Infrastructure · Disaster Recovery
Disaster Recovery
The planned capability to restore technology services at an acceptable level after a major disruption, within agreed time and data-loss limits.
IntermediateUpdated 2026-09-01
Overview
Disaster recovery is the technology component of business continuity. Business impact analysis establishes which services matter and how quickly they must return; DR design then delivers that within cost constraints.
A plan that has never been executed is an assumption. Mature programmes test at increasing fidelity: component restore, application failover, and full site or tenant level exercises with real people following the documented runbook.
How it works
- 01Recovery strategies range from backup and restore (cheapest, slowest) through pilot light and warm standby to active active (fastest, most expensive).
- 02Dependency order matters: identity, DNS, certificate services and network must return before applications can.
- 03Failover requires a decision authority and criteria, because failing over unnecessarily can cause more disruption than the original fault.
- 04Failback is a distinct plan and is frequently forgotten until it is needed.
Layer model
Define
Business impact analysisService tiersRPO and RTO per serviceDependency mappingRecovery order
Build
Replication or backup based recoverySecondary site or regionNetwork and DNS failoverIdentity availabilityDocumented runbooks
Prove
Component restore testsApplication failover testsFull exercisePost exercise remediationAnnual plan review
Design considerations
- Do not place the DR environment in the same failure domain, same region, same identity tenant, same credentials, as production.
- Include SaaS and cloud services in the plan; loss of a tenant or a region is a realistic scenario.
- Document manual workarounds for the first hours, because technology recovery is rarely instant.
- Keep the plan accessible offline with printed contact details.
Security considerations
- Treat a ransomware scenario as the design case: assume production identity and backups are targeted.
- Define a clean room recovery approach with isolated networks and rebuilt identity where necessary.
- Protect DR documentation, because it is an excellent map of critical systems for an attacker.
Common misconfigurations
- RTO commitments made in a policy document with no technical basis.
- DR infrastructure dependent on production identity, DNS or virtualization management.
- Runbooks referencing staff who left and systems that were decommissioned.