Disaster Recovery Planning
Protecting the Business When the Unexpected Happens
When IT fails — whether through human error, hardware failure, or a cyberattack — the speed and completeness of your recovery determines the impact on the business. A robust disaster recovery plan is what separates a managed incident from a business-threatening event. If you are responsible for IT, it is also what separates a controlled response from a very difficult conversation with leadership.
The Challenges You’re Facing
Why disaster recovery is harder to get right than it should be
Most businesses acknowledge that disaster recovery matters. The challenge is that it rarely feels urgent until something goes wrong — by which point the gaps in the plan become very expensive, very quickly.
If you are managing IT, you are likely aware of one or more of the following. These are also the points that are worth putting in front of decision makers, because each one carries a measurable business risk:
You're not certain what is backed up, or where those backups are
Knowing that a backup process exists is not the same as knowing what data is covered, where it is stored, how it is accessed, and who can retrieve it under pressure. That distinction matters when the clock is running.
Your plan does not reflect the current state of the business
Staff changes, new systems, new software, and new processes all affect how a recovery would work in practice. If the plan hasn’t kept pace, it may not cover the environment it’s meant to protect.
Your disaster recovery plan has not been tested recently
A plan that hasn’t been tested is a plan with unknown gaps. A tested plan gives you confidence in your recovery time. An untested one gives you uncertainty at the worst possible moment.
Recovery time and recovery point objectives have not been defined.
Recovery Time Objective (RTO) — how quickly the business can be operational again — and Recovery Point Objective (RPO) — how much data can be affordably lost — are two of the most important metrics in disaster recovery planning. If these haven’t been agreed with the business, recovery decisions will be made under pressure without a clear mandate.
The financial impact of downtime is not quantified.
Every hour of downtime carries a cost — in lost output, missed deadlines, damaged customer relationships, and staff time spent on recovery rather than productive work. Without a clear figure, it is difficult to justify investment in prevention. With one, the case tends to make itself.
Roles and responsibilities are not clearly assigned
When an incident occurs, confusion about who owns which part of the response adds time and cost to recovery. A plan that assigns clear roles — decision maker, recovery coordinator, communications lead, key IT personnel — allows the response to begin immediately and proceed without ambiguity.
Top 5 Data Backup Tips
Having an effective, reviewed and practiced disaster recovery plan cannot be underestimated in today’s modern age. We understand creating such a plan can be a challenge to any growing business. So we created an article on how to get started with some tips on how to protect your business from data loss.
“If you’re like me, your business is your biggest investment, in both time and money. You may have spent years of your life building a great company, employing people and serving your customers. That investment is now under threat, so like any investment where the risk becomes higher than the reward, you should de-risk. With your business, your greatest threat is now a cyber security breach, your loss of income, good-will and ultimately value in your business is significant. It’s in fact so bad that a third of all business your size, who suffer a cyber-attack close within 12 months.
I believe the best way to mitigate this risk is to have a joined-up service, one that addresses not only the potential threats but also does something about them.”
Simon Pardo, CEO
Mind The Coverage Gap - How Covered Are You?
Ignorance is not bliss
Why Disaster Recovery Can’t Be Ignored
Disaster recovery is your insurance, it’s your last ditch attempt to get your business back, it’s what you need with nothing else works. But it also needs to be more than that in todays always-on world. Your disaster recovery plan is your businesses way to continue working should the worst happen. If you don’t have a fit for purpose plan, chances are you will need to be paying staff to make tea and twiddle their thumbs.
There are disaster recovery plans and there are companies that take their disaster recovery seriously. You need to be living and breathing your plan, running your business on it to make sure you can operate if the worst happens.
Why? Because the threat of fire and flood are nothing compared to the threat of a ransomware attack. If you do get attacked, this is your way out of a potentially business closing event.
The Bottom Line for Your Business
While 97% of organizations eventually recover their data after a ransomware attack, the method and speed vary dramatically. Businesses with intact, tested backups recover nearly twice as fast as those with compromised backups. Even more concerning, 80% of businesses that paid the ransom were targeted again — making robust disaster recovery planning not just important for recovery, but essential for long-term business protection.
Disaster Recovery Planning
Why Having A Robust Disaster Recovery Plan Is Important
Watch our CEO and Founder Simon Pardo discuss the key reasons why having a robust, practiced disaster recovery plan is so important for minimal disruption to both employees – but also for your clients.
Disaster Recovery Planning
Is Your Plan Good Enough? Find Out Now
Our extensive experience in managing business risk has helped us shape our offering to work for businesses like yours. We include all the things you need to make sure your business is secure and safe. We’ve followed standards to ensure our solution is complaint with the best – even better than Cyber Essentials Plus or ISO27001 for security.
We’ve built a quiz that will help you assess your coverage. Just answer yes / no , to the 14 will help you ascertain if you are well covered or not. If you don’t know the answer just assume no for now – you can always retest.
