Disaster Recovery and Crisis Management

The continuity planning cycle covers prevention, preparedness, response, and recovery for organizational resilience.

Meta Summary: This playbook defines disaster recovery and crisis management, outlines the seven-phase contingency process from NIST SP 800-34, and provides RTO/RPO metrics, site types, team structures, and case studies to restore operations after any disruption.

Table of Contents

• Chapter 1: Foundations of Disaster Recovery and Crisis Management
• Chapter 2: Risk Assessment and Business Impact Analysis
• Chapter 3: Building the Plan: RTO, RPO, and Recovery Strategies
• Chapter 4: Incident Response, Command, and Communication
• Chapter 5: Testing, Maintenance, and Lessons from Real Crises
• FAQ
• References
• Related Topics

Chapter 1: Foundations of Disaster Recovery and Crisis Management

1.1 Key Definitions

A disaster is any event, whether human-caused, act of nature, or technology failure, that causes disruption to operations beyond acceptable time limits, thereby threatening the survival of critical services.

A Disaster Recovery Plan is a written plan for recovering one or more information systems at an alternate facility in response to a major hardware or software failure or destruction of facilities. It is designed to restore and resume normal IT operations after a disaster within an acceptable timeframe as determined by the agency.

Business continuity is the processes and plans designed to ensure the business can continue to function in the face of any type of interruption. Disaster recovery is a subset of business continuity focused on restoring IT systems and data.

Crisis management refers to the immediate actions taken to respond to a disaster. Response includes actions to ensure that crisis impacts and consequences are minimized, and that those affected are supported as quickly as possible.

1.2 NIST 800-34 Seven-Step Contingency Process

• Step 1: Develop the contingency planning policy statement. Formal policy provides authority and guidance to develop an effective plan.
• Step 2: Conduct the business impact analysis. Identify critical systems and components, maximum allowable downtime, and resource requirements.
• Step 3: Identify preventive controls. Measures that reduce the effects of system disruptions, increase availability, and reduce contingency costs.
• Step 4: Develop recovery strategies. Methods to restore IT operations quickly after disruption, including alternate sites and equipment.
• Step 5: Develop an IT contingency plan. Contains detailed guidance and procedures for restoring a damaged system.
• Step 6: Plan testing, training, and exercises. Tests identify gaps; training prepares personnel to execute the plan.
• Step 7: Plan maintenance. The plan should be a living document updated regularly to remain current with system enhancements.

1.3 Phases of Crisis Management

Australian Government Crisis Management Continuum

Preparedness................................Ensure resources and capabilities can be mobilised

Response....................................Immediate actions to minimise impacts

Relief......................................Meet essential needs: food, water, shelter

Recovery....................................Restore livelihoods and systems

Chapter 2: Risk Assessment and Business Impact Analysis

⬅ Back to Table of Contents

2.1 Identifying Threats and Hazards

Disaster management involves activities required to prepare for, mitigate, respond to, and repair the effects of all disasters whether natural or man-made.

Common threat categories include natural disasters, cyberattacks, power outages, hardware failure, human error, and supply chain disruption. In 2025, cybercrime damages are projected to reach 10.5 trillion dollars annually.

Disaster monitoring and prediction involves actions to predict when and where a disaster may take place and communicate that information to affected parties.

2.2 Business Impact Analysis

The business impact analysis identifies critical systems and components, maximum allowable downtime, and resource requirements. It prioritizes system components, supported mission processes, and interdependencies.

BIA outputs determine recovery point objective and recovery time objective for each system. The analysis considers financial, operational, legal, and reputational impacts of downtime.

For each mission essential function, identify dependencies: personnel, facilities, records, equipment, and IT. The goal is to understand what must be recovered first.

2.3 Preventive Controls

Preventive controls are measures that reduce the effects of system disruptions, increase availability, and reduce contingency costs.

Examples include uninterruptible power supplies, fire suppression, data backups, offsite storage, environmental monitoring, and staff cross-training.

Disaster preparedness and planning involves developing response programs and pre-disaster mitigation efforts to minimize loss of life and property.

Chapter 3: Building the Plan: RTO, RPO, and Recovery Strategies

3.1 Recovery Time Objective and Recovery Point Objective

A recovery time objective specifies the amount of time from the occurrence of a disruptive event to when the affected resource must be fully operational and ready to support the organization's objectives. It answers how long you can afford to be offline.

A recovery point objective designates the maximum amount of data that can be lost during an outage. It is measured backward from the moment of failure and defines how much data you can afford to lose. If RPO is one hour, backups must occur at least hourly.

RTO focuses on maximum acceptable downtime for a system or business process. RPO focuses on maximum acceptable data loss. Both metrics are expressed in seconds, minutes, hours, or days.

An inverse relationship exists between RTO and cost. The shorter an RTO, the more recovery costs increase. RTO drives system architecture and recovery strategy. RPO drives backup frequency.

3.2 Recovery Site Types

Disaster Recovery Site Options

Hot site....................................Fully functional, takes over without interruption

Warm site...................................Semifunctional, requires manual config

Cold site...................................Minimal infrastructure, most effort to use

Cost vs Speed...............................Hot highest cost, fastest; Cold lowest, slowest

A hot site is a fully functional location capable of taking over all operations without interruption. A warm site requires some manual configuration, staff, and equipment before taking over. A cold site contains only minimal infrastructure and requires additional equipment and configuration.

3.3 Failover, Failback, and Data Protection

Failover is shifting business processes to an alternate site or services to an alternate platform. If a primary database fails, services fail over to the secondary server.

Failback is shifting processes back to the primary site after resolving a failure. Once the primary server is fixed, the service fails back to it.

