example of a business disaster plan

University of Houston Small Business Development Center

Step-by-Step Guide: How to Build a Business Recovery Plan

By Tatyana Parham

In the midst of the coronavirus (COVID-19) pandemic, small businesses around the world are experiencing severe operational and economic challenges. In order to embrace small business recovery in such difficult times, business owners must proactively take the steps necessary to develop resilience in the face of a disaster. By creating a detailed business recovery plan geared towards the impacts of the pandemic, leaders are better equipped to respond efficiently and protect their employees, customers, and operations.

What is included in a small business disaster recovery plan? A business recovery plan is a strategic guide that details processes created to prepare, respond, and recover in the event of an emergency. As the COVID-19 pandemic has a unique set of challenges, as compared to other natural disasters such as floods and hurricanes, it calls for a nuanced plan-of-action that will mitigate risks and allow for an expedient recovery.

An effective business recovery plan clearly outlines policies and procedures that highlight key information such as disaster risk and impact, critical stakeholders and operations, communication models, and strategy for business continuity .

Here are some key concepts to consider when creating a disaster recovery plan for your small business:

Prioritize employee health and safety The health, safety, and wellbeing of your employees and customers should always be your top priority. Address any immediate needs and concerns first, including creating guidelines that support sick employees or those with sick family members. Consider expanding flexibility for typical work arrangements, and verify that you have the capacity to support a remote workforce. If telecommuting isn’t possible, ensure you have measures established that align with the current governmental health policies and support a safe working environment.

Identify COVID-19 risks and impact on your business Conduct a risk assessment:  Small business recovery begins with awareness of the potential risks that can adversely affect your business. A part of this may be to consider how operations will change in a worst-case scenario of 35 - 40% of your workforce being out sick, or how to reallocate your budget and preemptively avoid layoffs.

Other risks may include lack of access to public transport for employee commute, additional costs of establishing a remote workforce, national shutdowns prohibiting in-person contact, slowdown in sales, issues in supply chain and manufacturing, and even your business being forced to temporarily close. Prioritize critical business functions that are the most vulnerable, such as employee payroll inventory management, and outline how you can protect them. Once top risks are identified, you can assess which risks will generate the most substantial impact, so you can determine the most efficient use of your resources.

Analyze the impact:  Understand how the identified risks can affect critical business functions, and map out potential impacts this can have on your business. For example, if you have to temporarily stop operations for six weeks, how will that affect your quarterly and yearly financial statements, and how can you minimize financial loss through alternative sources of income? Identify the gaps in your current processes that prevent your business from operating sustainably. This process is called a business impact analysis.

Designate a recovery team After identifying your business’s prime vulnerabilities, designate a team of stakeholders that will be directly involved in recovery efforts. This team of key players should understand the business’s core competencies, and have the ability to consistently make choices that reflect the best outcome for the needs of the business. Be realistic about expectations for each individual, and ensure that you are a top leader throughout recovery in order to maintain employee confidence levels.

Establish transparent communication Consistently focus on transparent and timely communication with all relevant stakeholders to ensure regular support throughout the pandemic, including employees, clients or customers, suppliers, landlords, and investors. Create an employee communication plan specifically intended for the event of a disaster, and consistently provide updates based on CDC guidelines and organizational priorities. Regularly inform customers of any impact on products, services, and delivery, and maintain steady contact with suppliers regarding their continued capability to provide essential materials.

Revise business strategy for continuity As the pandemic progresses, significant shifts in consumer behavior will demand a different approach to sustaining your business. Proactively strategize how to minimize downtime and disruptions to daily operations. Perform a complete audit of your business and marketing plans to pinpoint what’s working, what’s not working, and what will best support your business in a worst-case scenario.

Creatively decide on a plan-of-action that will provide practical cost-effective strategies that reduce the impact of identified risks. Brainstorm how to protect cash flow and monitor utilization of resources, ensuring that you have more than enough to cover future expenses.

Continue to monitor external vulnerabilities that can impact the flow of business as well, including pressures on customers, partners, and suppliers. Devise multiple plans for multiple scenarios of varying intensity, to ensure full preparation for what’s ahead. Assess your wins and losses throughout the recovery process, and devise contingency plans that will enable your business to thrive moving forward. Although crises may have considerable impacts to the detriment of your business, they reveal opportunities for your business to generally improve in value, organization, or efficiency.

Maximize the use of alternative funding and support To support business recovery, stay up to date with available local and federal assistance programs that offer disaster relief. Visit our online hub for COVID-19 resources here .

Small Business Preparedness

To minimize the impact of disasters on employees, property, and operations, businesses must make the right preparations. These include: creating a disaster plan, identifying priorities, training employees on emergency preparedness, and reviewing the business’ insurance coverage. Here are resources to help prepare for disasters and organize your response.

Quick Guide: Small Business Preparedness

January 01, 2015

Top 10 Preparedness Tips

• Organize a staff team to create your plan.
• Gather critical documents and information needed for decision making.
• Identify and prioritize the company’s most important operations and processes.
• Identify hazards and potential disruptions to your operations.
• Keep it simple: design a plan that is easy to understand and implement. .
• Create a communications strategy and plan to use it post emergency. Maintain an up-to-date emergency contact list for employees, vendors, suppliers, and other key stakeholders.
• Recruit and train employee volunteers that can effectively manage the response.
• Back up and store vital records and data at an off-site location.
• Take action to mitigate the potential impact of a disaster on equipment, buildings, facilities, inventory, and storage. Consider your insurance options and whether to purchase a generator.
• Exercise, test, and update your plan at least annually.

Only 33% of small businesses have business interruption insurance. (National Association of Insurance Commissioners)

• Top 20 Preparedness Tips for Businesses  (DRB Toolkit) – Covers what you need to do before, during and after with tips on how to protect everything from your employees to the company brand.
• Are You Prepared? How to Make a Disaster Recovery Plan For Your Business  – A 10-step guide to creating a disaster recovery plan.
• 7 Steps You Need to Take Before Disaster Strikes  (AmEx) – Provides simple, straight-forward steps derived from the response to Hurricane Sandy and other disasters.
• Business Interruption Preparedness/Recovery – Five steps to ensuring business continuity during a disruption.
• How Small Businesses Should Plan for Disasters – Case studies on disaster response from Hurricane Sandy.

“Small businesses are at particular risk as they often lack the resources to survive a catastrophic event. And when small businesses are unable to rebuild, the entire community continues to suffer. Jobs are lost, neighborhoods decline, and individuals and families endure further hardships.” ~United Way, Larimer County (CO) after 2013 floods

Preparedness Guides

• 7 Steps to an Earthquake Resilient Business  – Focused on earthquake recovery, this booklet explains what businesses can do before, during, and after disaster.
• Preparedness Planning for Your Business  (FEMA) – Website and tools for assessing, planning, responding, and improving future readiness.
• American Red Cross Ready Rating Assessment  – A program that provides a 123-question assessment to help businesses identify gaps and strengths and where they should focus attention.
• Disaster Recovery and Continuity Guide – Guide to prepare and assist businesses affected by a disaster.

Checklists—General

• Emergency Preparedness Checklist for Small Businesses  (Red Cross) – 3-step preparedness checklist.
• IOWA Business Emergency Preparedness Plan  – Checklist with examples of best practices for creating a preparedness plan.
• Business Disaster Planning Checklist – Useful list to help business plan ahead before a disaster.  
• Minimizing the Risks to Your Business Using Security Measures and Disaster Planning  – Guide to securing business property following a disaster.

Checklists—By Hazard

• Prepare for a hurricane’s effect on your business, employees and community  (SBA/Agility) – Guide to preparing for a hurricane.
• Tornado Preparedness Checklist  (SCORE) – Guide to preparing for a tornado.
• Tornado Preparedness and Response  (OSHA) – Planning and employee training guide for tornado preparation.
• Flood Preparedness Checklist  (SCORE) – Guide to preparing for a flood.
• Earthquake Preparedness Checklist  (SCORE) – Guide to preparing for an earthquake.
• Seven Steps to Earthquake Safety – Step-by-step guide to earthquake preparation.

Business Continuity Planning (BCP)

• Planning for Business Continuity after a Disaster  (IRS) – Short video giving four key areas for businesses to focus on when planning.  
• DRB Toolkit © (Disaster Resistant Business Toolkit) – Step-by-step, fully customizable planning tool guides to help all types of businesses build a disaster plan, train employees, run exercises, and prepare operations. Provides tools, templates, and videos for beginners and experienced planners alike. Use discount code: USChamber
• Planning and Responding to Workplace Emergencies  (OSHA) – Factsheet of requirements and tips for emergency response and protecting employees.
• Preparing Your Business for the Unthinkable  (Red Cross) – Short guide with helpful suggestions to get started.
• 2011 Crisis Preparedness Study  – Slideshow for businesses about the importance of Business Continuity Planning.
• Preparing for Disasters (IRS) – Short video about how to protect tax and banking information following a disaster.
• Preparing for a Disaster (Taxpayers and Businesses) – Tips for safeguarding documents and tracking valuables after a disaster. Includes a Loss Workbook tool from the IRS.
• Being Prepared: Is Your Business Ready for a Disaster? – Slideshow of information about disaster recovery; includes information on government assistance, statistics about business recovery, and assistance for small businesses.

71% of small businesses say they are “very dependent” on 1 or 2 key people, but only 22% have “Key Person Insurance” ~National Association of Insurance Commissioners (NAIC)

Insurance is not a tax; it is a risk management tool critical for all businesses. It can reduce the financial impact of accidents, fires, and other unplanned disruptions. Insurance protects businesses from events out of their control and improves chances for survival. Here are some tips to keep your business running smoothly:

• Review your coverage and design an insurance program that fits your business and risks. Bring in an insurance professional to explain different types of available coverage. Keep in mind that some policies may not need to cover every aspect of the business but simply the most critical elements that you need to remain operational. Find the right balance.
• When disaster strikes, file a claim as soon as possible. To do so, plan ahead for what items you will be required to provide so you do not miss an important step in the process. Take pre-disaster photos of your business and equipment. After an event occurs, document damage with photos or videos.

Review Your Coverage

• What Types of Insurance Should a Small Business Consider?  – Discusses everything you need to know how to pick the right coverage for your business.
• Types of Business Insurance  (SBA) – The 5 basic types of insurance that businesses need to consider.  
• Insurance is Financial Risk Mitigation  (FEMA) - Information on National Flood Insurance Program (NFIP); includes resources such as a link to an insurance coverage review  form .
• Earthquake Basics Insurance – Details insurance options available for businesses facing the threat of an earthquake.
• How to Develop a Small Business Disaster Recovery Plan – Overview of helpful insurance plans for small businesses. 

Filing a Claim

• Let Us Help Guide You Through Your Business Insurance Claims  – Checklist to assist with filing a claim.   
• After A Loss: Filing Your Business Insurance Claim  – List of steps to take after filing an insurance claim.
• Disaster Resource Guide for Small Businesses  – Step-by-step guide to filing a claim. (Ignore Missouri specific information) 
• Important Insurance Lessons from Superstorm Sandy  – Helpful tips on working with insurance companies during the claims process. 

