Disaster Recovery Plan (DRP)
Definition
A plan focused on restoring IT systems and data after a major failure or destructive event. Often a subset of BCP. The IR plan's recovery phase should specify when a DRP is invoked and who authorises the invocation.
- Focus
- Restoring IT systems and data
- Relationship
- Often a subset of the BCP
- Trigger point
- Specified in the IR plan's recovery phase
- Field
- Incident response policy
Common questions
How does a DRP differ from the incident response plan itself?+
The IR plan covers detecting, containing, and eradicating an incident; the DRP takes over once that work is done, focusing specifically on rebuilding systems and restoring data from backups so operations can resume.
Who typically authorises invoking the DRP during an incident?+
The IR plan should name a specific role, often IT leadership or an incident commander, with authority to declare that recovery has begun, since invoking the DRP prematurely can overwrite evidence still needed for the investigation.
Related terms
- Business Continuity Plan (BCP)
- A document that specifies how an organisation keeps critical business functions operating during a significant disruption. The IR plan and BCP must...
- Communication Matrix
- A structured table in an IR plan that maps incident severity tiers to mandatory notification recipients, timelines, and communication channels. It removes...
- IR Plan
- The operational document that translates the policy into specific procedures, roles, severity tiers, communication chains, and recovery criteria. Versioned and reviewed at...
- IR Policy
- A management-approved governance statement that commits the organisation to an incident response programme, defines its scope, and grants authority to designated teams....
- Scope Statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...