This is often why individuals in DR/BC and security (a CISO for example) leave a company. They do their jobs and come up with recommendations and other steps t

This is often why individuals in DR/BC and security (a CISO for example) leave a company. They do their jobs and come up with recommendations and other steps that need to be taken to implement best practices in this area. When these recommendations and steps aren't taken they don't want to be the one taking the blame if something goes wrong, and rightly so, they leave. It is not uncommon for an organization to do "theater" that makes it look like all the best practices are being followed when in reality it's just a pretty checklist that doesn't actually follow the intent. The only way to know if an organization is taking DR/BC seriously is if they're willing to literally kill a server or other infrastructure element of high-importance and see how effective the roll over is. There are lots of horror stories about organizations that did DR/BC only to find that one or more critical elements of their process were so flawed that it was impossible to get back to operational.