Communicating with Employees, Suppliers, and Customers

During disasters, communication is one of the most needed activities to inform employees and suppliers, answer customer questions, reduce rumors, and provide expectations to the public. It is also one of the first systems to break or experience challenges.

To plan for potential business interruptions and to create a crisis communication strategy as part of your larger Business Continuity Plan. Here are some tips:

• Keep your Emergency Contact List updated with every possible mode to reach each person (phone: work, home, cell, significant other’s cell; email: work, personal, alternate; family contact; evacuation plan and contact; social media: Facebook, Twitter; etc.)
• Consider an alert mechanism that can keep your employees, customers, vendors, suppliers, and stakeholders informed and regularly updated in multiple ways (e.g. email, text messages). Test regularly.
• Use existing social media platforms to communicate online (e.g. Facebook, Twitter).
• Have procedures to work with the media following a crisis.
• Identify a spokesperson to be the voice of your company in talking with the media.
• Developing messaging and talking points specific to their intended audience (e.g. employees, vendors, community members).
• Communicate accurately and often with customers to keep them informed of any delays in delivery, alternatives, expectations, and any compensation.
• Monitor outside communications to determine what is working well and areas to improve your communication strategy.
• Update the communications strategy often. Train employees and provide new hires with the communications strategy.

Crisis Communication Planning

• Is Your Company Prepared to Respond after a Disaster?  (SBA) - Tips to get your company’s crisis communications plan started.
• Crisis Communications  – (SBA/Agility) Checklist for developing a crisis communications plan with recommendations for during and after an emergency.
• Disaster Recovery: Developing the Perfect Communications Plan for Your Business  – Guide to completing the Crisis Communications checklist.
• Crisis Communications Plan  (FEMA) – Background information about Crisis Communications Plans and their importance.
• Developing an Emergency Communications Plan: A Template for Business Continuity Planners  –List of eight essential topics that a crisis communications plan must cover.
• Crisis Communications and Disaster Response  – Tips on communicating with employees and stakeholders post-Disaster.                                       
• 2011 Crisis Preparedness Study  - Helpful statistics about Crisis Preparedness; includes recent case studies.
• Reputation Management  –Slideshow of the basics for pre-planning crisis communication and how to address events strategically.

Integrating Social Media into Your Communications Plan

• 5 Tips for Integrating Social Media into Your Disaster Plans – Helpful tips for using social media following a disaster.
• 8 Tips to Avoid Social Media Disaster – How to plan for and respond to potential damage to your company’s name and brand.
• Social Media Disaster Prevention and Response Tips – Case studies of businesses using social media to preserve their name and brand following a disaster.

Employee Assistance

An Employee Assistance Program (EAP) can be useful in handling productivity decline following a disaster.  

• Consider how your company can help employees and families access medical care, food, housing, and other essentials.
• Plan to connect employees with resources.  Those hit hardest may not have working phones or the ability to call area resources to find new housing, child care, a kennel, a rental car, or other necessary services.
• Plan for the possibility of employees requiring financial assistance through the form of emergency grants or an advance on future wages. 
• How to Set-Up an Employee Assistance Program?  – Five steps to set up an EAP.
• Employee Assistance & Support  (FEMA) – Steps on setting up an EAP and opening a family assistance center.
• A Manager’s Handbook: Handling Traumatic Events  – Chapters six and seven specifically provide information for businesses looking to set up an Employee Assistance Program. Includes tips on minimizing employees’ stress.

Additional Resources

Depending on the type of hazards your business may face there are a variety of resources to help. These include FEMA, SBA, business continuity publications, local fire departments, Chambers of Commerce, Economic Development organizations, professional organizations and many more. Most  have a strong online presence with tools available via the internet.

• FEMA.gov  – Presents many kinds of preparedness information and materials.
• Ready Business (FEMA) - Helps companies develop a five-step preparedness program that addresses the impact of many hazards.
• Protect your Property or Business from Disaster (FEMA) – A downloadable list of publications detailing how to minimize property losses caused by various types of natural disasters.
• DisasterAssistance.gov  – If you have personal (non-business) losses, register with FEMA here or call FEMA: (800) 621-3362 or TTY (800) 462-7585.
• Disaster Declarations  are made by states to keep track of what is happening and provide immediate resources.
• If there is a federal emergency declared, click here  to find your nearest Disaster Recovery Center.
• SBA: Disaster Loans  Links to articles, factsheets, and forms related to the Disaster Loans program; includes mail-in and online applications.  
• Emergency Preparedness (SBA) – Articles on planning and resources.
• IRS Videos on Disaster Subjects  – Informative videos to help businesses affected by a major disaster.

Recommended

• Disasters U.S. Chamber of Commerce Foundation and American Express Open Applications for Grant Program to Support Small Business Owners Impacted by Maui Wildfires
• Disasters Maui Small Business Recovery Grant Program Toolkit
• Disasters Building Resilience Conference Toolkit
• Disasters Maui Small Business Recovery Grant Program: Terms and Conditions
• Disasters Maui Small Business Recovery Grant Program: Frequently Asked Questions

View this online

Everything that you need to know to start your own business. From business ideas to researching the competition.

Practical and real-world advice on how to run your business — from managing employees to keeping the books.

Our best expert advice on how to grow your business — from attracting new customers to keeping existing customers happy and having the capital to do it.

Entrepreneurs and industry leaders share their best advice on how to take your company to the next level.

• Business Ideas
• Human Resources
• Business Financing
• Growth Studio
• Ask the Board

Looking for your local chamber?

Interested in partnering with us?

Start » strategy, how to build a disaster recovery plan for your small business.

The road to recovery after a disaster doesn’t have to be painful. Learn the six steps you need to take to build an effective recovery plan for your business.

It’s not always possible to avoid the business fallout of a disaster like a pandemic, earthquake, or cybersecurity breach. But you can build a recovery plan to get your business up and running ASAP. Here are six steps you can take to get started.

Review your insurance coverage

Having the right business insurance can be crucial to surviving a disaster. You should regularly review your policies to ensure there are no gaps in your coverage.

For instance, if you live in an area that regularly experiences earthquakes, you want to ensure your policy will protect your business against these risks. You also want to ensure that your insurance will cover the disruption to your company and pay for damages.

[Read more: How to Choose Cyber Insurance ]

Audit your business resources

Next, you want to audit all critical business resources , including:

• Equipment and other assets.
• Perishable resources or products.
• Staff members.
• Property or real estate.

Once your audit is complete, you’ll know what your business stands to lose if it’s exposed to different types of emergencies. For instance, your business could sustain a lot of physical damage during a flood.

But your business may suffer economic damage during a cybersecurity hack. Auditing your business resources will help you determine which areas of your business to focus on.

Have a plan to backup your data

You must have a reliable data backup plan before disaster strikes. Over 50% of businesses aren’t prepared for a significant data loss, and 60% of those companies end up going out of business within six months.

It’s best to have multiple data backup plans in place. For instance, you could buy and use an external hard drive to back up your company’s data. And you should also backup your data in the cloud so that you can access it from anywhere.

[Read more: What Is the 3-2-1 Backup Rule? ]

Over 50% of businesses aren’t prepared for a significant data loss, and 60% of those companies end up going out of business within six months.

Make a list of key employees

The next step is determining which employees are critical to your business functions. For instance, your IT team would be critical in keeping your electronic processes functioning properly in an emergency, whereas sales reps may not be as necessary.

When an emergency strikes, you should immediately reach out to the employees and internal partners that can help keep your business running. No one can fully recover from a disaster on their own, so utilizing the right people will make your recovery efforts much smoother.

Communicate with your customers

No matter what kind of disaster you encounter, it’s key to have a plan for communicating with your customers. For instance, if your company was the victim of a security breach, you should let your customers know what happened and what steps you’re taking to mitigate the damage.

Make sure your customers know what’s happening and how to get in touch with you. It’s also a good idea to pick one employee to monitor your social media networks and answer questions.

[Read more: 5 Crisis Communication Best Practices Every Small Business Should Know ]

Apply for the Small Business Readiness for Resiliency Program

The U.S. Chamber of Commerce Foundation partnered with FedEx to create the Small Business Readiness for Resiliency (R2R) Program . The R2R program encourages businesses to prepare for natural disasters before they occur and awards grants to businesses in qualifying areas.

You’ll start by downloading FedEx’s Emergency Preparedness Checklist for Small Businesses. This checklist will help you create an Emergency Action Plan for your business.

From there, you’ll apply online and provide more details about your business. If you apply before a disaster strikes in your area, you may be selected to receive a grant to help your business recover.

CO— aims to bring you inspiration from leading respected experts. However, before making any business decision, you should consult a professional who can advise you based on your individual situation.

Follow us on Instagram for more expert tips & business owners’ stories.

Applications are open for the CO—100! Now is your chance to join an exclusive group of outstanding small businesses. Share your story with us — apply today .

CO—is committed to helping you start, run and grow your small business. Learn more about the benefits of small business membership in the U.S. Chamber of Commerce, here .

Subscribe to our newsletter, Midnight Oil

Expert business advice, news, and trends, delivered weekly

By signing up you agree to the CO— Privacy Policy. You can opt out anytime.

For more business strategies

How startups contribute to innovation in emerging industries, how entrepreneurs can find a business mentor, 5 business metrics you should analyze every year.

By continuing on our website, you agree to our use of cookies for statistical and personalisation purposes. Know More

Welcome to CO—

Designed for business owners, CO— is a site that connects like minds and delivers actionable insights for next-level growth.

U.S. Chamber of Commerce 1615 H Street, NW Washington, DC 20062

Social links

Looking for local chamber, stay in touch.

How to Write a Disaster Recovery Plan + Template

Table of Contents

What is a disaster recovery plan?

Disaster recovery plan vs business continuity plan, what are the measures included in a disaster recovery plan, how to write a disaster recovery plan, disaster recovery plan template, disaster recovery plan examples, how secureframe can help your disaster recovery planning efforts.

• July 27, 2023

Anna Fitzgerald

Senior Content Marketing Manager at Secureframe

Cavan Leung

Senior Compliance Manager at Secureframe

A study found that only 54% of organizations have a company-wide disaster recovery plan in place. This percentage is even lower for government IT departments (36%) despite the proliferation of ransomware and other cyber threats. 

Not having a documented disaster recovery plan can seriously hamper an organization’s ability to recover lost data and restore its critical systems. This can result in significantly higher financial losses and reputational damage.

To help ensure your organization can recover from disaster as swiftly and easily as possible, learn what exactly a disaster recovery plan is and how to write one. Plus, find some examples and a template to help get you started.

A disaster recovery plan (DRP) is a document that outlines the procedures an organization will follow to recover and restore its critical systems, operations, and data after a disaster. Examples of disasters that may disrupt the continuity of product or service delivery are natural disasters, cyber attacks, hardware failures, and human errors. 

In planning for disaster recovery, what is the ultimate goal?

