A formal risk assessment should be undertaken in order to determine the requirements for the disaster recovery plan.

The disaster recovery plan should be periodically tested in a simulated environment to ensure that it can be implemented in emergency situations and that the management and staff understand how it is to be executed.

The disaster recovery plan should cover all essential and critical business activities.

The disaster recovery plan is to be kept up to date to take into account changing circumstances.

All staff must be made aware of the disaster recovery plan and their own roles within.

A similar policy statement to this should be communicated to all management and staff as part of its information security policy management process.