4.1 Business continuity and disaster recovery plan

Requirement

For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents.

Guidance

• Take into account industry-recognised standards when developing the business continuity (35) and disaster recovery plan.
• Create a list of natural disasters (e.g. hurricane, fire, flooding) and other occurrences (e.g. human error) that could affect the services together with a list of disaster recovery capabilities (e.g. backups, tests, recovery objectives, etc.).

Examples of evidence

• Business continuity plan.
• Disaster recovery plan.
• Business continuity and disaster recovery plans are in line with documented standards and/or good practices.
• List of natural and/or major disasters that could affect the services and a list of disaster recovery capabilities (either those available internally or provided by third parties).

Requirement

The relevant entities’ operations shall be restored according to the business continuity and disaster recovery plan. The plan shall be based on the results of the risk assessment carried out pursuant to point 2.1 and shall include, where appropriate, the following: (a) purpose, scope and audience; (b) roles and responsibilities; (c) key contacts and (internal and external) communication channels; (d) conditions for plan activation and deactivation; (e) order of recovery for operations; (f) recovery plans for specific operations, including recovery objectives; (g) required resources, including backups and redundancies; (h) restoring and resuming activities from temporary measures.

Guidance

• Keep logs of activation and execution of the business continuity plan, including:
  • decisions taken;
  • steps followed; and
  • final recovery time.
• Determine the order of recovery based on criteria, including (indicative, non-exhaustive list):
  • the asset classification level;
  • the importance of the service for the entity;
  • dependencies (services or assets that are essential for others are restored first);
  • recovery objectives (Annex to the regulation, point 4.1.3);
  • resource availability; and
  • regulatory requirements.
• Conduct capacity planning so that necessary capacity for information processing, telecommunications and environmental support exists after business continuity plan activation.
• Consider primary and alternate telecommunications service providers, section 13.1, to properly maintain disaster recovery plans (for the services provided).
  • For remote work, employees handling critical operations should:
    • have access to backup internet solutions (e.g. mobile broadband, tethering capabilities) and
    • participate in regular testing of failover options, including VPN access and voice communications (e.g. VoIP or cloud telephony) over backup networks.
• Prepare for recovery and restoration of services after a disaster by identifying measures such as:
  • failover sites in other regions;
  • backups of data with high criticality to remote locations; and
  • tested restore procedures with regular validation cycles.
• Make sure that third party services (e.g. hot site) will be available in case of disaster, where appropriate.
• Implement advanced measures for disaster recovery capabilities, where appropriate, for example:
  • full redundancy;
  • failover mechanisms; and
  • alternative site.

Examples of evidence

• Measures in place for dealing with disasters, such as failover sites in other regions and backups of data to remote locations.
• Up-to-date organisational structures widely communicated.
• Inventory of sectors and services essential for and/or dependent on the continuity of the network and service operation, and contingency plans for mitigating the impact related to dependent and interdependent sectors and services.

Requirement

The relevant entities shall carry out a business impact analysis to assess the potential impact of severe disruptions to their business operations and shall, based on the results of the business impact analysis, establish continuity requirements for the network and information systems.

Guidance

• Based on the results of the BIA (36) and risk assessment, the entity should establish appropriate recovery objectives, referred to in point 4.1.2 (f) of the Annex to the regulation (indicative, non-exhaustive list):
  • Recovery time objectives (RTOs) to determine the maximum amount of time allowed for the recovery of business resources and functions (e.g. information and communications technology (ICT) systems and processes, respectively) after a disaster occurs, for example maximum downtime of the entity’s website, enterprise resource planning (ERP) system or email system.
  • Recovery point objective (RPO) to determine how much data it is acceptable for specific ICT activities or applications to lose. Typically, they are measured in maximum time needed to recover data without causing unacceptable, according to the risk assessment, damage to the entity’s activities, for example maximum recovery time for an e-commerce website, an ERP system or an email server.
  • Service delivery objective (SDO) to determine the minimum level of performance that needs to be reached by business functions during the alternate processing mode. An indicative and non-exhaustive list of examples includes:
    • the percentage of inbound calls to be answered by a call centre within a specific timeframe;
    • the level of availability of ordering and payment systems of an e-commerce website within a specific timeframe;
    • the restoration time for accessing essential shared folders via a cloud file access system; and
    • the timeframe within which the full functionality of the remote work infrastructure is restored.
  • Maximum acceptable outage (MAO) or maximum tolerable period of disruption (MTPD) to determine the time it would take for the potential impacts of not providing a product/service or performing an activity to become unacceptable or significant, in accordance with the risk assessment. Typically they are longer than RTOs. MAOs focus on service availability while RPOs focus on data loss. An indicative and non-exhaustive list of examples:
    • the period of time beyond which the customer service would be severely impacted and reputation risk increases quickly;
    • the longest period of time that extended outage of an e-commerce website might result to major loss of sales and customer trust;
    • the longest period of time that shared access to project files may halt collaboration or decision-making in case that data is stored in cloud; and
    • the maximum acceptable outage for remote work infrastructure beyond which business functions are significantly impaired and productivity losses begin to escalate.
• RTOs, RPOs and SDOs may be used to determine backup and redundancy procedures.
• Document disaster recovery plan, taking into account:
  • the RTOs, RPOs and SDOs; and
  • compliance with applicable regulations and legislation.