The ultimate goal of disaster recovery planning is to minimize the impact of a disaster, and ensure business continuity.

Having a disaster recovery plan in place that is well-designed and regularly maintained can help organizations:

• minimize downtime
• reduce financial losses
• protect critical data
• resume operations quickly 
• provide peace of mind for employees

A disaster recovery plan and business continuity plan both take a proactive approach to minimize the impact of a disaster before it occurs and may even be combined into a single document as a result. 

However, the key difference is that a disaster recovery plan focuses on limiting abnormal or inefficient system function by restoring it as quickly as possible after a disaster, whereas a business continuity plan focuses on limiting operational downtime by maintaining operations during a disaster. 

In other words, a disaster recovery strategy helps to ensure an organization returns to full functionality after a disaster occurs whereas a business continuity plan helps an organization to keep operating at some capacity during a disaster. That’s why organizations need to have both documents in place, or need to incorporate disaster recovery strategies as part of their overall business continuity plan. 

Recommended reading

How to Write a Business Continuity Plan & Why It’s Important for a SOC 2 Audit [+ Template]

Just as no two businesses are the same, no two disaster recovery plans are. However, they do typically include some common measures. These are detailed below.

• Data backup and recovery

A section of a DRP should be dedicated to data backup and recovery. This should list backup methods, frequency of backups, the storage locations, and the procedures for data restoration.

• Redundant systems and infrastructure

Another section may explain how the organization implements redundant systems and infrastructure to ensure high availability and minimize downtime if a disaster occurs. This may involve duplicating critical servers, network equipment, power supplies, and storage devices using clustering, load balancing, failover mechanisms, virtualization technologies, or other measures. 

Alternate worksite

A DRP may identify alternative worksites or recovery locations where the organization can operate if the primary site becomes inaccessible. This section should also define procedures and infrastructure needed to quickly transition operations to the identified alternate sites.

• Communication and notification

Another part of DRP may define communication protocols and notification procedures to ensure communication during and after a disaster. Protocols and procedures typically include:

• notifying employees, customers, vendors, and stakeholders about the disaster
• providing updates on recovery progress
• maintaining contact information for key personnel and emergency services

Recovery objectives

A DRP may set acceptable time frames for recovering systems and data in terms of recovery time objectives (RTO) and recovery point objectives (RPO). These objectives should be based on the criticality of systems and shape recovery strategies accordingly. 

• RTO : The maximum amount of downtime allowed
• RPO : The maximum loss of data accepted (measured in time)

The 10 Most Important Cybersecurity Metrics & KPIs for CISOs to Track

Writing and maintaining a disaster recovery plan requires collaboration and coordination among key stakeholders across an organization and can seem intimidating. Below we’ll outline the process step by step to help you get started. 

1. Define the plan’s objectives and scope

To start, define the objectives and scope of your disaster recovery plan.

Objectives may include:

• safeguarding employees’ lives and company assets
• making a financial and operational assessment
• securing data
• quickly recovering operations

Next, identify what and who the plan applies. Typically, assets utilized by employees and contractors acting on behalf of the company or accessing its applications, infrastructure, systems, or data fall within the scope of the disaster recovery plan. In this case, employees and contractors are required to review and accept the plan. 

2. Perform a risk assessment

Identify potential risks and vulnerabilities that could lead to a disaster, both internal and external to the organization. This should involve evaluating your reliance on external vendors and suppliers for critical services or resources and assessing their own disaster recovery capabilities to ensure they align with your organization's requirements.

3. Perform a business impact analysis

Next, determine the business functions, processes, systems, and data that are essential for your organization's operations. For each critical component, establish recovery time objectives and recovery point objectives. 

4. Define recovery measures and procedures

Define the appropriate measures and step-by-step procedures for disaster recovery based on the risks and business impact you identified. This includes identifying the individuals or teams responsible for recovery tasks, the resources required, and the order of recovery tasks.

As stated above, these recovery tasks may fall into the following categories:

• Alternative worksite

You may also want to outline emergency procedures. These are the actions that should be taken during and immediately after a disaster occurs, and may include evacuation plans and communication protocols and coordination with emergency services.

5. Conduct testing and training regularly

Regularly test the disaster recovery plan to ensure its effectiveness and identify any potential gaps or weaknesses. Conduct training sessions for employees to familiarize them with their roles and responsibilities during a disaster.

6. Review and update the plan regularly

Review and update the disaster recovery plan periodically to incorporate changes in technology, business operations, and potential risks. Ensure that contact information, system configurations, and other relevant details are up to date.

Use this template to kick off your disaster recovery planning and customize it based on your organization's specific risks and objectives.

Below you can find examples of disaster recovery strategies and procedures from disaster recovery plans created and maintained by universities and other organizations. This should help you in brainstorming and documenting your own recovery strategies and plans for different services, environments, and types of disasters. 

1. IT disaster recovery plan

Southern Oregon University has a comprehensive disaster recovery plan specifically for its IT services because they are so heavily relied upon by faculty, staff, and students. There are disaster recovery processes and procedures outlined for various IT services and infrastructure, including its data center, network infrastructure, enterprise systems, desktop hardware, client applications, classrooms, and labs. 

Some of the IT disaster recovery processes and procedures outlined in the plan are:

• Secure facility as necessary to prevent personnel injury and further damage to IT systems.
• Coordinate hardware and software replacement with vendors
• Verify operational ability of all equipment on-site in the affected area (servers, network equipment, ancillary equipment, etc.). If equipment is not operational, initiate actions to repair or replace as needed.
• If the data center is not operational or recoverable, contact personnel responsible for the alternate data center and take necessary steps to ready the facility.
• Retrieve most recent on-site or off-site back-up media for previous three back-ups. Prepare back-up media for transfer to primary or secondary datacenter, as determined during the initial assessment.

2. AWS disaster recovery plan

AWS walks through disaster recovery options in the cloud in this whitepaper . It explains four primary approaches to cloud disaster recovery:

• Backup and restor e: Backup the data, infrastructure, configuration, and application code of your primary Region and redeploy them in the recovery Region. This is the least costly and complex approach. 
• Pilot light : Replicate your data from one Region to another and provision a copy of your core workload infrastructure so that you can quickly provision a full scale production environment by switching on and scaling out your application servers if a disaster occurs. This simplifies recovery at the time of a disaster and also minimizes the ongoing cost of disaster recovery by “switching off” some resources until they’re needed.
• Warm standby : Create and maintain a scaled down, but fully functional, copy of your production environment in another Region. This decreases the time to recovery compared to the pilot light approach, but is more costly because it requires more active resources.  
• Multi-site active/active : Run your workload simultaneously in multiple Regions so users are able to access your workload in any of the Regions in which it is deployed, which reduces your recovery time to near zero for most disasters. This is the most costly and complex approach. 

3. Data center disaster recovery plan

The University of Iowa also has a comprehensive disaster recovery plan , which includes several processes and procedures for recovering from a disaster that affects its data center. Some of these include: 

• Have large tarps or plastic sheeting available in the data center ready to cover sensitive electronic equipment in case the building is damaged due to natural disasters like tornadoes, floods, and earthquakes.
• If replacement equipment is required, make every attempt to replicate the current system configuration.
• If data is lost, then request that the IT department recover it from an off-site backup or cloud deep archive storage.

Secureframe’s automation compliance platform and in-house compliance expertise can help ensure your organization has the policies, controls, and expertise in place to protect systems proactively from business disaster and to recover if they do occur. Request a demo to learn how.

What are the 5 steps of disaster recovery planning?

The five steps of disaster recovery planning are prevention, mitigation, preparedness, response, and recovery. That means when planning, you should identify measures and actions to:

• avoid or prevent a disaster from occurring
• reduce the chances of a disaster occurring or the impact of it
• enhance your ability to respond when a disaster occurs
• be carried out immediately before, during, and after a disaster
• restore your business operations as quickly as possible

What are the 4 C's of disaster recovery?

The 4 C's of disaster recovery are communication, coordination, collaboration, and cooperation. Below are brief definitions of each:

• Communication  - developing and maintaining effective channels for sharing information before, during, and after disasters
• Coordination  - aligning actions to other parts of an organization or other organization to prepare for and respond to disasters
• Cooperation  - working with internal or external parties that share the same goal (ie. responding to and recovering from disasters) and strategies for achieving it
• Collaboration - partnering with internal or external parties to identify challenges and responsibilities to recover from a disaster as quickly as possible

What are the three types of disaster recovery plans?

Disaster recover plans can be tailored to different services, environments, and types of disasters. So types of disaster recovery plans include ones for IT services, data centers, and cloud environments.

How do you create a good disaster recovery plan?

Creating a good disaster recovery plan requires a few key steps such as:

• Performing a risk assessment and business impact analysis
• Setting objectives, including recovery time objectives (RTO) and recovery point objectives (RPO)
• Creating an inventory of critical assets
• Defining data backup requirements and recovery strategies
• Establishing alternate communication methods
• Assigning specific roles and responsibilities

What are the key elements of a disaster recovery plan?

Key elements of a disaster recovery plan are:

• Objectives and goals
• Recovery measures and procedures
• Testing processes
• A communication plan
• Defined disaster recovery stages

Disaster Recovery Plan Templates

By Andy Marker | November 26, 2018

• Share on Facebook
• Share on LinkedIn

Link copied

In this article, you’ll find the most useful disaster plan templates, available for download in Microsoft Word, Excel, PowerPoint, and PDF formats. Customize the free templates to fit your business needs so you can maintain productivity and operations in the event of a disaster.

Disaster Recovery Plan Template

Use this template to document and track all critical operations, personnel contact information, and key procedures to perform in the event of a disaster or business disruption. Use the designated space to record critical information, like the backup process, recovery sites, and restoration steps. This template is available for download in Microsoft Word, PowerPoint, and PDF formats.

Download Disaster Recovery Plan Template

Word | PowerPoint | PDF  | Smartsheet

See how Smartsheet can help you be more effective

Watch the demo to see how you can more effectively manage your team, projects, and processes with real-time work management in Smartsheet.

Watch a free demo

Disaster Risk Reduction Management Plan Template

Use this template to record the most essential information your organization needs in order to effectively gauge risks. Within the disaster risk reduction management plan, you’ll find space to detail risk severity and likelihood and outline it on a visual chart. Use this template to stay on top of risks and detail how to handle any disaster or disruption, no matter the severity.

Download Disaster Risk Reduction Management Plan Template

Excel  | PDF  | Smartsheet

IT Disaster Plan Template

This template outlines the specific steps for continuing business operations and recovery in the IT field. Space is included to document IT objectives, key IT personnel and all necessary contact information, recovery plan overview, and emergency response teams. Available in Microsoft Word, PowerPoint, and PDF formats, this template serves as a blueprint for recovering from all IT disruptions. .

Download IT Disaster Plan Template

Word | PowerPoint | PDF

Data Disaster Recovery Plan Template

Use this template to document the process for recovering key data after a disaster or disruption in business operations. With space to list a statement of intent, emergency response processes, financial and legal information, and recovery plan practice and implementation, this template will aid in the restoration of all critical business data.

