4.1.4 The business continuity plan and disaster recovery plan shall be tested, reviewed and, where …

Requirement

The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons learnt from such tests.

Guidance

• Test, review and, if necessary, update the business continuity and disaster recovery plans at least annually.
• Choose and combine method(s) to test the business continuity and disaster recovery plans, such as:
  • alternative locations for personnel;
  • disaster recovery locations – hot sites;
  • digital twins;
  • simulations;
  • table top exercises.
• Test business continuity and disaster recovery plans regularly, taking into account:
  • change logs;
  • past incidents; and
  • results of previous tests.
• Where appropriate, test the disaster recovery plan at an alternate processing site to:
  • familiarize related personnel with the facility and available resources; and
  • evaluate the capabilities of the alternate processing site to support operations.
• Test data centre infrastructure for:
  • availability;
  • auto failover;
  • power failover between power providers and/or power provider to backup (for example generators or batteries); and
  • resilience to maintain service to customers.
• Define full recovery and reconstitution of the information system to a known state as part of the disaster recovery plan testing.
• Update business continuity and disaster recovery plans and related measures based on:
  • change logs;
  • past incidents;
  • documented results of the continuity of operations test activities; and
  • records of individual training activities.
• Review change logs and documented results from past tests on business continuity and disaster recovery plans to ensure that the plans incorporate lessons learnt from such tests.
• Review and, if necessary, update roles and responsibilities.
• Review dependent third parties’ disaster recovery plans to ensure that the plans meet entity’s business continuity requirements.
• Communicate changes to business continuity and disaster recovery plans to related key personnel.

Examples of evidence

• Documented plans or schedules for future tests.
• Records from previous tests, reviews and possible updates.
• Logs of activation and execution of business continuity and disaster recovery plans, including decisions taken, steps followed and final recovery time.
• Communications, for example emails, documents and intranet announcements, concerning changes to the business continuity and disaster recovery plans.
• Evidences that lessons learnt from past tests are incorporated into the plans, for example workflow changes and updated plans.

Tips: guidance

• In addition to the elements referred to in point 4.1.2 of the Annex to the regulation, the business continuity plan might address:
  • management commitment;
  • coordination among organisational units;
  • communication plan;
  • compliance with laws;
  • metrics for measuring the successful implementation of the plan .
• Protect the business continuity and disaster recovery plans from unauthorized disclosure and modification.
• Ensure that business continuity and disaster recovery plans are easily accessible during a system outage. An indicative, non-exhaustive list of options to achieve this:
  • physical copies;
  • cloud storage;
  • external drives;
  • mobile access.
• Distribute copies of the business continuity plan to the related key personnel.
• Monitor the activation and execution of the business continuity plan registering successful and failed recovery times.
• Add a reference or a description / connection with the incident handling policy, plan and procedures into the business continuity plan.
• Coordinate the business continuity plan with the respective plans of external service providers to ensure that continuity requirements are satisfied
• Train key personnel involved in continuity operations.
• Set up procedures in regard to the appropriate communication channels with the (inter)national competent authorities, including disaster management organisations and disaster-relief teams.
• Regularly train the responsible personnel in disaster recovery operations.
• Implement contingency plans for systems based on scenarios.
• Monitor the activation and execution of contingency plans, registering successful and failed RTOs, RPOs and SDOs.
• Implement contingency plans for high criticality dependent and inter-dependent sectors and services.

Tips: examples of evidence

• Measures, for example encryption and access control, for protecting business continuity and disaster recovery plans from unauthorized disclosure and modification.
• Up-to-date organisational structures widely communicated.
• Decision process for activating contingency plans.
• Contingency plans for systems, including clear steps and procedures for common threats, triggers for activation, steps and defined RTOs, RPOs and SDOs.
• Logs of activation and execution of contingency plans, including decisions taken, steps followed and final recovery time.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• ENISA -