01
1. Define recovery objectives
Business impact determines recovery priority.
- Inventory critical services and data
- RTO: target time to restore service
- RPO: tolerable data loss
02
2. Document the path back
A backup alone is not a complete recovery plan.
- Dependencies across identity, network, applications and data
- Recovery sequence and step owners
- Access, keys, contacts and replacement infrastructure
03
3. Test and measure
The plan must survive an exercise.
- Safe restore test
- Measure actual time against RTO
- Update the procedure from observed gaps