Download Data Disaster Recovery Plan Template

Disaster Recovery Communication Plan Template

This disaster recovery communication plan template will help you identify the core communications across team members in the event of a disaster. This template provides space to assign responsibilities, identify stakeholders, and set up a proper response plan. This template is available in both Microsoft Word and PDF formats.

Download Disaster Recovery Communication Plan Template

Payroll Disaster Recovery Plan Template

Plan, track, and manage a disaster that affects the payroll process of your organization and hinders normal HR operations. You can use this template to detail key contact information, disaster recovery teams, and emergency alert and activation measures dealing with a disaster that affects typical payroll operations. This customizable template is available in Microsoft Word, PowerPoint, and PDF formats.

Download Payroll Disaster Recovery Plan Template

School Disaster Management Plan Template

In the event of a disaster or emergency situation at a school, use this template to plan the exact details involved in the response, mitigation, and recovery plan. Manage all risks that could potentially plague schools, such as site security or power outages. With space to document a full risk assessment, a preparedness plan, and response actions, your school will be fully prepared.

Download School Disaster Management Plan Template

Disaster Management Plan Template

Use this comprehensive template to detail the response and management plan of your organization after a disaster strikes. With space to include an outline of your overall disaster recovery plan, key contact information, disaster recovery procedures, and alternate recovery sites, this template enables you to manage any catastrophe that may affect your organization.

Download Disaster Management Plan Template

Simple Disaster Recovery Plan for Small Businesses

This template offers a simple yet comprehensive recovery plan for small businesses when a disaster or emergency situation interrupts typical activity. You’ll find space to outline everything from recovery plans to backup procedures, and even disaster site rebuilding and relocation plans. This template is available for download in Microsoft Word, PowerPoint, and PDF formats.

Download Simple Disaster Recovery Plan for Small Businesses

SaaS Disaster Recovery Plan Template

This template is specifically designed for SaaS organizations to plan, manage, and assess the damage after a disaster occurs. Outline key objectives, provide a detailed overview, and assign responsibilities across emergency and disaster response teams with this comprehensive template available in Microsoft Word, PowerPoint, and PDF formats.

Download SaaS Disaster Recovery Plan Template

Disaster Drill Evaluation Template

Use this template during and after a disaster drill to evaluate the effectiveness of your organization’s plan. Record the type of disaster the drill is for, drill initiation and complete times, emergency response team accuracy, and lessons learned. Download and customize for your business needs, available in both Microsoft Word and PDF formats.

Download Disaster Drill Evaluation Template

Excel | Word | PDF

Disaster Call Tree Template

Streamline the process of phone communication when an emergency occurs. Use this template to detail the person responsible for starting the call tree, as well as all of the people who then contact others to effectively and quickly alert all team members of the disaster.

Download Disaster Call Tree Template

Excel | Word | PowerPoint | PDF

Manufacturing Disaster Recovery Plan Template

In the event of a disaster that affects the normal manufacturing operations, use this template to outline the critical details needed to restore manufacturing. With space to document critical personnel responsibilities, contingency operations, backup locations, and more, manufacturing teams can continue or relocate operations to maintain normal functions as quickly as possible.

Download Manufacturing Disaster Recovery Plan Template

Disaster Recovery Runbook

Use this template to document the steps to recovery from a disaster. You can apply this template across a multitude of business functions or teams. Easily document key details like communication strategies, disaster declaration and response procedures, infrastructure overviews, and restoration details in one place. This template is available for download in Microsoft Word, PowerPoint, and PDF formats.

Download Disaster Recovery Runbook

Application Disaster Recovery Plan Template

Use this template to document specific steps for recovering from a disaster or business disruption. There is space to include policy statements, contact information, and disaster and emergency response teams and procedures. This template is available to customize and download in Microsoft Word, PowerPoint, and PDF formats.

Download Application Disaster Recovery Plan Template

Law Firm Disaster Recovery Plan Template

This template offers specific recovery procedures and processes associated specifically with law firms. Document disaster response steps, personnel losses, new employee training, and office space information to effectively tackle the aftermath of a disaster that plagues a law company. This template is available for download in Microsoft Word, PowerPoint, and PDF formats.

Download Law Firm Disaster Recovery Plan Template

What Is a Disaster Recovery Plan?

A disaster recovery plan (DRP) is a step-by-step procedure that outlines how a business or organization will recover from disrupted systems, operations, processes, or networks. The aim of a DRP is to identify critical systems or procedures, prioritize recovery time objectives (RTOs), document key personnel contact information, and outline any necessary policies to follow in the event of a disaster.

What Is the Purpose of a Disaster Recovery Plan?

A DRP is an essential document for any business or organization, as it ensures that all normal business processes, infrastructure, and applications continue to operate when a major disaster strikes. Usually, a disaster recovery plan is included as part of the overall business impact analysis .

Additionally, the plan provides details for responding to unplanned incidents, which can include cyber attacks, environmental or natural disasters (flood, earthquake, landslide, volcano, tornado, etc.), power disruptions, fires, employee errors, hardware or software failures, terrorism or sabotage, bomb or shooter threats, and more.

A DRP can also minimize the negative impacts of disasters by helping to ensure that all business locations are kept safe. In addition to all of these positive effects of having a DRP, it also helps with the following:

• Ensure employees and team members can react rapidly and restore activity effectively, in light of an emergency or disaster.
• Capture, summarize, and organize critical information needed to restore business operations.
• Develop, test, and document a detailed, easy-to-understand plan.
• Secure contingency plans, and ensure they are cost effective.
• Build resilience within the business.
• Identify responsibilities of each team member, and outline disaster practices to ensure effectiveness.
• Prepare and respond to emergencies most likely to plague certain business, teams, or roles.
• Ensure the overall prosperity and survival of the business.

Most businesses cannot afford to be non-profitable and lose critical operations for an extended period of time. DRPs help to ensure that all operations can be restored in a quick, responsive manner.

Steps For Creating a Disaster Recovery Plan

When you are writing your disaster recovery plan, start by conducting a thorough business impact analysis to identify your organization’s most essential parts or critical services and how a disaster might affect them. Assess the risk and impact associated with losing business functions in a disaster.

Look at historical or company background information to determine if any disasters have affected the organization in the past, and how they were consequently handled. Perform a gap analysis to compare what is currently being done to prevent or handle a disaster against what should be done, and see if there are missing components. Next, identify any existing preventive controls to mitigate disasters.

From there, you can start creating a disaster recovery plan by following these steps:

• Develop recovery strategies.
• Obtain management commitment and authorization to proceed with DRP creation.
• Classify and prioritize business operations.
• Set the scope of the DRP, either in covering a whole business, specific teams, or individual people.
• Develop the cost estimate and scheduling of the plan to share with key stakeholders.
• Determine supplies, equipment, and other infrastructure that must be maintained during a disaster.
• Establish an emergency communication system, usually through a call tree, and include support services and assistance information.
• Document emergency response actions and internal recovery strategies, and designate specific teams to carry them out, as well as dependent processes that must be handled in a particular order.
• Determine data and records backup and data restoration times to ensure timely IT recovery.
• Designate specific phases of your DRP, such as a response phase, resumption phase, and restoration phase.
• Identify “hot” and “cold” sites, when necessary.
• Plan an evacuation route.
• Include detailed instructions and contact information in the case of a medical emergency.
• Determine a comprehensive plan to rebuild a disaster site.
• Determine a hazard assessment to minimize exposure to risks and dangers.
• Create an emergency checklist to have on-hand when a disaster strikes.
• Conduct tests and trainings of the DRP.
• Perform an annual review of your DRP and document any necessary changes in the plan.

Who Are the Resources Involved in a Disaster Recovery Plan?

A DRP is comprised of many different human resources who are leveraged when a disaster or emergency strikes. These participants are usually grouped into teams to cover a variety of important responsibilities included in a DRP.

The plan development team helps craft the plan and assigns responsibilities to the other resources. The IT and application teams deal with disaster strategies that disrupt that portion of the business, and the emergency response team focuses on the overall emergency response process of the entire organization.

Within the emergency response team is a primary crisis manager and a company spokesperson who both focus on communicating and acting on emergency response procedures. An emergency contact helps in altering the rest of the business of the disaster, specifically to vendors or suppliers who may work remotely.

Tips For Creating a Disaster Recovery Plan

Because a DRP is an important document for any business or organization to have, creating the most accurate, clear, and actionable plan can be daunting. The following tips can help:

• Establish clearly defined roles for each team member.
• Get support and buy-in from senior management.
• Keep the wording and process description simple.
• Review results with business units.
• Be flexible and accept suggestions regarding all parts of the DRP.
• Plan for emergencies most likely to happen where you live, or according to your business.
• Detail what to do in the event of lost communication, evacuation, and safety threats.
• Make sure you have a strong communication plan across your organization.
• Always plan and prepare for the worst case scenario.
• Conduct extensive risk assessments to ensure you are covering all your bases.
• Consider the specific needs or accommodations of all employees.
• Organize your team and perform practice plans before a disaster actually strikes.

Once you have completed the plan, ask the following questions to ensure that your DRP is coherent, comprehensive, and easy to implement:

• Are all employees able to execute the plan, and is everyone aware of their role?
• Are backup procedures detailed, and are they accessible within a desired timeline?
• Are there specific contingency operations in place if one of the primary procedures fails?
• Is the recovery time objective and recovery point objective (RPO) practical for your business and all of your team members?
• Can systems be restored before an excessive amount of revenue or data is lost?

Examples of Effective Disaster Recovery Plans and Additional Resources

For more direction in creating the most appropriate and actionable DRP for your business, refer to these recovery plan examples to gain familiarity and understanding of how to write and what to include in a DRP.

• MIT Disaster Recovery Plan : MIT outlines all critical components of a DRP, including purpose of plan, disaster response, disaster detection, and business continuity teams.
• IBM Disaster Recovery Plan : IBM clearly documents key details of their business to minimize the effect of a disaster, including recovery procedures, recovery sites, major goals, and plan testing.

To gain an even better idea of how to create the best disaster recovery plan, and detail why every business should have one, refer to these helpful resources and reports:

• NIST Special Publication 800-34
• EMC IT Downtime Report
• Computer Security Resource Center
• Guide to Test, Training, and Exercise Programs for IT Plans & Capabilities
• Building an Information Technology Security Awareness & Training Program
• FEMA: “Emergency Management Guide for Business and Industry”

Deploy Your Disaster Recovery Plan with Smartsheet

Empower your people to go above and beyond with a flexible platform designed to match the needs of your team — and adapt as those needs change. 

The Smartsheet platform makes it easy to plan, capture, manage, and report on work from anywhere, helping your team be more effective and get more done. Report on key metrics and get real-time visibility into work as it happens with roll-up reports, dashboards, and automated workflows built to keep your team connected and informed. 

When teams have clarity into the work getting done, there’s no telling how much more they can accomplish in the same amount of time.  Try Smartsheet for free, today.

