Charity Disaster Recovery Plan Template

Standard Operating Procedure: Disaster Recovery Plan (DRP)

Entity: Template Registry | Dept: Operational Resilience
Author: Julian Vance, Chief Architect

---

1. Document Control Block

---

2. Executive Summary & Purpose

This DRP establishes the technical and procedural framework for the recovery of critical charitable operations following a catastrophic failure (cyber-attack, natural disaster, or infrastructure collapse). The objective is to restore essential mission-critical services within defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).

---

3. Scope & Prerequisites

Scope: Applies to all physical, digital, and personnel-related assets of the organization.
Tools Required:

• Encrypted Offline Backup Repository (Immutable storage).
• Emergency Communication System (Out-of-band, e.g., Signal/Satellite).
• Hard-copy Documentation (Emergency contact directory, site access codes).
• Hardware: Replacement workstations, spare server/network gear, mobile power units.

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Procedure

Phase 1: Assessment & Declaration

• Establish initial contact with Emergency Response Team (ERT).
• Assess the scale of impact (Partial vs. Total Loss).
• Formally declare a "Disaster Event" to trigger insurance/legal protocols.

Phase 2: Immediate Containment

• Isolate compromised systems to prevent lateral movement (Network segment shutdown).
• Execute physical site lockdown if safety is compromised.
• Notify staff and beneficiaries via established out-of-band channels.

Phase 3: Recovery Operations

• Provision verified clean-state environments (Infrastructure as Code preferred).
• Restore data from most recent immutable backup (verify hash integrity).
• Conduct vulnerability scanning on restored systems.
• Perform user acceptance testing (UAT) on critical databases (CRM/Financials).

Phase 4: Restoration & Reporting

• Initiate phased restoration of services (Internal -> Beneficiary-facing).
• Conduct Post-Incident Review (PIR) within 72 hours of restoration.
• Reconcile financial/donations data against pre-disaster logs.

---

6. Quality Assurance & Pro-Tips

Pro-Tips:

• Immutability is Non-Negotiable: Ensure backups cannot be deleted or encrypted by ransomware (WORM storage).
• The "Three-Deep" Rule: Maintain a minimum of three copies of data: two on different media, one off-site (cloud/geographic).
• Documentation: If it isn't written down, it doesn't exist during a crisis. Keep physical binders in off-site safes.

Metrics/Thresholds:

• RTO: All critical systems must be operational within 4 hours.
• RPO: Data loss tolerance is restricted to 1 hour of transaction logs.

---

7. Frequently Asked Questions

Q: How do we verify that our backups are not corrupted?
A: Implement automated daily integrity checks with cryptographic hashing. Perform a "Live Restore" simulation every quarter to ensure file recoverability.

Q: If we lose our physical office, where does the team congregate?
A: The primary site is the "Office," the secondary site is the "Cloud-First Workspace," and the tertiary site is the "Designated Remote Operations Hub" defined in the Emergency Contact Directory.

Q: Who authorizes the "all-clear" signal?
A: The Disaster Recovery Lead authorizes the technical all-clear, while the Executive Director authorizes the resumption of public-facing operations.