Best practices to optimize RTO and RPO include frequent backups, redundancy, testing, automation, and offsite or immutable storage. For near-zero data loss, continuous data protection enables real-time replication.

Disaster recovery plans should specify backup strategies, failover procedures, restoration protocols, and recovery teams.

Chapter 4: Incident Response, Command, and Communication

⬅ Back to Table of Contents

4.1 Incident Command System

The Incident Command System is a component of the National Incident Management System. It is the combination of facilities, equipment, personnel, procedures and communications operating within a common organizational structure, designed to aid in domestic incident management activities.

ICS is used for a broad spectrum of emergencies, from small to complex incidents, both natural and manmade, including acts of catastrophic terrorism. It is used by all levels of government and many private-sector organizations.

Logan City Council integrated its Crisis Management Team with the Local Disaster Coordination Centre and Australasian Inter-Service Incident Management System to enhance coordination and clarity.

4.2 Crisis Communication Best Practices

Effective crisis management requires open and honest communication with employees during a crisis. Leaders should keep employees and stakeholders informed rather than hiding problems.

Companies that manage crises well show concern for customers, take responsibility for issues, and respond decisively with improvements.

Poor communication worsens crises. Delayed or misleading statements damage trust and extend recovery time.

Best practice: lead with empathy and ensure actions align with words in the months post-crisis.

4.3 Roles and Responsibilities

Local government has the primary role of planning and managing all aspects of the community’s recovery. Individuals, families and businesses look to local governments to articulate their recovery needs.

Successful recovery depends on all recovery stakeholders having a clear understanding of pre- and post-disaster roles and responsibilities. Coordination, integration, community engagement and management are prominent system elements.

Recovery managers and coordinators should be designated at local, state, tribal and territorial levels. A Federal Disaster Recovery Coordinator position provides national-level coordination.

Plans should include Continuity of Government and Continuity of Operations plans.

Chapter 5: Testing, Maintenance, and Lessons from Real Crises

5.1 Testing and Exercises

Plan testing, training, and exercises identify gaps. Training prepares personnel to execute the plan.

Dynamic planning is essential. Activation triggers and scenario-based exercises are more effective than static plans. Prior to COVID-19, Logan City Council relied on a 98-page Master Business Continuity Plan that was not utilized during the pandemic response.

Testing should validate RTO and RPO assumptions. Organizations should conduct tabletop exercises, walkthroughs, and full simulations.

5.2 Plan Maintenance

Plan maintenance ensures the plan remains a living document updated regularly to stay current with system enhancements.

Changes in personnel, IT systems, vendors, or business processes require plan updates. Version control and annual reviews are recommended.

Shared responsibility drives resilience. Embedding crisis readiness across teams reduces reliance on discretionary effort and improves sustainability.

5.3 Case Studies: Crisis Management in Action

Mattel 2007 Lead Paint Recall: Toy maker recalled nearly 2 million toys tainted with lead paint. Within days, Mattel identified the factory, halted production, and launched an investigation. The company voluntarily expanded its review, imposed new tests, changed suppliers, and communicated consistently. Mattel won praise for its swift and honest response.

Samsung Galaxy Note 7 2016: Smartphones exploded due to a battery problem. Samsung took accountability, was transparent about not knowing the cause, and put 700 engineers on the problem. After identifying the issue, the company communicated clearly and introduced quality assurance features. Samsung’s brand value rose 9 percent the next year.

Logan City Council COVID-19: Pre-pandemic business continuity planning was managed by a small group with static documents not used during response. Post-pandemic, the council evolved structures to integrate business continuity and disaster management functions, aligning the Crisis Management Team with AIIMS.

5.4 Organizational Learning

Organizational learning applies lessons from crises so they will be prevented or mitigated in the future. It is the fourth stage of the crisis management framework.

Best practices for effective corporate crisis management include pre-planning and evaluation, choosing the correct spokesperson, and involving leaders in every stage.

After-action reviews should capture what went well, what failed, and what to change. Findings must be incorporated into plan revisions and training.

Related Topics

• Business Impact Analysis templates for disaster recovery
• Incident response plan vs disaster recovery plan
• High availability architecture for critical systems
• Cybersecurity tabletop exercises for crisis teams
• Supply chain risk management and continuity planning

FAQ

What is the difference between disaster recovery and business continuity?

Business continuity is proactive and ensures mission-critical functions can continue during and after a disaster. It covers all business functions. Disaster recovery is reactive and focuses on restoring IT systems and data after an incident. Disaster recovery is a subset of business continuity.

How do you calculate RTO and RPO?

RTO is determined by business impact analysis: how long can a system be down before unacceptable consequences occur. RPO is determined by how much data loss is tolerable, which sets backup frequency. For example, an RPO of 15 minutes requires backups at least every 15 minutes. Both should be set per application based on criticality and cost.

What is the difference between a hot site, warm site, and cold site?

A hot site is fully functional and can take over operations without interruption. A warm site is semifunctional and requires some manual configuration before taking over. A cold site has minimal infrastructure and requires significant effort to use. Hot sites have highest cost and fastest recovery; cold sites lowest cost and slowest.

References

NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems

Disaster Recovery Plan - NIST CSRC Glossary

Disaster Recovery Key Concepts & Definitions - FEMA

Incident Command System - FEMA Glossary

Local Disaster Recovery Managers Responsibilities - FEMA

Australian Government Crisis Management Continuum

RPO vs. RTO: Key Differences Explained With Examples - TechTarget

Business Continuity vs. Disaster Recovery - IBM

Disaster recovery site requirements: Hot, warm, cold - TechTarget

Evolution of the Crisis Management Team Structure - IGEM Queensland

The Best Crisis Management Examples - Smartsheet

Best Practices for Effective Corporate Crisis Management - Cal Poly

Continuity Planning Suite - CISA