Discover why over 90% of Fortune 100 companies trust Smartsheet to get work done.

A disaster recovery plan (DRP) is a detailed document that outlines how an organization will respond effectively to an unplanned incident and resume business operations.

DRPs help ensure that businesses are prepared to face many different types of disasters, including power outages,  ransomware  and  malware  attacks, natural disasters and much more.

A strong DRP quickly and effectively helps restore connectivity and repair data loss after a disaster. Companies worldwide were set to spend USD 219 billion in 2023 alone on  cybersecurity , a 12% increase from the previous year,  according to a report by the International Data Corporation  (link resides outside ibm.com).

What is a business continuity plan?

Like a DRP, a business continuity plan (BCP) is part of the  disaster recovery  process that helps businesses restore normal operations after a disaster happened. BCPs typically take a broader look at threats and resolution options than DRPs, focusing on what a company will need to restore basic business functions after an incident.

What is an incident response plan?

Incident response plans (IRPs) are a kind of DRP that focuses exclusively on cybersecurity and threats to information systems. An IRP clearly outlines an organization’s emergency response from the moment that they detect a threat through to its mitigation and resolution. An IRP seeks to address the specific damage done by a  cyberattack , and focuses exclusively on preparedness for threats to technology, IT infrastructure, business operations and reputation.

Connect and integrate your systems to prepare your infrastructure for AI.

Register for the guide on app modernization

DRPs play a critical role in the development of an overall security plan that helps ensure stakeholders, clients and investors that a business operates responsibly. Enterprises that don’t take the necessary steps to ensure preparedness face various risks, including costly data loss, operational downtime, financial penalties and reputational damage. 

Here are some of the benefits that businesses who invest in creating a strong DRP can enjoy:

Shorter downtimes

Many of today’s top businesses rely heavily on technology for normal operations. When an unplanned incident disrupts business as usual, it can cost millions. The high-profile nature of cyberattacks and the frequently analyzed length   of their downtimes can also result in customers and investors losing confidence. Strong, vigorously tested DRPs help companies get back up and running swiftly and smoothly after an unplanned incident.

Reduced recovery costs

Recovering from an incident can be expensive. According to IBM’s recent Cost of Data Breach Report , the average cost of a breach in 2023 was USD 4.45 million, a 15% increase over the previous three years. Enterprises with strong DRPs in place can significantly reduce the costs of business recovery and other fallout from an unplanned incident. The same report found that, on average, organizations that use security AI and automation extensively save USD 1.76 million compared with organizations that don’t.

Lower cyber insurance

Because of the scale and frequency of cyberattacks, many enterprises rely on cyber insurance to protect them from dangerous security breaches. Many insurers won’t insure an enterprise that hasn't established a strong DRP. DRPs can help reduce your business' overall risk profile with insurers and help keep premiums low.

Fewer fines in heavily regulated sectors

Businesses that operate in heavily regulated sectors, such as healthcare and personal finance, face heavy fines and penalties for data breaches. Shortening response and recovery lifecycles is critical in these sectors as the amount of a financial penalty is often tied to the duration and severity of a breach. Enterprises with robust DRPs can recover more quickly and wholly from an unplanned incident and face fewer fines as a result.

The most effective DRPs are developed alongside strong BCPs and IRPs that provide crucial support when an incident occurs. Let’s look at a few key terms that are essential in understanding how DRPs work and what to consider when building your own:

Failover or failback

Failover is a widely used process where IT operations are moved to a secondary system when a primary one fails due to a power outage, cyberattack or other threat. Failback is the process of switching back to the original system after it has been restored. For example, a business might failover from its  data center  onto a secondary site where a redundant system takes effect instantly. If run properly, failover or failback can create a seamless experience where a user or customer isn’t even aware they are being moved to a secondary system.

Recovery time objective (RTO)

RTO refers to the amount of time that it takes to restore business operations after an unplanned incident. Establishing a reasonable RTO is one of the first things businesses need do when they’re creating their DRP. 

Recovery point objective (RPO)

Your business’s RPO is the amount of data that it can afford to lose in a disaster and still recover. Some enterprises constantly copy data to a remote data center to ensure continuity if there is a massive breach. Others set a tolerable RPO of a few minutes—or hours—so they know they can recover from whatever they've lost during that time.

Disaster-recovery-as-a-service (DRaaS)

DRaaS has been gaining popularity of late due to a growing awareness around the importance of data security. Companies that take a DRaaS approach to creating their DRPs are outsourcing their disaster recovery to a third party. This third-party hosts and manages the necessary infrastructure for recovery, then creates and manages response plans and ensures a swift resumption of business-critical operations.  According to a recent report by Global Market Insights  (link resides outside ibm.com), the market size for DRaaS was USD 11.5 billion in 2022 and was set to grow by 22% in 2023.

With the prevalence and rising sophistication of cybercrime, most organizations are focusing their DRP efforts on their IT infrastructure, including critical data backup procedures (both on and offsite) and data protection. Here are a few examples of IT disaster recovery plans that have been tailored to fit a specific threat or business need:

A data center DRP focuses on the overall security of a data center facility and its ability to get back up and running after an unplanned incident. Some common threats to data storage include overstretched personnel that can result in human error, cyberattacks, power outages and difficulty following compliance requirements. Data center DRPs create operational risk assessments that analyze key components, such as physical environment, connectivity, power sources and security. Since data centers face a wide range of potential threats, their IT DRPs tend to be broader in scope than others.

Network DRPs rely on a clear set of steps to help an organization recover from an interruption of network services, including internet access, cellular data, local area networks and wide area networks. Considering how vital networked services are to business operations, an effective network DRP must clearly outline the steps, roles and responsibilities necessary to restore services quickly and effectively after a network compromise.

A virtualized DRP can dramatically enhance the effectiveness and speed of a recovery effort. Virtualized DRPs rely on  virtual machine  (VM) instances that can be ready to operate within a couple of minutes. Virtual machines are representations, or emulations, of physical computers that provide critical application recovery through high availability, or the ability of a system to operate continuously without failing.

Given the prevalence of  cloud computing  in many enterprise workloads, having a tailored DRP for the restoration of cloud services is becoming more common. Cloud DRPs outline a series of steps that ensure cloud data is backed up and apps and systems that rely on the cloud are restored smoothly.

The development of a DRP starts with an analysis of business processes, risk analysis and a few clearly defined recovery objectives. While there is no reliable, one-size-fits-all template, there are several steps you can take—regardless of company size or industry—to ensure you have a process in place to face various incidents.   

A business impact analysis (BIA) is a careful assessment of each threat that a company might face and what its ramifications might be. A strong BIA examines how a potential threat might impact things such as daily operations, communication channels and worker safety. Some examples of potential considerations for a BIA include loss of revenue, cost of downtime, cost of reputational repair (public relations), loss of customers and investors (short and long term) and any incurred penalties from compliance violations.

Different industries and types of businesses face different threats, so risk analysis is critical to determining how you respond to each one. You can assess each risk separately by considering both its likelihood and potential impact. There are two widely used methods for determining risk: qualitative and quantitative risk analysis. Qualitative analysis is based on perceived risk, while quantitative analysis is performed by using verifiable data.

To recover from a cyber incident, it’s important to have a complete picture of the assets your enterprise owns. Doing regular inventory helps identify hardware, software, IT infrastructure, data and other assets that are critical to business operations. You can use labels such as "Critical", "Important" and "Unimportant" as a starting point to divide your assets into three overarching categories, then assign them more specific labels as needed:

• Critical:  Only label assets as critical if your enterprise needs them for your normal business operations.
• Important:  Give this label to assets that you use at least once a day and would have an impact on business operations (but not shut them down entirely) if they are disrupted.
• Unimportant:  These are assets your business uses infrequently that are not essential for normal business operations.

The roles and responsibilities section of your DRP is arguably the most important. Without it, no one knows what to do when an unplanned incident occurs. While actual roles and responsibilities vary greatly depending on the type of business you conduct, here are some typical roles and responsibilities contained in most DRPs:

• Incident reporting:  You should assign an individual (or individuals) in each department whose sole responsibility is communicating with the management team, stakeholders and all relevant authorities when disruptive events occur.
• DRP management:  You should appoint a DRP supervisor to ensure that team members are performing their assigned tasks, and that the DRP is running smoothly. 
• Asset protection:  You should give someone the job of securing and protecting your most critical assets when a disaster strikes and reporting back on their status to management and stakeholders. 
• Third-party communication:  You should make it the responsibility of one person to coordinate with any third-party vendors you’ve hired as part of your DRP. This person should give constant updates on how the DRP is going to any relevant stakeholders. 

To ensure that your DRP unfolds seamlessly during an actual incident, you need to practice it regularly and update it according to any meaningful changes you make to your business. For example, if your company acquires a new asset after your DRP has been formed, you’ll need to incorporate it into your plan to ensure it's protected going forward.

Testing and refinement can be simplified into three steps:

• Create an accurate simulation:  Try to create an environment as close to the actual scenario your company will face without putting anyone at physical risk.
• Identify problems:  Use the testing process to identify faults and inconsistencies with your plan, then address them in the next iteration of your DRP.  
• Test your backup and restore capabilities:  Seeing how you’ll respond to an incident is vital, but it’s just as important to test the procedures you’ve put in place for restoring your critical systems when the incident is over. Test how you’ll turn networks back on, recover any lost data and resume normal business operations. 

Protect your data with a cloud disaster recovery plan.

Employ a highly durable, scalable and security-rich destination for backing up your data.

Expand capacity and consolidate data center infrastructure onto an automated and centrally managed software-defined data center with IBM Cloud for VMware Solutions.

Accelerate business recovery in response to cyberattack events by using AI-powered threat detection methods developed by IBM Research®.

Many factors come into play when deciding whether to invest in and manage your on-premises DR solutions or use DRaaS providers.

Backup and restore refers to technologies and practices for making periodic copies of data and applications to a separate, secondary device and then using those copies to recover the data and applications.

There are critical similarities and differences between disaster recovery and backup. Both these solutions can help you solve your business' most important problems.

Enable early threat detection and fast data recovery to help organizations reestablish business operations in minutes instead of days.

IBM Cloud for VMware Solutions supports a wide variety of VMware products and services in its cloud environment. Migrate all of your VMware workloads from on-premises infrastructure to IBM Cloud, or mix and match, creating a hybrid cloud environment you can manage from a single place.

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Business Continuity Planning

Organize a business continuity team and compile a  business continuity plan  to manage a business disruption. Learn more about how to put together and test a business continuity plan with the videos below.

Business Continuity Plan Supporting Resources

• Business Continuity Plan Situation Manual
• Business Continuity Plan Test Exercise Planner Instructions
• Business Continuity Plan Test Facilitator and Evaluator Handbook

Business Continuity Training Videos

The Business Continuity Planning Suite is no longer supported or available for download.

