What are the steps to build a disaster recovery plan for paper and electronic records?

A disaster recovery (DR) plan protects records from fire, flood, ransomware, hardware failure, and other disruptions, and sets out how to restore access afterward. The strongest plans treat paper and electronic records as one coordinated program rather than two separate efforts. The steps below offer a practical, principle-based starting point.

Assess risks and identify vital records

Begin by cataloging where records live: file rooms, off-site storage, on-premises servers, and cloud systems. Then identify your vital records — those essential to operations, legal obligations, and rights of citizens or employees. These deserve priority protection. Pair this with a risk assessment of likely threats to each location and format, so that effort matches actual exposure.

Prevent and prepare

Reduce the chance and impact of loss before anything happens:

• Store paper away from water sources, in stable temperature and humidity, using fire-rated containers where appropriate.
• For electronic records, follow a tested backup strategy with multiple copies, at least one stored off-site or offline to guard against ransomware.
• Apply your retention schedule consistently — the less inactive material you hold, the less there is to lose or recover.

Plan the response

Document who does what when disaster strikes. Include emergency contacts, salvage priorities (vital records first), and step-by-step procedures. For wet paper, time matters: stabilizing, freezing, and drying are common salvage methods. For digital systems, define restore-from-backup procedures and recovery time objectives.

Establish recovery and continuity

Decide how operations continue while primary records are unavailable — alternate sites, redundant systems, or temporary access to backups. Ongoing digital preservation practices (integrity checks, format migration, redundant storage) help ensure electronic records remain usable over time, not just recoverable in a crisis.

Train, test, and maintain

A plan only works if people know it and it still reflects reality. Train staff, run periodic drills or tabletop exercises, and review the plan after any incident, system change, or relocation.

For broader context on protecting and preserving records, see the Archives & Preservation topic hub.

These steps are general guidance; align your plan with your organization’s legal requirements, retention obligations, and risk tolerance.