Recovery Decisions: What Comes Back First?

What is disaster recovery?

Restoring the technology, data, systems, and infrastructure needed to return to normal operations.

What is the difference between business continuity and disaster recovery?

Business continuity keeps essential operations running during disruption; disaster recovery restores normal technology and services.

What are the five stages of a disciplined recovery sequence?

Stabilize → Prioritize → Restore → Validate → Resume.

What happens during the stabilization stage?

Confirm that the environment is safe enough to begin recovery.

What determines which systems should be restored first?

Mission impact, time sensitivity, dependencies, security risk, and recovery feasibility.

What five factors guide recovery priorities?

Safety, mission, dependency, impact, and feasibility.

Why should foundational services sometimes be restored before critical applications?

Critical applications may depend on foundational services to function.

What is Recovery Time Objective (RTO)?

The target maximum time allowed to restore a system, service, or business capability after disruption.

What is Recovery Point Objective (RPO)?

The target maximum acceptable data loss, measured backward in time from the disruption.

What is the difference between RTO and RPO?

RTO measures acceptable downtime; RPO measures acceptable recent data loss.

A system must be restored within two hours. Which objective is this?

RTO (Recovery Time Objective).

An organization can lose no more than 30 minutes of recent data. Which objective is this?

RPO (Recovery Point Objective).

Do RTO and RPO guarantee actual recovery performance?

No. They are targets that recovery capabilities must be designed and tested to meet.

How do shorter RTO and RPO targets generally affect recovery costs?

They usually require more preparation, capability, and expense.

Why should different services have different recovery objectives?

Their mission importance, time sensitivity, and tolerance for data loss differ.

What five dependency categories can affect recovery?

Identity, network, data, vendors, and people.

What is an illustrative recovery sequence for foundational services?

Core network → Identity/access → Shared data/databases → Critical applications → Lower-priority services.

Why might identity services need restoration before a student records system?

Users may be unable to authenticate or access the student records application without identity services.

Why are backups alone insufficient for disaster recovery?

Backups must be available, trusted, restorable, and capable of supporting a functioning service.

What four conditions make a backup useful for recovery?

Backup exists → Backup is trusted → Restoration works → Service returns successfully.

What three principles guide a resilient backup strategy?

Separation, frequency, and testing.

Why should backup copies be separated?

To prevent one failure, ransomware attack, compromised account, or physical event from destroying every copy.

How should backup frequency relate to RPO?

Backups should be frequent enough to support the organization's acceptable data-loss target.

What must be validated before users return to a restored service?

Security, data integrity, functionality, dependencies, and monitoring.

What does security validation check?

That the cause of compromise is addressed and credentials, access, and configurations are trustworthy.

What does integrity validation check?

That restored data is complete, consistent, and from a trusted recovery point.

What does functional validation check?

That the restored service can perform its required business processes.

Why is a restored server being online not enough?

It may still contain compromised configurations, corrupted data, broken dependencies, or other unresolved problems.

What is redundancy?

Using duplicate or alternate components to reduce the impact of a single failure.

What are three examples of alternate recovery capabilities?

Redundant components, manual/reduced-capability workflows, and alternate locations or services.

What is a cold recovery site?

A lower-cost alternate capability requiring significant setup before operations resume.

What is a warm recovery site?

A partially prepared alternate capability requiring some restoration or configuration before use.

What is a hot recovery site?

A highly prepared alternate capability maintained close to operational readiness for faster recovery.

How do cold, warm, and hot recovery options compare?

Cold: lower cost/slower; warm: moderate cost/speed; hot: higher cost/faster.

Does using a cloud provider eliminate recovery responsibility?

No. The organization must still understand recovery responsibilities, dependencies, objectives, and evidence of trustworthy restoration.

What is a tabletop recovery exercise?

Walking through a recovery scenario and decisions without changing production systems.

What is a restore test?

Recovering selected data or systems from backups to verify functionality and recovery timing.

What is a failover or alternate recovery test?

Exercising an alternate environment or location to verify it can support operations.

An aviation maintenance backup is missing overnight records. What must happen before normal operations resume?

Restore the trusted backup, reconcile missing maintenance actions, and validate records, access, functionality, and dependencies.

Who is responsible for recovery decisions and communication?

Technical teams restore and validate systems; organizational leaders set priorities, accept risk, authorize resumption, and coordinate communication.