Business Continuity Training Introduction

An overview of the concepts detailed within this training. Also, included is a humorous, short video that introduces viewers to the concept of business continuity planning and highlights the benefits of having a plan. Two men in an elevator experience a spectrum of disasters from a loss of power, to rain, fire, and a human threat. One man is prepared for each disaster and the other is not.

View on YouTube

Business Continuity Training Part 1: What is Business Continuity Planning?

An explanation of what business continuity planning means and what it entails to create a business continuity plan. This segment also incorporates an interview with a company that has successfully implemented a business continuity plan and includes a discussion about what business continuity planning means to them.

Business Continuity Training Part 2: Why is Business Continuity Planning Important?

An examination of the value a business continuity plan can bring to an organization. This segment also incorporates an interview with a company that has successfully implemented a business continuity plan and includes a discussion about how business continuity planning has been valuable to them.

Business Continuity Training Part 3: What's the Business Continuity Planning Process?

An overview of the business continuity planning process. This segment also incorporates an interview with a company about its process of successfully implementing a business continuity plan.

Business Continuity Training Part 3: Planning Process Step 1

The first of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “prepare” to create a business continuity plan.

Business Continuity Training Part 3: Planning Process Step 2

The second of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “define” their business continuity plan objectives.

Business Continuity Training Part 3: Planning Process Step 3

The third of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “identify” and prioritize potential risks and impacts.

Business Continuity Training Part 3: Planning Process Step 4

The fourth of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “develop” business continuity strategies.

Business Continuity Training Part 3: Planning Process Step 5

The fifth of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should define their “teams” and tasks.

Business Continuity Training Part 3: Planning Process Step 6

The sixth of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “test” their business continuity plans. View on YouTube

Last Updated: 12/21/2023

Return to top

• Pricing Overview
• CrashPlan Essential
• CrashPlan Professional
• CrashPlan Enterprise
• CrashPlan for MSPs
• Ransomware Recovery
• Device Migration
• Disaster Recovery
• State and Local
• Financial Services
• Research & Development
• Technology & Media
• Business Services
• Our Partners
• Become a Reseller
• Become an MSP Partner
• Become an Affiliate
• Resources Overview
• Security and Compliance

How to create a disaster recovery plan (DRP)

A disaster recovery plan (DRP) is a set of guidelines and procedures that ensure the availability of data and critical systems in the event of a disaster. Putting a DRP in place insulates your organization from negative consequences such as:

• Data loss: Proper backups and a cybersecurity disaster recovery plan allows an organization to recover important data which would otherwise have been lost.
• Business interruption: Quick recovery of critical systems and data can reduce downtime, and keep your business productive
• Legal and regulatory compliance issues: Certain industries are subject to certain data regulations. A DRP helps avoid an accidental violation of regulations and their respective penalties.
• Increased costs: Having a DRP can help lower costs for disaster recovery and keep insurance rates from growing.
• Loss of customer trust: By protecting your customers’ sensitive data, you’ll help preserve trust and retain their business.

While very important, the process of creating a DRP shouldn’t be feared. That’s why we’ve prepared this step-by-step guide to help you create the plan that best suits your organization.

The Difference Between a Business Continuity Plan and a Disaster Recovery Plan

Although business continuity planning (BCP) and disaster recovery (DR) share similar objectives in enhancing an organization’s resiliency, they differ in terms of their scope. Business continuity is a proactive strategy that aims to reduce risks and maintain the ability of an organization to provide products and services, regardless of any disruptions. It primarily concentrates on methods to ensure that employees can continue their work and that the business can remain operational during a disaster event.

On the other hand, disaster recovery is a subset of business continuity that specifically deals with the IT systems essential for business continuity. It outlines the steps needed to restore technology operations after an incident occurs. It’s a reactive process that necessitates planning but is only activated when a disaster actually happens.

Essential Steps for Creating an Effective Disaster Recovery Plan

Here is an overview of disaster recovery planning steps.

Obtain Management Buy-In

The top management plays a key role in ensuring the success of the DRP. It allocates resources in the form of capital, human resources, time, and advisory support to the team charged with developing and implementing the plan. Therefore, management should be involved in the entire process. Before starting, ensure that the top management is on the same page and has given you the nod to continue with the plan. Address any concerns that the management team may have regarding the plan before getting started.

Create Your DRP Team

Put together a DRP team to oversee the development and actual implementation of your plan. Each member of the disaster recovery planning committee should play a specific role in the success of your plan. This ensures that the operations during a disaster are smooth and well coordinated. Here are the most critical roles on the team:

• Disaster Recovery Team Lead: This person is responsible for the development and implementation of the DRP. They also coordinate the efforts of the other team members.
• Unit Managers: They are accountable to management  for identifying the critical systems, processes, and data that are essential to their specific business unit and developing recovery procedures for those assets.
• IT/IS Staff: They are responsible for the technical aspects of the DRP, including the creation and maintenance of backups, testing of recovery procedures, and coordination with vendors and other IT services.
• Communication/Public Relations: They are responsible for developing and implementing communications procedures for use during a disaster and communicating with internal and external stakeholders (E.g. customers and media).
• Employee or Human Resource Representatives: They are responsible for addressing the needs of employees during and after a disaster, including coordinating evacuation and providing support for employees affected by the disaster.
• Legal and Regulatory Compliance Team: They are responsible for ensuring that the DRP is compliant with all relevant laws and regulations, as well as helping the organization avoid penalties and legal entanglements.
• External vendors: They can provide important support, such as disaster recovery services, equipment rental, and other logistics. You should have their roles and contact information readily available and documented.

Complete a Risk Assessment

An effective Disaster Recovery Plan (DRP) is built on a thorough business impact and risk analysis that considers various likely disasters, such as technical, human-induced, and natural disasters.

The disaster recovery planning committee should analyze the potential risks and consequences of these disasters in each department in the organization. This process should consider all critical systems, processes, and data essential to the organization’s operations, as well as the potential consequences and negative impact of each disaster scenario on the organization’s overall performance.

Traditionally, fire has been a leading threat to organizations, but it is essential to also consider scenarios of human malicious destruction, such as cyber-attacks, sabotage, or terrorism, and plan accordingly. The DRP should also provide for the worst scenario, such as complete site destruction.

The committee should also evaluate the impacts of the loss of vital data. This could include, but is not limited to, data recovery costs, productivity loss, and reputational damage. Additionally, it should analyze the costs related to preventing data loss and creating a robust IT disaster recovery plan, including the costs of equipment, software, personnel, and external vendors.

It’s important to keep in mind that risk assessment and business impact analysis are ongoing processes that need to be regularly updated to reflect changes in the organization’s operations and threat environment. By assessing the potential risks and impacts of different disaster scenarios, organizations can better prepare for and respond to a disaster, minimize downtime, and mitigate consequences following an emergency.

Identify Critical Needs and Recovery Strategies

Organizations should evaluate the critical needs of each department to ensure continuity of operations in the event of a disaster. The evaluation should focus on several key areas, including operations, key departmental personnel, information, processing systems, service, documentation, vital records, and procedures. Analysis helps the organization determine how much time it can operate without any such systems.

Define what constitutes a department’s critical needs. These are essential procedures and equipment required for a department, server room, main facility, or all of these to continue operations in the event of a disruption such as destruction or inaccessibility. Document all departmental operations. Then, rank the operations and processes in terms of priority, with essential functions at the top, followed by important, then non-essential functions.

Once done, check the recovery options available for each of the assets. Prioritize the best options in terms of full recovery and speed, but have as many options at hand as possible. Here are some possible options:

• Backup and recovery: This strategy involves regularly creating backups of important data and storing them in a secure location (hopefully geographically isolated from the source). In the event of data loss, the backup can be used to recover the lost data.
• RAID recovery: involves using specialized software to reconstruct data from a RAID (redundant array of independent disks) system that has failed. This will be helpful for recovering from hardware failure associated with a server in your data center.
• Cloud recovery: This is the use of cloud services to store and recover data. Be mindful of the way you leverage cloud/SaaS for data storage and possible gaps in usage and adoption within your organization.
• Remote recovery: You use remote access technology to access and recover data from a remote data server. If you have a so-called “warm” or “hot” spare copy of your data for redundancy, you can leverage this for re-population of an impacted site instead of a backup.
• Physical recovery: This involves repairing IT infrastructure after physical damage or replacing failed hardware in order to recover data.
• Disk imaging: Here, you create a virtual copy of the entire storage space on a particular medium or just the used space. This can also be known as “full system” or “bare-metal” restoration. You restore the image after losing data.

The 321 backup strategy is a widely accepted best practice for data backup and recovery. It involves creating three copies of important data, storing them on two different types of media, and keeping one copy offsite. This strategy helps protect against data loss due to a variety of potential issues, such as hardware failure, natural disasters, or cyber-attacks. The three copies of the data provide redundancy, while the use of multiple types of media and offsite storage helps to protect against data loss from more complex incidents (such as a natural or site disaster).

Collect Data and Document Your Disaster Recovery Plan

Here are some common types of data to gather:

• Critical telephone numbers
• Listing for backup positions
• Communications inventory
• Equipment inventory
• Software and data file backup and retention schedules
• Primary calling list
• Vendor list
• Main computer hardware inventory
• Microcomputer software and hardware inventory
• Telephone inventory
• Forms inventory
• Insurance policy inventory
• Office supply inventory
• Distribution register
• Documentation inventory
• Notification checklist
• Offsite storage location inventory
• Temporary location details

Write a plan detailing all procedures to use before and after a data disaster. The written plan should also include procedures for updating the plan to reflect any changes in important areas it covers. Be as specific as possible. Do not assume the person or people deploying the plan have your same level of knowledge. For example, “migrate system to new network segment” may not be enough information.

Structure the disaster recovery plan with team members. Assign specific responsibilities to each department in the organization. You should have someone responsible for facilities, logistics, administrative functions, user support, restoration, computer backup, and any other essential area in the organization.

Test and Revise

There are several ways to test a DRP:

• Conduct a tabletop exercise in which key personnel simulate a disaster scenario and work through the procedures outlined in the plan.
• Conduct a full-scale test in which the procedures are actually executed in a controlled environment.
• Perform regular reviews and updates of the plan to ensure that it takes into account any changes in the organization’s systems or operations.

A regular testing process should be established to determine the effectiveness of the DR plan and identify areas for improvement. Address any issues identified during testing during the revision. Check if the issues have been resolved in your next test cycle. Remember, testing and revising is a continuous process that should occur regularly.

Maintain an Updated DRP

Keeping a disaster recovery plan up to date is critical for effective disaster response and recovery. An updated DRP should consider changes in the organization’s systems or operations. This includes new technologies, business processes, software and hardware assets, personnel or organizational structure changes, and any other changes that may impact the organization’s ability to recover from a disaster.

Regular reviews and updates to the DRP help ensure that it remains current and relevant and that the organization is prepared to respond to and recover from a wide range of potential disasters. It should be reviewed at regular intervals, such as once a year, or more frequently if there are significant changes to the organization.

During the review process, assess the effectiveness of the plan, identify areas for improvement, and update the procedures and strategies as necessary. This may include updating contact lists, reviewing recovery time objectives, conducting additional testing of the plan, and also updating the backup solutions, and testing the data recovery.

