IT Disaster Recovery Lead
IT
SmartSuite for the IT Disaster Recovery Lead
The IT Disaster Recovery Lead owns the recovery of technology services after a disruption: recovery strategies, DR plans, recovery time and point objectives, failover testing and the link between IT recovery and business continuity plans.
Reports to:
What you own
The IT Disaster Recovery Lead owns the recovery of technology services after a disruption: recovery strategies, DR plans, recovery time and point objectives, failover testing and the link between IT recovery and business continuity plans.
- Own IT disaster recovery plans and recovery strategies
- Set and validate RTOs and RPOs with business continuity
- Plan and run DR tests and failover exercises
- Maintain the inventory of critical systems and dependencies
- Coordinate recovery during IT incidents and disasters
- Track DR test findings and remediation
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the IT Disaster Recovery Lead: navy is owned, blue is touched, grey is depended on.
- First lineThe business and its control ownersRun the processes, own the controls, fix the issues
- Second lineRisk, compliance and the domain programmesSet the frameworks, assess, monitor and advise
- Third lineInternal auditIndependent assurance to the board and audit committee
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
IT Operations Director
See the roleDirect reports
Works closely with
Business Continuity Manager
See the roleSystems Administrator
See the roleIncident and Problem Manager
See the roleChief Information Security Officer
See the roleHead of Operational Resilience
See the roleHow SmartSuite supports the IT Disaster Recovery Lead
The IT Disaster Recovery Lead owns recovery of technology services, and the IT Operations Director, the Head of Operational Resilience and examiners under FFIEC, DORA or HIPAA expect current plans, validated targets and evidenced tests. SmartSuite links DR plans, RTO and RPO targets and exercise results to the business services they protect.
Own DR plans, targets and the test calendar
Map each critical system, its dependencies and its facilities and vendors to the business services it supports, so the recovery sequence follows what the business needs first rather than what the runbook listed first.
Operational Resilience suitePlan each DR test and failover exercise with tasks sent automatically to the Systems Administrator and participants, engagement tracked and outcomes recorded with full traceability, so the test produces its own evidence.
Operational Resilience suiteContinuity plan governance puts every DR plan on an automated review cycle with version control and a named owner, so a plan written for last year's infrastructure is flagged for review before an exercise exposes it.
Operational Resilience suiteStay aligned with continuity, operations and security
Each Business Impact Analysis (BIA) records the tolerance the business can bear, linked to the systems beneath it, so you and the Business Continuity Manager set RTOs and RPOs from the same impact data rather than negotiating from memory.
Operational Resilience suiteDuring a live disruption, incidents are logged, actions tracked and collaboration happens in the record, so the Incident and Problem Manager's restoration work and your recovery steps share one timeline for the post-incident review.
Operational Resilience suiteThird-party dependency governance tracks how critical systems rely on external providers, so a cloud or hosting supplier's recovery commitment is visible next to your own RTO and the CISO can see the exposure.
Operational Resilience suiteEvidence recovery to examiners and leadership
Full histories of tests, incidents, reviews and ownership changes are retained, so an FFIEC, DORA or HIPAA contingency-plan examination reads the exercise record rather than a summary written for the visit.
Operational Resilience suiteUse the AI Assistant in a SmartDoc field to draft scenario test summaries and incident reports from the exercise record, so the write-up after a failover test is ready for the IT Operations Director while the findings are still fresh.
Operational Resilience suiteRun simulations and stress-test scenarios against the dependency map to see how recovery holds under different failure conditions, so the readiness you report rests on tested assumptions rather than on last year's exercise alone.
Operational Resilience suiteOperational resilience. Holds DR plans, RTO/RPO targets and test schedules linked to the business services they support.
Issues and actions. Tracks DR test findings and remediation to closure.
Reporting. Reports recovery readiness against targets to resilience and IT leadership.
Products this role uses most
Industry reference
ISO/IEC 27031 and NIST SP 800-34 Rev. 1 define ICT readiness and contingency planning; ITIL 4's service continuity management practice and ISO/IEC 27001:2022 Annex A 5.30 require it as part of service and security management; ISO 22301 ties IT recovery to business impact.
Regulators test recovery. The FFIEC BCM booklet and DORA require backup policies and tested recovery for financial entities; the HIPAA Security Rule requires a contingency plan with data backup, disaster recovery and testing (45 CFR 164.308(a)(7)); federal systems follow NIST SP 800-53 contingency controls; technology providers evidence recovery for SOC 2 availability commitments.
Related roles
IT Operations Director
See the roleExplore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
The IT Disaster Recovery Lead owns the recovery of technology services after a disruption: the DR plans and recovery strategies, the recovery time and recovery point objectives set and validated with business continuity, the DR tests and failover exercises, the inventory of critical systems and their dependencies, and the coordination of recovery when an IT incident or disaster is live. They track test findings and remediation, which is how the plans improve between tests.
Operational Resilience holds DR plans, RTO and RPO targets and test schedules linked to the business services they support, so each plan shows which services depend on it and whether its targets meet the tolerances the Business Continuity Manager set. Business Impact Analysis (BIA) supplies those tolerances, and Configuration Management (CMDB) holds the critical systems and dependencies the plan recovers. The test schedule sits against the plan, so overdue tests are visible before an auditor finds them.
DR test findings and remediation are tracked to closure in Issues Management, so each finding from a failover exercise has an owner, a due date and evidence when it is fixed, and the next test can confirm it. The Systems Administrator and Incident and Problem Manager see the same actions, which is how a finding about a backup gap or a dependency nobody documented becomes a change rather than a line in a test report.
SmartSuite reports recovery readiness against targets to resilience and IT leadership from the plans, tests and open findings as they stand. The IT Disaster Recovery Lead can show the IT Operations Director and Head of Operational Resilience which systems have tested plans that meet their RTO and RPO, which tests are overdue and which findings remain open. That is the tested recovery evidence the FFIEC BCM booklet, DORA, the HIPAA Security Rule and SOC 2 availability commitments ask for.
New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows. For the IT Disaster Recovery Lead the first workflow is the DR plan set: load the inventory of critical systems with their dependencies, attach each DR plan with its RTO and RPO targets, and link the plans to the business services they support so the resilience and IT views agree. Setting the test schedule then puts the exercise cycle on a calendar, and the first test's findings start the remediation record.