Signs it is time to revisit disaster recovery

Most teams know this matters. Fewer have decided who owns it. A few signals that disaster recovery is due some attention.

The cheapest security work is the boring kind done on a schedule. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

The signals

• Nobody can say when it was last reviewed
• The answer depends on who you ask
• Ask how long you could be down before it really hurts
• That answer sets your budget

The practical version

Practise the recovery at least once a year. It is worth being explicit about, because assumptions differ quietly. Write the reasoning down alongside the decision, because the reasoning is what changes first.

The short version

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about disaster recovery before you move on:

• Someone can say what the current setup is without going to look
• Practise the recovery at least once a year — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Pick the one that would hurt most if it failed, and start there.