Disaster Recovery Planning: Your Business Continuity Checklist

R4.5M+

Average cost of downtime per incident for mid-sized SA businesses

93%

Of businesses without DR close within 1 year of major data loss

99%+

Cove Data Protection automated recovery success rate

Most disaster recovery plans fail for a simple reason: they exist as documents, not as tested procedures. A plan that has never been rehearsed is a hope, not a strategy.

This checklist turns hope into action. Use it as a working template to build, test, and maintain a disaster recovery (DR) plan that protects your business when it matters most.

---

Step 1: Define Your Recovery Objectives

Before selecting tools or writing procedures, establish what your business actually needs.

RPO — Recovery Point Objective is the maximum amount of data you can afford to lose. If your RPO is 4 hours, your backups must run at least every 4 hours. Anything older than that is gone.

RTO — Recovery Time Objective is the maximum time your business can be offline. If your RTO is 2 hours, your recovery process must restore critical systems within that window.

• Define RPO for each critical system (email, ERP, file shares, databases)
• Define RTO for each critical system
• Get sign-off from business leadership — these are business decisions, not IT decisions
• Document acceptable data loss and downtime in writing

Tip: Start with the question "How much would one hour of downtime cost us?" The answer sets your RTO budget.

---

Step 2: Map Your Critical Systems

Not everything needs the same level of protection. Rank your systems by business impact.

Tier 1 — Mission Critical (RTO: under 1 hour)

Systems that stop revenue when they go down.

• Email and communication platforms (Microsoft 365, Teams)
• ERP / accounting systems
• Customer-facing applications and websites
• Core databases

Tier 2 — Business Important (RTO: 4–8 hours)

Systems that cause disruption but not immediate revenue loss.

• File servers and shared drives
• Internal collaboration tools
• HR and payroll systems

Tier 3 — Standard (RTO: 24–48 hours)

Systems that can wait.

• Development and test environments

• Archive and historical data

• Non-critical internal tools

• Complete a full asset inventory of servers, workstations, and cloud services

• Assign each asset to a tier

• Document dependencies — which systems rely on which

---

Step 3: Establish Your Backup Strategy

Your backup strategy must match your recovery objectives. If your RPO is 1 hour but your backups run daily, the plan is already broken.

• Confirm backup frequency meets RPO requirements for each tier
• Use immutable backups — backups that ransomware cannot modify or delete
• Store backups off-site or direct-to-cloud, outside your production network
• Encrypt all backups with AES-256 at rest and in transit
• Maintain a minimum of 30 days of recovery points
• Back up Microsoft 365 data separately (Exchange, SharePoint, OneDrive, Teams)
• Verify bare-metal recovery capability for physical servers
• Confirm virtual machine backup coverage (Hyper-V, VMware, Azure)

Why Cove Data Protection: Cove's direct-to-cloud architecture eliminates local backup appliances. Data goes straight to one of 30 global data centres — including South African storage locations — encrypted with AES-256. Backups are immutable by design. Cove's TrueDelta technology produces incrementals that are 60x smaller than traditional file-level backups, making cloud backup practical even on South African bandwidth.

---

Step 4: Build Your Communication Plan

When disaster strikes, people panic. A written communication plan removes the guesswork.

• Designate a DR coordinator with authority to trigger the plan
• Create a contact list with mobile numbers for all key personnel
• Define who communicates with staff, clients, suppliers, and media
• Prepare template communications for common scenarios (ransomware, power failure, hardware failure)
• Store the communication plan offline — printed copies and in mobile phones
• Include your IT provider's emergency contact details

Key Contacts Template

---

Step 5: Document Recovery Procedures

Step-by-step instructions that any competent IT professional can follow — not just the person who set up the system.

• Write recovery runbooks for each Tier 1 system
• Include login credentials in a secure, offline location (not in the DR document itself)
• Document the recovery order — which systems come up first
• Include network configuration details (IP addresses, DNS, firewall rules)
• Document cloud service recovery procedures separately
• Create a "bare minimum" recovery plan — the fastest path to basic operations

---

Step 6: Test Your Plan

This is where most organisations fail. A plan that has never been tested is not a plan.

• Schedule quarterly DR tests (minimum)
• Run a full failover test annually
• Test individual system restores monthly
• Record recovery times and compare against your RTO targets
• Document what failed during each test and fix it
• Verify backup integrity — can you actually restore from your backups?

Cove automates this. Cove runs automated recovery testing on 14-day and 30-day cycles. Every backup is tested for recoverability and you receive a report confirming success or failure. No manual effort required, and a 99%+ success rate across the platform.

• Review and update the DR plan after every test
• Review and update after any infrastructure change
• Review and update after any personnel change

---

Step 7: Address South African-Specific Risks

Operating in South Africa means planning for risks that other regions do not face.

• Load shedding contingency — UPS and generator runtime calculations
• Bandwidth constraints — ensure backup solutions work on limited connectivity
• POPIA compliance — confirm backup and recovery procedures meet data protection requirements
• Physical security — include theft and vandalism in your risk register
• Confirm your backup provider has South African data residency options

---

Your DR Plan Scorecard

Count your checked items above. Here is where you stand:

---

Build a DR Plan That Works

A disaster recovery plan is only as good as its last test. OAS builds and tests DR plans that actually work — backed by Cove Data Protection's automated recovery testing and the "Recover" pillar of our Protect, Detect, Recover methodology. With 40+ years of enterprise IT experience in South Africa, we have a proven track record of keeping businesses running when disaster strikes.

Build Your DR Plan →