What should a small-business disaster recovery plan contain?

Choose a small set of realistic scenarios: losing a work laptop, a Linux server failing, losing administrator access to a key service, or an unavailable website. Identify which business activity each scenario stops and what would be needed to restart it.

List the order of recovery. An application may depend on a database, network settings, an account and the person authorised to use them. Record those dependencies so the plan is usable by someone who did not design the system.

Decide how much recent work you could tolerate losing and how long the business could function without the service. These are planning targets, not recovery promises. Compare them with the copies, replacement equipment and supplier arrangements you actually have.

The NCSC's incident-preparation guidance recommends planning responsibilities and recovery, including knowing how to restore backups and preparing the people who may need to do it. The plan should identify contacts and a way to reach essential instructions if the usual computer is unavailable.

Walk through one scenario with the people named in the plan. Check whether they can find the relevant contact, locate a backup and understand the first actions. A technical restore test can then verify the parts that need direct evidence.

Record unresolved dependencies and assign an owner. Review the plan after changing systems, suppliers or staff responsibilities. A concise plan with current contacts and tested steps is easier to maintain than a large document nobody uses.