Great article
I was a BCP/DRP coordinator for the last 10 years of corporate life in a multi-national company.
We had three main groups (Wins, Unix, MF) responsible for their own backup, but all under the umbrella of the DRP/BCP group. My area was MF but we worked closely with the other two ( they had server rooms within the datacenter) and ran DRP/BCP tests offsite every six months..
From my experience, I can only reiterate your points. Business continuity (preferred over disaster recovery) means test, test, test. Is the data recoverable, is the data current, do I have the means to recover?
#4. whether you have the hardware at hand or not, you should at least have configurations documented as well as where to obtain that hardware. This is certainly true if you need to move location and isn't limited to IT hardware.
#6. Not only do a dry run, but document what you did (whether it worked or not) and the time each step took. You will find with each dry run that the procedure gets easier. Make that document into a script, and have one for ech scenario. When your client asks for ETR, you can be quite accurate in your answer.
#9. 30 miles is the minimum distance for offsite. Anything closer and you could be in the same disaster zone. Direction of offsite storage is also a factor. Are you and your storage in the same line for tornadoes or hurricanes?
#10. If not printed, at least available on an external storage that you can attach to a laptop. Add a printer here too.
