Disaster recovery

Disaster recovery (DR) comprises all technical and organisational provisions used to restore failed IT systems, applications and data sets after a serious incident. Triggers can include hardware failures, cyberattacks such as ransomware, software and configuration errors, power outages or physical disasters like fire and flooding. Disaster recovery is the IT-focused core of the broader business continuity management (BCM): while BCM ensures the continuation of critical business processes as a whole, DR concentrates on bringing the underlying information technology back into operation.

The central control parameters are the Recovery Time Objective (RTO) as the maximum tolerable recovery time and the Recovery Point Objective (RPO) as the maximum acceptable data loss, measured by the interval since the last usable backup. These targets are derived from the business impact analysis and determine the architecture of the DR solution, for example redundant data centres, geo-redundant sites, regular backups, replication or cloud-based failover. A robust disaster recovery plan documents responsibilities, recovery sequences, escalation paths and communication rules and must be validated for effectiveness through recurring tests and exercises.

Legally, disaster recovery has gained considerable importance through the NIS2 Directive and its national transposition. Essential and important entities must demonstrate measures for backup management, recovery and the maintenance of operations as part of their risk management. The BSI IT-Grundschutz also explicitly addresses recovery in its business continuity module, and ISO/IEC 27001 requires, in Annex A 5.29 and A 5.30, information security during disruption as well as ICT readiness for business continuity. Disaster recovery is therefore no longer merely operational precaution but increasingly a regulatory obligation with liability relevance for senior management.