+Verification, updating and testing of the business continuity

Verification, updating and testing of the business continuity

The business impact analysis, business continuity plans and contingency plans are reviewed, updated and tested on a regular basis (at least annually) or after significant organisational or environmental changes. Tests involve affected customers (tenants) and relevant third parties. The tests are documented and results are taken into account for future operational continuity measures.
Additonal CriteriaIn addition to the tests, exercises are also carried out which, among other things, have resulted in scenarios from security incidents that have already occurred in the past.
Supplementary Information - About the CriteriaTests are primarily conducted at the operational level and are aimed at operational target groups. Tests include e.g.:
• Test of technical precautionary measures;
• Functional tests; and
• Plan review.Exercises also take place on a tactical and strategic level. These include e.g.:
• Plan meeting;
• Staff exercise;
• Command post exercise;
• Communication and alerting exercise;
• Simulation of scenarios; and
• Emergency or full exercise.
After a completed exercise:
• Review and possible adaptation of the existing alarm plan.Relevant third parties are in particular service providers and suppliers of the Cloud Service Provider who contribute to the provision of the cloud service (cf. basic criteria SSO02 and SSO05).

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania

3. Powiązane regulacje

Regulacje