A disaster recovery plan must include your organizations recovery time objective (RTO) and recovery point objective (RPO), a comprehensive, up-to-date inventory of your IT assets, identification of person(s) responsible for the disaster recovery processes, a list of disaster recovery sites, the remote storage location of copies of critical data, documented disaster response procedures, identification sensitive data and how it is securely backed up up and who has access, a clear communication plan for disaster events, physical facilities needs, and regular drills and testing of your disaster recovery plans in realistic scenerios.