short and specific. It lists your critical systems, the RTO and RPO for each, where the backups are, who to call (your IT provider, your software vendors, your internet provider), and the passwords or recovery keys needed — stored somewhere you can reach if the office itself is unavailable.

For healthcare, this isn’t optional. The HIPAA Security Rule’s contingency plan standard expects covered entities to have a data backup plan, a disaster recovery plan and an emergency mode operation plan, and to test and revise them. For everyone else, it’s often a cyber insurance requirement.

Example: a hurricane forces a Volusia County office to close for three days. Because its files and email are in Microsoft 365 and its line-of-business database is backed up to the cloud, staff work from home on managed laptops while the building is closed. Disaster recovery is part of the wider business continuity plan — read our hurricane preparedness guide for a Florida-specific checklist.