It is also important to keep staff informed and educated about the changes to the plan so that they are prepared to respond quickly and effectively in a disaster.

Start now with CrashPlan

An effective disaster recovery plan can make or break your organization. It’s your perfect ally when an unexpected threat becomes a reality and interrupts your operations. Don’t wait until you actually need it and start putting together your set of tools to help in data loss protection and recovery, minimizing downtime and associated losses in the meantime.

That’s where we come in. CrashPlan offers the protection you need to keep your critical information safe. Reduce your operational interruptions and the costs of pulling through a disaster with cost-effective automatic cloud backup. No matter how many devices your DRP covers, we can have options tailor made for your team.

CrashPlan is the endpoint cloud backup solution for you. We have the expertise and tools to cater to any data backup requirements. Contact us today for a consultation.

9 Point disaster recovery plan checklist

Business continuity vs disaster recovery: The difference explained

Cybersecurity: disaster recovery planning to protect your business from ransomware.

The complete guide to disaster recovery planning (DRP)

CrashPlan® provides peace of mind through secure, scalable, and straightforward endpoint data backup. We help organizations recover from any worst-case scenario, whether it is a disaster, simple human error, a stolen laptop, ransomware or an as-of-yet undiscovered calamity.

• Become a Partner

© 2024 CrashPlan® All rights reserved.

Privacy | Legal | Cookie Notice | Free Trial

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

• For Businesses

Prepare My Business for an Emergency

Businesses can do much to prepare for the impact of the many hazards they face in today’s world including natural hazards, human-caused hazards or technology related hazards.

• Natural hazards could be a flood, hurricane, tornado, earthquake or a widespread serious illness such as the H1N1 flu virus pandemic.
• Human-caused hazards include accidents, acts of violence by people and acts of terrorism.
• Examples of technology-related hazards are the failure or malfunction of systems, equipment or software.

DHS/FEMA sponsors a resource called “Ready Business” to assist businesses in developing a preparedness program by providing tools to create a plan that addresses the impact of many hazards. The direction recommended is to adopt a standard for Disaster/Emergency Management and Business Continuity Programs called an “all hazards approach.”

Steps to Create a Business Preparedness Program

To develop an “all hazards approach,” DHS has adopted National Fire Protection Association 1600 (NFPA 1600) as the American National Standard for developing a preparedness program.

There are five steps toward creating a business preparedness program:

1. Program Management

• Organize, develop and administer your preparedness program
• Identify regulations that establish minimum requirements for your program

2. Planning

• Gather information about hazards and assess risks
• Conduct a business impact analysis (BIA)
• Examine ways to prevent hazards and reduce risks

3. Implementation

Write a preparedness plan addressing:

• Resource management
• Emergency response
• Crisis communications
• Business continuity
• Information technology
• Employee assistance
• Incident management

4. Testing and Exercises

• Test and evaluate your plan
• Define different types of exercises
• Learn how to conduct exercises
• Use exercise results to evaluate the effectiveness of the plan

5. Program Improvement

• Identify when the preparedness program needs to be reviewed
• Discover methods to evaluate the preparedness program
• Utilize the review to make necessary changes and plan improvements
• How Do I - For Businesses
• Preparedness

BCDR Plan Template

What Is A Business Continuity And Disaster Recovery Plan?

A Business Continuity and Disaster Recovery (BCDR) plan is an all-encompassing strategy that details how an organization will respond to and recover from potential threats and business disruptions. Taking a proactive approach, it ensures the continuity of critical business functions while minimizing the impact of adverse events, such as natural disasters, technological failures, cyber attacks, or any other incidents that could disrupt normal operations.

Comprising a series of documented business processes, protocols, and resources, the plan equips an organization to respond effectively to a wide range of disruptions for effective emergency management.

Through the implementation of a robust BCDR plan, organizations can minimize downtime, protect their reputation, maintain customer trust, and ensure their recovery strategies are effective. This enables the business to continue functioning as smoothly as possible in the face of challenging circumstances.

Business Continuity Plan & Disaster Recovery Plan - Key Differences

When it comes to ensuring organizational resilience in the face of disruptions, two key components play vital roles: the Business Continuity Plan (BCP) and the Disaster Recovery Plan (DRP). While both plans contribute to the overall goal of maintaining operations and recovering from adverse events, they have distinct focuses and scopes.

👉🏻Understanding the key differences between a BCP and a DRP is essential for organizations to develop a comprehensive strategy that addresses both business continuity and IT recovery activities.

Business Continuity Plan (BCP)

The Business Continuity Plan (BCP) is a proactive strategy designed to ensure the continuity of critical business functions during and after a disruptive event. It encompasses a comprehensive approach to minimize downtime, manage the impact on the overall business, and maintain essential operations. The BCP focuses on a broad range of potential disruptions, including natural disasters, technology failures, cyber attacks, pandemics, or any event that could disrupt normal business operations.

Its key components include:

• Identifying critical business functions.
• Assessing risks and vulnerabilities.
• Implementing preventive measures.
• Establishing alternate work arrangements.
• Developing resumption plans.

Disaster Recovery Plan (DRP)

The Disaster Recovery Plan (DRP) is a specific subset of the BCP that focuses on the recovery of IT infrastructure, information systems, and data in the event of a disaster. It provides guidance on technical aspects of IT disaster recovery to restore critical systems and information technology assets.

Key elements of the DRP include:

• Data backup and recovery.
• System restoration.
• Alternative infrastructure arrangements.

Uniting Business Continuity and Disaster Recovery: The BCDR Plan

The Business Continuity and Disaster Recovery (BCDR) plan serves as the overarching framework that unites both the Business Continuity Plan (BCP) and the Disaster Recovery Plan (DRP) . The BCDR plan integrates the strategies, procedures, and resources from both plans into a comprehensive approach to ensure organizational resilience. It addresses the broader business perspective covered by the BCP while also focusing on the technical recovery efforts handled by the DRP.

🫱🏻‍🫲🏼 By combining the BCP and DRP, the BCDR plan enables organizations to effectively respond to and recover from disruptions. It ensures the continuity of critical business functions, minimizes downtime, protects valuable data, and allows for a swift restoration of operations . With a well-designed BCDR plan in place, organizations can navigate through challenging circumstances, safeguard their reputation, maintain customer trust, and quickly resume normal operations, even in the face of adverse events.

What Is A BCDR Plan Template?

A BCDR (Business Continuity and Disaster Recovery) plan template is a pre-designed framework or structure that organizations can use as a starting point to develop their own customized strategic plans . It provides a standardized format and guidelines for creating a BCDR plan tailored to the specific needs and circumstances of the organization.

By leveraging a template, organizations can save time and effort in creating a structured and comprehensive BCDR plan that addresses their unique requirements, risks, and recovery objectives.

What's Included In This BCDR Plan Template?

• 3 focus areas
• 6 objectives

Each focus area has its own objectives, projects, and KPIs to ensure that the strategy is comprehensive and effective.

Once you have set your template, you can also create dashboards for real-time performance monitoring.

And yes - you get free access with no credit card required. ✅

Who Is The BCDR Plan Template For?

The BCDR (Business Continuity and Disaster Recovery) plan template is designed to cater to a wide range of organizations, from small businesses to large enterprises, across various industries. It serves as a valuable resource for senior management, continuity managers, recovery teams, IT professionals, and team members responsible for developing and implementing strategies to ensure organizational resilience. Additionally, stakeholders and service providers involved in the continuity and recovery process can also benefit from the template's structured approach.

By utilizing the BCDR plan template, organizations can create an actionable plan that outlines the necessary steps and procedures to ensure business continuity in the event of a disaster. It offers a standardized framework that can be customized to meet the specific needs and resources of the organization. This enables not only the management team but also human resources and other team members to actively participate in the planning and implementation of resilience strategies. By engaging stakeholders and service providers, the template encourages collaboration and alignment of efforts to effectively safeguard the organization's continuity and recovery.

What are the steps to use this BCDR Plan Template?

Once you have successfully created a free account in Cascade, you will immediately have access to pre-filled data that includes sample focus areas, objectives, and Key Performance Indicators (KPIs).

Here's how you can make the most out of this template:

1. Define clear examples of your focus areas

Focus areas serve as the overarching topics that should be addressed within your business continuity and disaster recovery plan. Identifying and defining these areas is crucial to ensure a comprehensive and effective plan that aligns with your organization's objectives and needs.

How to choose the right focus areas?

Selecting the right focus areas can be challenging, as it requires understanding where to start and how to prioritize the most impactful aspects for your business. To guide this process, consider the key elements typically included in a BCDR plan before defining your specific focus areas:

• Business Impact Analysis (BIA) : This step involves identifying and prioritizing critical functions, processes, and assets. It also entails determining the potential impact of disruptions and establishing recovery time objectives (RTO) and recovery point objectives (RPO).
• Risk Assessment : Here, potential threats and vulnerabilities that could lead to disruptions are identified and assessed. These may include natural disasters, power outages, data breaches, or equipment failures. You can use a risk matrix to easily visualize internal and external threats and dangers to projects and organizations.
• Prevention and Mitigation Strategies : To prevent or reduce the likelihood of disruptions, various measures need to be implemented. These could include redundancy in systems and infrastructure, cybersecurity measures, regular backups, and data protection strategies.
• Response and Recovery Procedures : This section outlines the steps to be taken during and immediately after a disruptive event. It entails a clear delineation of roles and responsibilities, communication protocols, activation of emergency response teams, evacuation plans, and other pertinent actions ensuring employee safety and safeguarding critical assets.
• Data Backup and Recovery : Procedures for regular data backups, off-site storage, and recovery processes are established to enable the restoration of data in case of loss or corruption.
• Testing and Training : Regular testing of the BCDR plan is crucial to validate its effectiveness and identify areas for improvement. Training staff members on their roles and responsibilities, as well as conducting drills or simulations, contribute to readiness during an actual event.
• Ongoing Maintenance and Review : Regular review, updates, and maintenance of the BCDR plan are essential to keep it aligned with the evolving business environment, technological advancements, and emerging threats. Incorporating lessons learned from previous incidents is also fundamental.

🔝 These key elements above can serve as your focus areas if they match your business needs!

By clearly defining these focus areas, you can develop an actionable plan that encompasses all the critical aspects necessary for ensuring organizational resilience.

📃 Pre-filled examples of focus areas in this BCDR Template include business continuity, IT security, data backup and recovery, and communications. Tweak them easily to match your business’ priorities!

2. Think about the objectives that could fall under that focus area

Objectives represent the specific goals you aim to accomplish within each focus area. They serve as the milestones that contribute to meeting the overall focus area. When defining objectives, ensure they are specific, measurable, and realistic within a certain defined timeframe.

Examples of objectives for the focus area of Data Backup and Recovery could be:

• Implement automated data backups for workstations, servers, and data centers.
• Maintain up-to-date contact information for the data recovery team.
• Ensure redundant connectivity for uninterrupted data access.
• Establish secure off-site data storage for backup and recovery.
• Conduct regular tests to validate data recovery procedures.
• Develop alternate site strategies for seamless continuity of operations.

