Disaster recovery is not a document. It is a drill.

Plenty of organizations have a disaster recovery document. Very few have a disaster recovery capability. The gap between the two is almost always closed by drilling.

The minimum viable drill

Pick a scenario, sit your team in a room, and walk through it as if it were happening now. Two hours, including a debrief.

A good scenario

• "Our primary file server is encrypted by ransomware at 7 AM Monday."
• "Our M365 tenant locks us out due to a breach response. We need to operate for 72 hours."
• "Our internet circuit is severed and the failover did not engage."

What to grade

Time to detect. Time to decision. Time to first restore action. Time to operational. Whether the runbook was actually followed.