Disaster Recovery Plan
The technical recovery plan Your Organization follows to restore information systems and data after a disruption — recovery strategies by system tier, RTO/RPO commitments against the recovery register, runbook structure, and testing cadence.
Maps to FedRAMP Moderate CP-4 · FedRAMP Moderate CP-10 · ISO/IEC 27001:2022 A.5.30 · SOC 2 Type II A1.2 · NIST Cybersecurity Framework 2.0 RC.RP-01 · NIST Cybersecurity Framework 2.0 RC.RP-02
Read it now — the PDF opens either way.
Purpose
This plan defines how Your Organization restores information systems and data after a disruption. It is the technical counterpart to the Business Continuity Plan: where that plan covers people, process, and communications, this plan covers systems, infrastructure, and data. Recovery strategies are organized by the criticality tier each system is assigned in the recovery register (the same tiering the Business Continuity and Disaster Recovery Policy defines) rather than restated here, so a tier's RTO/RPO commitment is defined in exactly one place.
Scope
This plan applies to every information system in the recovery register, and to the engineering, platform, and vendor personnel responsible for restoring them. It does not cover the business-process-level continuity actions (alternate operations, communications) that the Business Continuity Plan owns.
6 more sections in the full template
Recovery strategies by tier · RTO/RPO commitments · Runbook structure · Testing cadence · Coordination with the Business Continuity Plan · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Disaster Recovery Plan template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.