The assessment checklist you can use is right here, it will help you to ascertain where you need to invest and how:
This tool is completely free and will give you some feedback and suggestions on how to begin addressing your cybersecurity gaps.
What Robust Disaster Recovery Looks Like
The difference between a plan that exists and a plan that works
The businesses that recover quickly from a serious incident — and the ones that avoid paying ransoms or losing data — share a few things in common. They have a plan that is current, tested, and understood by the people responsible for executing it. They know their recovery time. They have practiced running the business on their recovery platform. And they have ensured their backups cannot be reached and destroyed by the same attack that compromised their primary systems.
The data reflects why this matters: businesses with intact, tested backups recover from ransomware attacks nearly twice as fast as those whose backups have been compromised. And of those that pay a ransom to recover, 80% are targeted again — because paying demonstrates both willingness and vulnerability.
Disaster recovery is not a one-time exercise. It is an ongoing discipline — and one that, when presented to leadership with clear metrics and a defined plan, is straightforward to justify against the alternative.
Common Misconceptions — And Why They Matter
How to address the assumptions that create real risk
One of the most useful things you can do when making the case for investment in disaster recovery is to address the assumptions decision makers may already hold. These are the ones that come up most often:
“We back up our data, so we’re covered.”
A backup is a store of data. Disaster recovery is a process. Having one does not mean you have the other. The backup is only as useful as the plan that governs how it is accessed, restored, and verified — and that plan needs to be documented, tested, and kept current.
“Disaster Recovery is only for large organisations.”
The scale of the plan should be proportionate to the business — but no business that relies on technology to operate is exempt from needing one. The question is not whether a plan is necessary, but whether the cost of building one is greater than the cost of not having it when it’s needed.
“Everything’s in the cloud, so we're protected.”
Cloud providers protect the availability of their platforms. They do not take responsibility for recovering your data in the event of a ransomware attack, accidental deletion, or user error. That responsibility sits with the business, and it needs to be planned for accordingly
“Our insurance will cover us.”
Cyber or business interruption insurance can cover some cots but often there are exclusions on policies if you haven’t got the environment set up properly or you haven’t taken the right precautions to minimise the chance of an attack.
“How long does it take to recover from ransomware?"
This is a key question and if you are reading this looking for an answer then your disaster recovery plan is either inadequate or untested.
To understand this metric, you need to have performed a full test – that involves running your business on your disaster recovery platform for at least a day.
"We have a plan, our data is safe"
Having a plan on file is a starting point, not an endpoint. Cyber criminals routinely target backups first — specifically because destroying them forces businesses to pay ransoms. A plan that doesn’t include air-gapped or isolated backups may offer less protection than it appears to.
How we help
How Our Customers Benefit From Our Expertise
What it is
Our disaster recovery planning service is a consultative approach to ensuring your business can weather the storm of an unplanned event.
How it works
We take a big-picture view of technology and your businesses attitude to risk.
We then start to examine how your business would operate should your IT function no longer exist.
We’ll uncover assumptions that need addressing, we’ll lift the lid on all those little processes that go to keep you working and orders flowing.
Then we’ll build out a full plan to ensure that everything is covered.
Why it matters
If you don’t lie awake at night worrying about what will happen to your business when you get attacked, they you are either:
1. Sure your disaster recovery plan works, have tested it recently and have it clearly identified and marked off your your risk register.
– OR –
2. Burying your head in the sand.
A consultative approach to building a plan that works for your business
We work with you to build a disaster recovery plan that reflects how your business actually operates — not a generic template filed away as a compliance exercise.
That means we start by understanding your business: how it runs, where it is most exposed, which systems and processes are critical, and what the realistic cost of downtime looks like for you. From there, we develop a plan that covers the full recovery process, assigns clear roles, defines your RTO and RPO, and — critically — is tested so that you know it works before you need it.
We also make sure your backups are protected from the same threats your primary systems face, including air-gapped storage that cannot be reached in the event of a ransomware attack.
The result is a plan you can present to leadership with confidence: a documented, tested, and maintained approach to business continuity that reduces risk and supports informed investment decisions.
What you get from working with us:
Clarity on your actual risk exposure
Not assumptions, but a clear picture of where gaps exist and what they could cost the business.
A tested recovery plan
Documented, role-assigned, and verified to work under real conditions.
Protected backups
Including air-gapped copies that remain accessible even if your primary environment is compromised.
Defined recovery metrics
Agreed RTO and RPO that give the business a clear mandate for recovery decisions.
Ongoing plan maintenance
Reviewed and updated as the business changes, so it never becomes outdated.
Fewer unpleasant conversations
Because when an incident occurs, you have a plan, a process, and a team that knows what to do.
Our case Studies
Take the opportunity to get a free 45 minute consultation with one of our industry leading experts.
