Relocation
If the organization’s primary work site is unavailable, an alternate work site shall be used by designated personnel. The organization’s alternate work site is located at [list the address of the alternate work site that the organization will use].
The personnel required to report to the alternate work site during a disaster includes [list the personnel titles responsible for reporting to the alternate work site].
Critical Services, Key Tasks and, Service Level Agreements (SLAs)
The following services and technologies are considered to be critical for business operations, and must immediately be restored (in priority order):
[list the critical services and technologies that must remain running during a disaster]
The following key tasks and SLAs must be considered during a disaster recovery event, in accordance with the organization’s objectives, agreements, and legal, contractual or regulatory obligations:
[list of key tasks / SLAs that must be kept operational, with respective deadlines]
The organization’s Recovery Time Objective (RTO) is [set the maximum amount of time before critical processes must be restored, to include relocation and getting critical services/technologies back online]. Relocation and restoration of critical services and technologies must be completed within this time period.
Notification of Plan Initiation
The following personnel must be notified when this plan is initiated:
[list all personnel (including titles) that must be notified of plan initiation ]
[person responsible for notifications, including title] is responsible for notifying the personnel listed above.
Plan Deactivation
This plan must only be deactivated by [person or persons with authority to deactivate the plan, including job title].
In order for this plan to be deactivated, all relocation activities and critical service / technology tasks as detailed above must be fully completed and/or restored. If the organization is still operating in an impaired scenario, the plan may still be kept active at the discretion of [person or persons with authority to deactivate the plan, including job title].
The following personnel must be notified when this plan is deactivated:
[list all personnel (including titles) that must be notified of plan activation]
The organization must endeavor to restore its normal level of business operations as soon as possible.
A list of relevant points of contact both internal and external to the organization is enclosed in Appendix A.
During a crisis, it is vital for certain recovery tasks to be performed right away. The following actions are pre-authorized in the event of a disaster recovery event:
[job title] must take all steps specified in this disaster recovery plan in order to recover the organization’s information technology infrastructure and services.
[job title] is authorized to make urgent purchases of equipment and services up to [amount].
[job title] is authorized to communicate with clients.
[job title] is authorized to communicate with the public.
[job title] is authorized to communicate with public authorities such as state and local governments and law enforcement.
[job title] is authorized to cooperate with [name of supplier/ outsourcing partner].
[add/modify/remove authorizations in this section as necessary]
Specific recovery steps for information systems infrastructure and services are provided in Appendix B.