Disaster recovery procedures documented, tested quarterly, with RTO and RPO targets

An undocumented disaster recovery process is an untested one — and an untested recovery process will fail at the worst possible moment. Without explicit RTO and RPO targets, there is no definition of success during a recovery, no basis for SLA commitments, and no mechanism to detect that backups are unrestorable before they are needed (NIST 800-53 CP-2, CP-4, ISO 27001 A.5.30). CIS AWS 2.1.1 requires documented recovery procedures. The most common failure mode is not missing backups but unencrypted or untested backups that cannot be restored under real incident conditions.

Create docs/disaster-recovery.md documenting numeric RTO/RPO targets, backup procedures, and recovery steps. Set up automated backups with Velero for Kubernetes resources:

# Install Velero with S3 backend
velero install \
  --provider aws \
  --bucket my-dr-backups \
  --backup-location-config region=us-east-1 \
  --use-volume-snapshots=true

# Schedule daily backups retained for 30 days
velero schedule create daily-cluster-backup \
  --schedule="0 2 * * *" \
  --ttl 720h

Document in docs/disaster-recovery.md:

## Recovery Objectives
- **RTO:** 4 hours (time to restore service)
- **RPO:** 1 hour (maximum data loss window)

## Quarterly DR Test
Date of last test: <date>
Restoration verified by: <name>

Backups must be encrypted (Velero uses KMS by default with AWS) and stored in a separate account or region from the primary environment.