The short answer
Backups answer "do we have a copy?" A recovery plan answers what matters in an outage:
- Priority: what first, and what can wait?
- RTO (recovery time objective): tolerable downtime per system?
- RPO (recovery point objective): tolerable data loss?
- Where: restore to what, if servers, cloud or office are gone?
- Who: roles, and contact if email is down?
- Proof: a real, recent restore?
Why backups alone fall short
The NIST Cybersecurity Framework agrees: recovery is a function of its own, alongside prevention and detection, and recovery plans should be executed and improved after each event (NIST). Common failures in real recoveries:
Never tested
Jobs reported success; files were incomplete or would not restore.
Reachable by attackers
Ransomware hit copies on the same network and admin credentials.
Too slow
Terabytes from the cloud over office internet took far longer, worse on a congested or failing link.
Missing dependencies
Licence server, database version, DNS or identity services nobody documented.
SaaS assumed safe
Microsoft 365, Google Workspace or cloud apps with only provider retention.
No restore order
Staff restored what they could, not what the business needed first.
Set recovery objectives with the business
RTO and RPO are business decisions, not IT settings: ask the people who depend on each system.
| System | What stops if it is down? | Downtime (RTO) and data loss (RPO) agreed with |
|---|---|---|
| Accounting or ERP | Invoicing, payments, payroll | Finance |
| Email and files | Most communication and work | Leadership |
| Line-of-business application | Service delivery | Operations |
Shorter objectives cost more (more frequent backups, standby systems, faster storage, more testing); the plan records the trade-off chosen.
Protect backups from ransomware
The widely used 3-2-1 rule means three copies, on two media types, one off site, and CISA recommends keeping backups offline, disconnected from the network, out of an attacker's reach (CISA). In practice:
Offline or immutable
At least one write-once copy nobody can alter or delete for a set period.
Separate credentials
MFA-protected backup accounts, not the domain admin accounts attackers target.
Encrypt
Encrypt backups and keep the keys reachable during an incident.
Monitor
Alert on failed jobs and unusual deletions.
Preparation and recovery steps: CISA's #StopRansomware guide.
Do not forget cloud and SaaS data
Providers keep services running; recovering your data after accidental deletion, a malicious insider or ransomware in a synced folder is usually your job. For Microsoft 365: Microsoft 365 Backup, pay-as-you-go for SharePoint, OneDrive and Exchange Online (Microsoft Learn), or third-party tools keeping copies outside Microsoft. Check every critical SaaS app's export and restore options.
What a recovery plan contains
- Scope and triggers: what activates the plan, who declares it.
- Contacts: roles, IT providers, key vendors, insurer, legal adviser; reachable offline.
- Priorities: RTO and RPO per system.
- Dependencies: identity, network, DNS, licences, databases, integrations.
- Restore steps a competent person who did not build the system can follow.
- Alternatives: where people work, how they communicate, power if the grid and generator fail, the second internet link, manual workarounds.
- Message templates for staff, clients and, for personal data, breach notifications.
- Test schedule and results.
The NIST structure behind it
NIST's contingency planning guide describes business impact analysis, preventive controls, recovery strategies, plan documentation, testing and training, and maintenance (NIST SP 800-34). The list above is the practical version for a small or mid-sized organisation.
Test, then test again
Only a test proves recovery works. Mix three types:
| Test | What and how often |
|---|---|
| File and item restores | Routine checks, often |
| Full system restores | Important systems to an isolated environment, at least annually, timed against the RTO |
| Tabletop exercises | Leaders walk through a scenario (ransomware on a Monday morning) to test decisions and communication |
Record each test's duration and problems, then update the plan.
A worked example
A hypothetical accounting firm backs up its file server nightly to a device in the same office and assumes it is covered. A review finds three gaps: the backup device shares the server's administrator password, Microsoft 365 mailboxes have no backup, and nobody has timed a full restore. The firm adds an immutable off-site copy with separate credentials, a Microsoft 365 backup and a test restore of its practice management system before the year-end filing rush. The restore takes most of a working day, so the partners agree an RTO that reflects it and budget for a faster option next year.
Recovery readiness worksheet
Objectives
- Critical systems listed in priority order
- RTO and RPO agreed with business owners for each
Backups
- 3-2-1 approach with an offline or immutable copy
- Separate, MFA-protected credentials for the backup system
- SaaS data (Microsoft 365, Google Workspace, other cloud apps) covered
Plan
- Dependencies documented for each critical system
- Step-by-step restore procedures written
- Contacts and plan stored where they are reachable offline
- Communication templates prepared
Testing
- Routine file restores scheduled
- Full restore of critical systems tested and timed
- Tabletop exercise held with leadership
Limitations
Every new system, provider or office changes the plan: review it at least annually and after any significant change. For backup, disaster recovery or restore testing set up or reviewed, see our backup and disaster recovery service.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- #StopRansomware Guide, Cybersecurity and Infrastructure Security Agency (CISA)
- NIST Cybersecurity Framework, National Institute of Standards and Technology
- Contingency Planning Guide for Federal Information Systems (NIST SP 800-34 Rev. 1), National Institute of Standards and Technology
- Overview of Microsoft 365 Backup, Microsoft Learn
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.