4.1.2 The relevant entities’ operations shall be restored according to the business continuity and …

Requirement

The relevant entities’ operations shall be restored according to the business continuity and disaster recovery plan. The plan shall be based on the results of the risk assessment carried out pursuant to point 2.1 and shall include, where appropriate, the following: (a) purpose, scope and audience; (b) roles and responsibilities; (c) key contacts and (internal and external) communication channels; (d) conditions for plan activation and deactivation; (e) order of recovery for operations; (f) recovery plans for specific operations, including recovery objectives; (g) required resources, including backups and redundancies; (h) restoring and resuming activities from temporary measures.

Guidance

• Keep logs of activation and execution of the business continuity plan, including:
  • decisions taken;
  • steps followed; and
  • final recovery time.
• Determine the order of recovery based on criteria, including (indicative, non-exhaustive list):
  • the asset classification level;
  • the importance of the service for the entity;
  • dependencies (services or assets that are essential for others are restored first);
  • recovery objectives (Annex to the regulation, point 4.1.3);
  • resource availability; and
  • regulatory requirements.
• Conduct capacity planning so that necessary capacity for information processing, telecommunications and environmental support exists after business continuity plan activation.
• Consider primary and alternate telecommunications service providers, section 13.1, to properly maintain disaster recovery plans (for the services provided).
  • For remote work, employees handling critical operations should:
    • have access to backup internet solutions (e.g. mobile broadband, tethering capabilities) and
    • participate in regular testing of failover options, including VPN access and voice communications (e.g. VoIP or cloud telephony) over backup networks.
• Prepare for recovery and restoration of services after a disaster by identifying measures such as:
  • failover sites in other regions;
  • backups of data with high criticality to remote locations; and
  • tested restore procedures with regular validation cycles.
• Make sure that third party services (e.g. hot site) will be available in case of disaster, where appropriate.
• Implement advanced measures for disaster recovery capabilities, where appropriate, for example:
  • full redundancy;
  • failover mechanisms; and
  • alternative site.

Examples of evidence

• Measures in place for dealing with disasters, such as failover sites in other regions and backups of data to remote locations.
• Up-to-date organisational structures widely communicated.
• Inventory of sectors and services essential for and/or dependent on the continuity of the network and service operation, and contingency plans for mitigating the impact related to dependent and interdependent sectors and services.

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

3. Σχετικοί κανονισμοί

Συνδεδεμένα ζητήματα

• ENISA -