Most organisations have a disaster recovery plan. It documents the recovery procedures for critical systems, the RTO and RPO targets, the escalation contacts, and the steps to restore from backup. It was written at some point in the past, possibly updated once or twice since, and it sits in a document repository that is accessed primarily when an auditor asks to see it.

The problem with an untested DR plan is not that it might have typos or outdated contact information, though those are real. The problem is that it is a hypothesis. It describes what the organisation believes would happen during a recovery. Whether it would actually happen — whether the recovery procedures work, whether systems can be restored within the defined RTO, whether the people executing the plan can actually follow it under pressure — is entirely unknown until it is tested.

And the moment you discover the hypothesis is wrong is exactly the moment you need the plan to work.

The Types of DR Tests

DR testing exists on a spectrum from low disruption to high fidelity. The right type of test depends on what you need to learn and what you are willing to disrupt to learn it.

Walkthrough review. The recovery team walks through the plan document together, reviewing each step, identifying gaps, outdated information, and dependencies that may have changed. This is the minimum test — it requires no technical execution but identifies documentation gaps and ensures that recovery personnel are familiar with the plan. Every organisation should do this at least annually.

Tabletop exercise. A facilitated scenario discussion where the recovery team works through a simulated disruption event. The facilitator presents injects — new information about the scenario — and the team discusses how they would respond at each stage. Tabletop exercises test decision-making, communication, escalation, and inter-team coordination without any technical execution. They consistently reveal gaps in the plan that walkthroughs miss, because they introduce the complexity of a real scenario.

Technical recovery test. An actual test of IT recovery procedures — restoring systems from backup, activating failover environments, validating that restored systems function correctly. A partial technical test might restore one or two systems in an isolated environment. A full technical test might activate the complete DR environment and validate all critical systems. Technical tests are the only way to confirm that backup and replication solutions actually work, and that RTO/RPO targets are achievable.

Full simulation. A complete simulated disruption that activates the DR plan in as close to real conditions as possible — production systems are temporarily taken offline, the DR environment is activated, and the organisation operates from the DR environment for a defined period. Full simulations are disruptive and resource-intensive, but they are the only test that validates the complete DR capability under operational pressure.

What Testing Consistently Reveals

Across all types of DR tests, certain findings appear with almost universal consistency: recovery procedures that are undocumented or documented insufficiently for someone to execute under pressure; backup solutions that technically work but restore within timeframes that exceed the defined RTO; dependencies on systems or resources that are not in scope for DR but that critical recovery procedures require; and key-person dependencies — recovery procedures that only one person knows how to execute, with no documented alternative.

These findings are not failures. They are exactly what testing is designed to surface — so they can be addressed before a real disruption forces the discovery.

At Bitsecura, we design and facilitate DR tests across all levels — from walkthrough reviews to full simulations — and help organisations build testing programmes that are proportionate to their risk profile and practical within their operational constraints. If you want to know whether your DR plan actually works, reach out here.

Bitsecura provides business continuity management and disaster recovery planning services. Learn more about our BCM and DR services.