A Disaster Recovery Plan (DRP) is the operational document that precisely describes how systems are restored after a total failure. It must define trigger criteria (when the DR plan is activated), clarify roles and responsibilities, establish a restoration sequence (critical systems first: Active Directory, DNS, then ERP, email, file servers), contain step-by-step instructions per system and include a communication plan for internal and external stakeholders.

In the ransomware context, the most critical aspect is: the DRP must be available offline. If the entire IT infrastructure is compromised, a digitally stored DRP may be inaccessible. Printed copies in a safe are not an old-fashioned precaution — they are a practical necessity.

The recovery sequence in a ransomware scenario typically follows this logic: hours 0 – 4, damage containment (isolate infected systems, map extent, activate incident response); hours 4 – 8, backup verification (verify air gap backup, identify last clean recovery point); hours 8 – 24, restore critical systems (Active Directory, DNS, critical applications); days 2 – 7, full restoration of all systems.

Frequently asked questions

At minimum, a full recovery test of all critical systems with timing against defined RTO targets annually. Quarterly, recovery tests for the most critical systems (Active Directory, primary ERP) should be performed. BSI CON.3.A11 recommends regular tests; DORA Art. 11 requires their documentation.
Business Continuity (BCM) is the overarching organizational framework ensuring that critical business processes are maintained — including through manual workarounds during recovery. Disaster Recovery is the technical subset: restoring IT systems after a failure. A complete BCM program encompasses both aspects.