What is a disaster recovery plan (DRP)?
A disaster recovery plan is a documented strategy that outllines how your organisation will restore its critical IT systems, recover data and continue operations after a cyber attack or other disruptive event (such as a natural disaster). Your disaster recovery plan is a key part to your overall business continuity plan, focusing specifically on technical recovery.
Almost every system in the workplace is now either online or supported through a data centre, this means that for every business, a technical recvory plan is more important than ever to your overall business continuity plan.
Key elements of a DRP include:
- Risk assessment & business impact analysis
- Recovery Point Objective (RPO) – how much data loss is acceptable
- Recovery Time Objective (RTO) – how quickly systems must be restored
- Backup strategies – secure, offsite and immutable
- Emergency response procedures
- Communication protocols
Why disaster recovery is crucial for cyber security
- Research and expert analysis show that disaster recovery planning is one of the most effective ways to strengthen your cyber security posture to help prevent the worst happening to you and your business
- A well designed DRP minimises downtime, protects your data and ensures rapid recovery after attacks like ransomware or DDoS (distributed denail of service)
- Studies conducted in 2024-25 found that 63% fall victim to a cyber attack due to lack of people or skills, emphasising the need for expert-level disaster recovery and incident response plans
- Post-incident reviews reveal that organisations with strong DR endpoints recover faster and improve their overall security posture
- FEMA reports that 40% of small businesses never reopen after a disaster without a recovery plan
Real-world examples where a DRP was critical
Collins Areospace ransomware attack (September 2025)
In one of the most disruptive cyber incidents in aviation history, Collins Aerospace – a key provider of check-in and boarding software – was hit by a HardBit ransomware attack. The breach ended up crippling the entire MUSE platform, which is used by major European airports including Heathrow, Brussels, Berlin and Dublin.
- Impact: automated systems failed, forcing airports to revert to manual check-ins and handwritten boarding passes. Brussels Airport cancelled 60 flights and cut capacity by 50%. Heathrow experienced delays on 90% of flights.
- Recovery challenges: Collins Aerospace faced multiple reinfections during recovery, indicating that the malware persisted even after initial cleanup. Their systems had to be rebuilt from scratch, and the company struggled to remove the attackers from their network.
- Disaster recovery lessons:
- Manual fallback procedures were essential to maintain operations
- The incident exposed supply chain vulnerabilities, as a third-party vendor’s failure cascaded across the continent
- Highlights the need for segmented backups, vendor risk assessments, and resilience planning in critical infrastructure
CDK Global automotive software breach (June 2024)
CDK Global, a software provider for over 15,000 car dealerships across North America, was attacked by the BlackSuit ransomware group. The breach shut down dealership operations nationwide.
- Impact: dealerships lost access to systems for payroll, financing, inventory and service scheduling. Many reverted to pen-and-paper operations, physically driving documents to DMV offices.
- Recovery process: CDK faced two consecutive attacks, complicating recovery. Restoration took weeks, and dealerships lost an estimated £453 million in the first two weeks alone.
- Disaster recovery lessons:
- The lack of zero-trust architecture and segmented backups made containment difficult
- The attack revealed the risks of over-reliance on third-party vendors
- A phased restoration and manual workarounds were vital to resume operations
UnitedHealth Group / Change Healthcare ransomware attack (February 2024)
A ransomware attack on Change Healthcare, a subsidiary of UnitedHealth Group, disrupted the U.S. healthcare system. The BlackCat (ALPHV) group encrypted systems that processed insurance claims, affecting 190 million Americans.
- Impact: pharmacies couldn’t process prescriptions, hospitals couldn’t bill insurers, and patients were forced to pay out-of-pocket. UnitedHealth paid a £16million ransom, but still had to rebuild its entire IT infrastructure from scratch.
- Recovery process: the company replaced routers, switches and servers, keeping only the cables. Restoration took months, and some systems remained only partially operational even a year later.
- Disaster recovery lessons:
- Backups were not properly segmented, allowing attackers to encrypt them too
- The incident emphasised the need for industry-backed backup plans, multi-factor authentication and network segmention.
- UnitedHealth had to advance £3.5million to healthcare providers to maintain continuity.