Examples of evidence

• Documented BIA with specific recovery objectives.
• Processes, procedures and measures to ensure the required level of continuity in disruptive situations.

Requirement

The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons learnt from such tests.

Guidance

• Test, review and, if necessary, update the business continuity and disaster recovery plans at least annually.
• Choose and combine method(s) to test the business continuity and disaster recovery plans, such as:
  • alternative locations for personnel;
  • disaster recovery locations – hot sites;
  • digital twins;
  • simulations;
  • table top exercises.
• Test business continuity and disaster recovery plans regularly, taking into account:
  • change logs;
  • past incidents; and
  • results of previous tests.
• Where appropriate, test the disaster recovery plan at an alternate processing site to:
  • familiarize related personnel with the facility and available resources; and
  • evaluate the capabilities of the alternate processing site to support operations.
• Test data centre infrastructure for:
  • availability;
  • auto failover;
  • power failover between power providers and/or power provider to backup (for example generators or batteries); and
  • resilience to maintain service to customers.
• Define full recovery and reconstitution of the information system to a known state as part of the disaster recovery plan testing.
• Update business continuity and disaster recovery plans and related measures based on:
  • change logs;
  • past incidents;
  • documented results of the continuity of operations test activities; and
  • records of individual training activities.
• Review change logs and documented results from past tests on business continuity and disaster recovery plans to ensure that the plans incorporate lessons learnt from such tests.
• Review and, if necessary, update roles and responsibilities.
• Review dependent third parties’ disaster recovery plans to ensure that the plans meet entity’s business continuity requirements.
• Communicate changes to business continuity and disaster recovery plans to related key personnel.

Examples of evidence

• Documented plans or schedules for future tests.
• Records from previous tests, reviews and possible updates.
• Logs of activation and execution of business continuity and disaster recovery plans, including decisions taken, steps followed and final recovery time.
• Communications, for example emails, documents and intranet announcements, concerning changes to the business continuity and disaster recovery plans.
• Evidences that lessons learnt from past tests are incorporated into the plans, for example workflow changes and updated plans.

Tips: guidance

• In addition to the elements referred to in point 4.1.2 of the Annex to the regulation, the business continuity plan might address:
  • management commitment;
  • coordination among organisational units;
  • communication plan;
  • compliance with laws;
  • metrics for measuring the successful implementation of the plan .
• Protect the business continuity and disaster recovery plans from unauthorized disclosure and modification.
• Ensure that business continuity and disaster recovery plans are easily accessible during a system outage. An indicative, non-exhaustive list of options to achieve this:
  • physical copies;
  • cloud storage;
  • external drives;
  • mobile access.
• Distribute copies of the business continuity plan to the related key personnel.
• Monitor the activation and execution of the business continuity plan registering successful and failed recovery times.
• Add a reference or a description / connection with the incident handling policy, plan and procedures into the business continuity plan.
• Coordinate the business continuity plan with the respective plans of external service providers to ensure that continuity requirements are satisfied
• Train key personnel involved in continuity operations.
• Set up procedures in regard to the appropriate communication channels with the (inter)national competent authorities, including disaster management organisations and disaster-relief teams.
• Regularly train the responsible personnel in disaster recovery operations.
• Implement contingency plans for systems based on scenarios.
• Monitor the activation and execution of contingency plans, registering successful and failed RTOs, RPOs and SDOs.
• Implement contingency plans for high criticality dependent and inter-dependent sectors and services.

Tips: examples of evidence

• Measures, for example encryption and access control, for protecting business continuity and disaster recovery plans from unauthorized disclosure and modification.
• Up-to-date organisational structures widely communicated.
• Decision process for activating contingency plans.
• Contingency plans for systems, including clear steps and procedures for common threats, triggers for activation, steps and defined RTOs, RPOs and SDOs.
• Logs of activation and execution of contingency plans, including decisions taken, steps followed and final recovery time.