Ransomware, a failed storage array, a fire, an earthquake or a simple human mistake: the cause changes, the result is the same — systems down and data at risk. A disaster recovery plan (DRP) is how a company decides, in advance and in calm, how it will get back to work. Here is a practical way to build one in seven steps.
1. Know what matters most (business impact analysis)
List your systems and processes — billing, ERP, email, website, phone system, file servers — and ask for each one: what happens if it stops for an hour, a day, a week? Rank them. Not everything needs the same protection, and trying to protect everything equally is how budgets run out.
2. Set your RTO and RPO
- RTO (recovery time objective): how long a system can be down before the damage becomes unacceptable.
- RPO (recovery point objective): how much data, measured in time, you can afford to lose. An RPO of 24 hours means a daily backup is enough; an RPO of 15 minutes needs replication.
These two numbers drive every technical decision that follows, and they should be agreed with management, not chosen by IT alone.
3. Apply the 3-2-1 backup rule
Keep three copies of your data, on two different types of media, with one copy off-site. Today, add a fourth principle: at least one copy should be immutable or isolated, so ransomware that reaches your network can't encrypt or delete it.
4. Choose a recovery site
Your off-site copy needs a place to run if your main site is lost. Options include:
- Backup storage in a data center: the most economical option for long RTOs.
- Standby servers in the cloud or on dedicated servers, ready to start when needed.
- A replicated environment in colocation for critical systems with short RTO and RPO.
The recovery site should be far enough away not to share the same risks — power, flooding, building access — and close enough to keep latency low. A certified Tier III data center adds redundant power and cooling, so the recovery site itself doesn't become the weak point.
5. Write the runbooks
For each critical system, write step by step how to recover it: who decides to activate the plan, who does what, which passwords and contacts are needed, and in what order systems come back (usually network, then identity, then databases, then applications). Store a copy where you can reach it even if your own systems are down.
6. Test it — really
A plan that has never been tested is a hope, not a plan. Start with a tabletop exercise, then restore a single server, then run a full failover of one system. Every test finds something: an expired password, a missing step, a backup that wasn't running. Better to find it on a Tuesday afternoon than during a real incident.
7. Review and keep it alive
Review the plan at least once a year and every time something important changes: a new system, a new provider, a reorganization. Assign an owner. If the company holds certifications such as ISO 27001, the DRP will be part of the evidence your auditors ask for.
Don't forget the legal side
In Costa Rica, Ley 8968 on the protection of personal data requires appropriate security measures for the personal data you process, and many customer contracts add their own requirements on where data is stored and how fast it must be recovered. Involve your legal advisers when you define where backups and recovery sites live.
Where to start this week
- List your five most critical systems.
- Agree RTO and RPO for each one with management.
- Check that you have an off-site, isolated copy of each — and when it was last restored.
We help companies build recovery sites in our Tier III and Rated-3 data center in San José, with off-site backup storage, cloud servers and colocation on the same network. Tell us your RTO and RPO and we will design the plan with you.
Talk to an engineer
Tell us what you need and we will design it with you, from our Tier III and Rated-3 data center in San José.