week 8

K1.8 How a disaster recovery plan (DRP) works:

A Disaster Recovery Plan (DRP) is a documented process that outlines how an organisation will recover its IT services and data following a disruption such as a cyber attack, fire, flood, hardware failure or power outage.

The goal of a DRP is to:

• Recover services

• Maintain business continuity

• Protect digital security

• Minimise downtime and data loss

---

How a Disaster Recovery Plan Works

A DRP is built step-by-step to ensure it’s thorough, effective, and ready to be used when needed. Below is the full process:

Define the Scope of the Plan

Before writing a DRP, the organisation must define what areas the plan will cover.

This step ensures nothing important is missed in the recovery plan.

Gather Relevant Information

To create a useful DRP, the organisation needs to collect essential data about its systems and past issues.

Having the right people and tools listed makes the response much faster and more accurate.

Risk Assessment

A DRP must be based on a proper risk assessment to understand what needs to be protected and how.

This step helps prioritise what should be restored first in the event of a disaster.

Creating the DRP

With the scope, information, and risks identified, the actual plan is developed.

Key Elements to Include:

• Objectives: Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)

• Roles & Responsibilities: Who does what during recovery

• Resources Required:

  • Systems (e.g. backup servers, cloud platforms)

  • Equipment (e.g. replacement PCs, mobile devices, routers)

The plan should be written clearly so anyone on the IT team can follow it in an emergency.

Plan Approval

Once the plan is created, it must be formally approved.

Approval ensures that the plan is trusted, understood, and adopted by the wider organisation.

Testing the DRP

The plan must be tested regularly to ensure it works in practice.

Testing Steps:

1. Identify the scope of the test – will it simulate a total server failure or just user access loss?

2. Identify the resources needed – people, hardware, test environment.

3. Determine testing frequency – e.g. every 6 months, annually.

4. Implement the test – simulate an incident and follow the DRP steps.

5. Review and document the outcome – identify what went well and what didn’t.

6. Amend the plan – update procedures based on test results.

Testing ensures the plan remains current and effective as systems, staff, and threats change.

Continuous Improvement

After testing, the plan should continue to evolve through ongoing reviews.

Continuous improvement ensures the plan is always ready when needed – not just written and forgotten.

"Part 2 - Those that fail to plan, plan to fail"

Scenario:
Your College/school’s network has gone down due to a power failure. You’ve been asked to help create a DRP.

Your Task:
1. Define the scope of the DRP (e.g. whole school? just IT services?)
2. Identify key assets and risks (e.g. school server, student logins)
3. List resources needed for recovery (e.g. backup server, laptops)
4. Create a step-by-step plan for restoring systems
5.Explain how you would test the plan and improve it over time

Extension: Create a checklist or flowchart based on the seven stages above.

Class discussion: Tutor led discussion exploring types of impacts that can occur within an organisation as a result of threats and vulnerabilities, including: 
Danger to life. 
Privacy. 
Property and resources. 
Economic. 
Reputation. 
Legal. 

Last Updated
2025-07-11 14:58:44