nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Disaster Recovery Plan

odysseyelite

Its been a long time since I first visted this site. Life got in the way of getting my certifications but I'm back on track.

I have been given the task at work to create a Disaster Recovery Plan and I feel somewhat overwhelmed. Does anyone have any advice on where to start in creating a DRP?

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

hypnotoad

That depends on your project scope and who you have to report this plan to. Break it down in to sections. For example, in regards to backups as part of DR:

what events are we looking at?
who does the backups?
how do we secure the backups?
how do we implement physical/host/infrastructure security?
how often?
what do they backup?
where do the backups go?
who can do a restore?
do we have hardware/license keys for software/redundant servers available?
what is plan B?

Then, do a CYA:
1. Practice restore every X weeks.
2. Make management approve of your plan -- get it signed off.
3. Involve management so it doesn't come back on you.

brad-

nl wrote:

where do the backups go?

Whatever you do, you wanna make sure you have a backup in a different physical location in case of a flood or fire or other act of craziness.

Sie

brad- wrote:

nl wrote:

where do the backups go?

Whatever you do, you wanna make sure you have a backup in a different physical location in case of a flood or fire or other act of craziness.

Like a group of snakes riding unicycles playing banjos? Man i dream some weird stuff.

On topic I had a quick look and this site seems to be a good resource:

http://www.businesslink.gov.uk/bdotg/action/layer?topicId=1076146961

Always factor into your backup schedule a testing of backups, nothing worse than backing up data for months to find when something needs to be restored the tapes are blank.

sprkymrk

Check out these papers from SANS Reading Room on Disaster Recovery:

http://www.sans.org/reading_room/whitepapers/recovery/?portal=cbc6eb3fce00a76f7fa211e8cf151467

ajs1976

two things to do first.

As a CYA move, make sure you have good reliable backups that are being stored off site, and that one copy of the backup media is offsite at all times. Also, have a device available that can read and restore from the media offsite.

At the same time you are working on that talk to the people who are requesting the DRP. Find out what they are looking for. DRPs and be anything from having tapes offsite, to having a dedicated hot site with extra PC, printers, phones, faxes, etc. Plan for different scenerios. ex. Primary location is gone (think 9/11), X server dies, X application corrupts at a critical time. How much down time is acceptible. Don't forget to include non-IT things like phones, faxes, desks.

My current project is implementing a hot site with a replica of the clients data center.

sallyxi

Wow, a tricky task as for me,well,good luck for you.

Vogon Poet

You should feel overwhelmed. Developing a DRP really needs to be a team effort. See if you can recruit others for their input. I would recommend the following resource:

http://www.drj.com/new2dr/samples.htm

Good luck.

odysseyelite

Yeah, its not a fun task.

We are a small software company so we do not have the ability to have a second site. I'm having enough hard time to get them to use someone to pickup our backup tapes daily. Right now, they go home with me.

I would love to find a sample that showed me a formal layout of a DRP. I have a lot of info saying why you have a plan but not section by section to go by.

odysseyelite

Our main concern is being ready for Hurricane Season since it begins on June 1st.

Trailerisf

www.doubletake.com

We implemented their product to replicate the servers to a COLO in another geographical area...
Not cheap, but well worth the money.

paintb4707

I use image-based backups (Acronis True Image) for my company.

I think what you need to consider is, if you were to have a complete disaster what would be your RTO (recovery time objective)?

With a standard file level backup, you have to reinstall the operating system, reinstall all software, drivers, then finally load your backups. This process can take several hours the least.

With image-based backups, you have the image ready on an external drive, burn it onto the machine, and you could be back up in running in about 30 minutes (give or take depending how large the image is) with no additional configuration. The only disadvantage really is that images take up a lot of space and that they are intended for a full recovery. You also may need to have a file-level backup of databases and such.

Additionally, if you had a hardware failure and you were knees deep in water waiting for that part to come in, you could burn the image on ANY workstation handy. You could make a temporary Exchange sever, DC, SQL, or what have you on any machine until you are able to repair the original box.

Also trash the tapes. They require too much administrative intervention. The less you have to do is a better job that that you're doing. Use disk-to-disk backups to another box and have the back-ups replicated to an external drive.

Also consider online backups for off-site storage. I just recently found a cheap service ($200/mo for 100gb). When you're manually taking tapes home, they can always get lost, damaged, or stolen. It would be a worthy investment to just pay for online backups and not have to worry about it. Secondly, when you have a disaster, you can request that they overnight an encrypted external drive with your backups on it so that you can make a quick recovery.

That's all I got for now. I'll probably come back in later and add a few more.