Ask any organization whether they have backups and the answer is yes. Ask when they last restored one, and the room goes quiet. That silence is the actual state of their disaster recovery, because a backup that has never been restored is a hope, not a plan.
The failure modes are well known and keep happening anyway. Backups that silently stopped running months ago. Backups that run but capture the wrong things, the files but not the database, or the database but not the uploads. Backups stored on the same server they are meant to protect, which works for every disaster except the ones that matter. And the ransomware-era classic: backups reachable from the network that just got encrypted, so they got encrypted too.
A recovery plan answers questions a backup does not. How much data can we afford to lose, an hour or a day? How long can we be down? Who does the restore, onto what, and where are the credentials that make it possible if the primary systems are gone? The answers set how backups should be built, not the other way around.
Then the unglamorous part: rehearse. Twice a year, restore to a scratch environment and confirm the business actually runs on what comes back. Every restore drill we have run has found something: a missing directory, an expired credential, a step only one departed employee knew. Better to meet those on a Tuesday afternoon than during the real thing.