💡 Remember to tailor these objectives to your specific organizational needs and consider any additional factors that may be relevant to your focus area.

3. Set measurable targets (KPIs) to tackle the objective

Key Performance Indicators (KPIs) are the metrics that you use to measure your success in achieving the objectives. KPIs should be measurable and achievable.

Examples of KPIs related to the objectives above could be:

• Achieve a Backup Completion Rate of 95%.
• Maintain Contact Information Accuracy at 95%.
• Ensure Network Uptime of at least 99.5%.
• Reduce Data Recovery Time to 2 hours.
• Improve Recovery Testing Success Rate to 95%.
• Minimize Site Recovery Time to 12 hours.

By defining these KPIs, you establish tangible benchmarks to monitor progress and evaluate the effectiveness of each objective. Regularly track and adjust these KPIs based on your organization's specific requirements and desired performance levels.

4. Implement related projects to achieve the KPIs

Projects, also referred to as actions, encompass the specific initiatives necessary to accomplish the objectives and reach the target KPIs. They should be specific and actionable within a set timeframe. They should also have clear owners that will make sure the project is implemented, to drive accountability in your teams.

Examples of projects for a BCDR plan could be:

• Implement automated backups for all systems.
• Review and update contact details of recovery team.
• Establish backup connectivity for continuous data access.
• Set up secure off-site storage for data backups.
• Conduct periodic tests to verify data recovery.
• Develop alternate site plans for seamless transition.

Tailor these projects to your organization's needs and allocate appropriate resources to achieve your objectives.

5. Utilize Cascade Strategy Execution Platform to see faster results from your strategy

Cascade Strategy Execution Platform empowers organizations to effectively track, manage, and report on their strategies. This comprehensive platform enables teams to swiftly develop and implement strategies, offering real-time progress updates. By leveraging Cascade, teams can accelerate strategy execution, ensuring heightened readiness to tackle disruptions or emergencies.

Some of our key features include:

• Integrations : Consolidate your business systems underneath a unified roof to reach the pinnacle of clarity in your strategic decision-making. Import context in real-time by leveraging Cascade’s +1,000 native, third-party connector (Zapier/PA), and custom integrations.
• Dashboards & Reports : Gauge an accurate picture of your strategic performance and share it with your stakeholders, suppliers, and contractors. Evaluate your margins at a glance to weigh revenue-generating initiatives versus cost-impacting.

• Relationships: Prepare for the unexpected by tracking the program dependencies, blockers, and risks that may lie along your strategic journey.

Explore Related Templates

• Business Continuity Plan Template
• Disaster Recovery Plan Template
• Cloud Disaster Recovery Plan Template
• Supply Chain Business Continuity Plan Template
• Business Continuity and Disaster Preparedness Plan
• Risk Management Strategy Template

🔍 Didn’t find what you were looking for? Check out our Template Library with thousands of templates to help you streamline your strategic planning process.

An official website of the United States government

Here’s how you know

Official websites use .gov

A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS

A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. .

Planning Guides

Planning Considerations

Comprehensive Guides

Houses of Worship & Schools

Pre-Disaster Recovery

Other Resources

Accomplished properly, planning provides a methodical way to engage the whole community in thinking through the lifecycle of a potential crisis, determining required capabilities and establishing a framework for roles and responsibilities. It shapes how a community envisions and shares a desired outcome, selects effective ways to achieve it and communicates expected results.

A shared planning community increases the likelihood of integration and synchronization, makes planning cycles more efficient and effective and makes plan maintenance easier.

We have resources to guide the way.

Have questions? Email the National Integration Center .

Climate Adaptation Planning: Guidance for Emergency Managers

We are releasing the “ Climate Adaptation Planning: Guidance for Emergency Managers .” The guide’s structure is designed to walk state, local, tribal, and territorial partners through the Six Step Planning Process, as identified in Comprehensive Preparedness Guide 101: Developing and Maintaining Emergency Operations Plans . The climate guide also highlights existing climate mapping tools, trainings, and potential funding resources.

Download the Guide

Attend an Overview Session

FEMA Seeks Feedback on Draft Guide

FEMA and the DHS Center for Faith-Based and Neighborhood Partnerships are seeking feedback on the draft, “Engaging Faith-Based and Community Organizations: Planning Considerations for Emergency Managers.” This document outlines best practices for engaging faith-based and community organizations before, during, and after disasters to help jurisdictions improve their resilience and emergency management capabilities.

To provide feedback on the draft:

• Download the line-numbered draft “ Engaging Faith-Based and Community Organizations: Planning Considerations for Emergency Managers ” and Feedback Form and email feedback to [email protected] by June 21, 2024.
• Attend a webinar session providing an overview of the draft and facilitated discussion with attendees to gather feedback.

Local Elected and Appointed Officials Guide

The document and associated quick reference guide and checklists provide an executive-level introduction to emergency management concepts and principles for local senior officials and identifies local senior officials’ roles and responsibilities for emergency management before, during and after disasters. Download the Quick Reference Guide and Checklist . View the short video on potential roles local elected and appointed officials can play before, during and after disasters.

Evacuation and Shelter-in-Place

Identifies relevant concepts, considerations, and principles that can inform jurisdictions in planning for evacuation and/or shelter-in-place protective actions.  The research report Improving Public Messaging for Evacuation and Shelter-in-Place and its companion slide library documents findings from peer-reviewed research and presents recommendations for informing community members about risk and providing effective warnings.

The Shelter-in-Place Pictogram Guidance provides the public clear protective action guidance for 10 hazards and three building types. The guidance includes recommended interior locations by hazard, additional protective actions, and duration. Social media friendly versions are available to provide clear protective action guidance regardless of platform.

Complex Coordinated Terrorist Attacks

Identifies  concepts and principles relevant to the development of related plans and the completion of a THIRA.

Engaging Faith-based and Community Organizations

Provides a methodology for emergency managers to engage and build partnerships with faith-based and community organizations in order to enhance resilience.

Disaster Financial Management Guide

Identifies the capabilities and activities necessary to prepare and successfully implement disaster financial management while maintaining fiscal responsibility throughout response and recovery operations.

Healthcare Facilities and Power Outages

Provides jurisdictions, utility owners/operators, and healthcare facilities with information and resources to improve resilience to power outages, integrate plans, and prioritize assistance during an outage.

Cyber Incidents

Developed in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), “ Planning Considerations for Cyber Incidents: Guidance for Emergency Managers Guide ” provides state, local, tribal, and territorial emergency managers with foundational knowledge of cyber incidents to increase cyber preparedness efforts in their jurisdictions. This guide is intended to help emergency management personnel collaboratively prepare for a cyber incident and support the development of a cyber incident response plan or annex. Download the Overview document and Critical Cyber Asset Identification & Prioritization Checklist . View the short video outlining the important roles emergency managers have in planning for cyber incidents impacting their communities through the identification and prioritization of critical services and dependencies.

Distribution Management Plans

Distribution Management Plans enable SLTT partners to strengthen capabilities before a disaster to enhance capacities to distribute resources to survivors after a disaster. FEMA. Effective 2019, all Emergency Management Performance Grant (EMPG) recipients are required to develop and maintain a Distribution Management Plan as an annex to their Emergency Operations Plan. View the frequently asked questions.

Disaster Housing

Guidance on national housing priorities, types of housing, key considerations and housing-specific planning recommendations that jurisdictions can apply when developing or improving housing plans.  ( Spanish )

Supply Chain Resilience Guide

Provides emergency managers with recommendations and best practices on how to analyze local supply chains and work with the private sector to enhance supply chain resilience using a five-phased approach.

Hazardous Materials Incidents

Provides officials with information and resources on hazardous materials, incident preparedness and response and practices to increase community resilience to those incidents.

Comprehensive Preparedness Guides (CPG)

Comprehensive preparedness guide 101: developing and maintaining emergency operations plans.

CPG 101 provides guidelines on developing emergency operations plans and promotes a common understanding of the fundamentals of community-based, risk-informed planning and decision making to help planners examine threats or hazards and produce integrated, coordinated and synchronized plans.

CPG 201: Threat and Hazard Identification and Risk Assessment (THIRA) and Stakeholder Preparedness Review (SPR) Guide

CPG 201 provides guidance for conducting a Threat and Hazard Identification and Risk Assessment (THIRA) and Stakeholder Preparedness Review (SPR).

CPG 502: Considerations for Fusion Center and Emergency Operations Center Coordination

CPG 502 outlines the information-sharing roles of fusion centers and emergency operations centers and identifies planning and coordination considerations each entity.

Emergency Operation Plans – Houses of Worship and Schools

Houses of worship.

Guide on emergency operations planning, discussing actions that may be taken before, during and after an incident to reduce the impact on property and loss of life. It encourages houses of worship to develop an emergency operations plan.

Institutions of Higher Education

This guide outlines principles of emergency management planning for institutions of higher education, provides a process for the development of emergency operations plans and describes the content with those plans.

K-12 Schools

This guide provides recommendations in the development of plans not only to respond to an emergency, but also outlines how schools (K-12) can plan for preventing, protecting against, mitigating the impact of and recovering from these emergencies.

Pre-Disaster Recovery Planning Guides

Tribal governments.

This guide prepares tribal governments for recovery efforts from future disasters by engaging with the whole community and planning for recovery activities that are comprehensive and long term.

Local Governments

This guide is designed to help local governments prepare for recovery from future disasters offering tools for public engagement, whole-community recovery, identification of existing recovery resources, and identifying outside partnerships that can help local governments build resilience.

State Governments

This guide helps states and territories prepare for recovery by developing pre-disaster recovery plans that follow a process to engage members of the whole community, develop recovery capabilities across government and nongovernmental partners and create an organizational framework for comprehensive recovery efforts.

Private Public Partnerships

The Private-Public Partnerships (P3) Guide and supplemental documents provide jurisdictions with best practices to establish and maintain a private-public partnership to help coordinate mitigation, response & recovery planning and preparedness, and increase community resilience. 

Building Private-Public Partnerships

Execu tive Summary

P3 Guide  | View in  Sp ani sh

Restoration and Recovery Guide

Fact Sheets:

P3s Support Equitable Outcomes for Risk Reduction

P3s Support Reducing Risks and Building Resilience

Information Sharing Guide for Private-Public Partnerships

Provides recommendations and resources for any P3 to develop, conduct, and improve the capability to share information for resilience and all response and recovery. The members of a P3 often share information through the human and technical systems of a partnership network, a community resilience hub, or a business emergency operations center (BEOC).

Implementation of Community Lifelines

Lifelines enable the continuous operation of critical government and business functions and is essential to human health and safety or economic security.

Disaster Resource Identification Fact Sheet

This fact sheet provides recommendations and resources for jurisdictions to conduct disaster resource identification, includes recovery resources, guidance for how to search for disaster recovery resources, and recommendations for disaster resource management.