Disaster recovery: what to get right first

The gap between knowing this and actually doing it is where most teams lose ground. If you only fix one thing about disaster recovery this quarter, make it the first item below.

Security is a maintenance habit rather than a purchase, which is why it drifts. Budget a little time for it every quarter and it never becomes a project of its own.

Start here

Ask how long you could be down before it really hurts. In practice this is a scheduling problem more than a technical one. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

Then this

That answer sets your budget. That sounds obvious written down. It is still the thing most often skipped. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

Eventually

Practise the recovery at least once a year. Where this goes wrong is almost never a lack of knowledge. Assume whoever inherits this will have half your context and none of your patience.

In practice

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about disaster recovery before you move on:

• Someone can say what the current setup is without going to look
• That answer sets your budget — and you know whether that is true here
• There is a way to tell whether the last change to this helped

The point is not perfection, it is knowing which of these you have consciously chosen to skip.