A copy and a plan
Disaster recovery goes beyond backups: it plans which systems return first, how access is restored, and how people are informed. It should support any uptime promises made to customers.
The recovery point objective (RPO) sets the maximum recent data that can be lost; the recovery time objective (RTO) sets the longest time to restore service. An RPO of one hour and an RTO of four hours mean the plan must limit data loss to one hour and downtime to four hours.
Test that backups work
Store backups away from the live system, limit access, and practise restoring them. A copy on the same machine may be lost in the same failure. An automatically updated copy is not always a backup: it may copy an accidental deletion too.