# Business Continuity & Disaster Recovery Guidance

**Document owner:** [Owner/Role]  
**Approved by:** [Steering Committee / CISO]  
**Effective date:** [YYYY-MM-DD]  
**Review cadence:** [Annually]

---

## 1. Purpose & Scope
Implementation guidance for the [Business Continuity & Disaster Recovery Policy](business_continuity_dr_policy.md). Applies to IT, system owners, and business continuity coordinators.

---

## 2. BIA — Practical Approach
- Interview each business unit: "if this system is down for 4 hours / 24 hours / a week, what breaks?"  
- Convert answers into RTO/RPO, then map to the tier table in policy §2.2 — don't let every system owner claim "critical," that defeats the tiering.

## 3. Backup — 3-2-1-1 Pattern
- **3** copies of data, **2** different media/storage types, **1** offsite, **1** offline/immutable — the extra "1" beyond the classic 3-2-1 is specifically to survive ransomware that targets connected backup systems.

## 4. Greenfield Rebuild — What "Tested" Means
- Not: "we have Terraform files somewhere."  
- Yes: a scheduled exercise (can be non-production) that actually runs the documented rebuild process end-to-end and records how long it took and what broke in the documentation.  
- Treat gaps found during the exercise as findings, feeding [Authentication Policy §2.12](authentication_policy.md) structural learning.

## 5. DR Test Checklist
✅ Full failover test run annually for kill-chain/critical systems, with results documented.  
✅ Backup restoration spot-tested quarterly for kill-chain systems.  
✅ Break-glass access confirmed to work if the primary IdP is the thing that's down (test this specifically — it's the scenario people forget).  
✅ Greenfield rebuild capability exercised at least once every 5 years, findings tracked.

---

## 6. References
- **[NIST SP 800-34 Rev. 1](https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final)**  
- **[ISO 22301:2019](https://www.iso.org/standard/75106.html)**