38 lines
1.9 KiB
Markdown
38 lines
1.9 KiB
Markdown
# Business Continuity & Disaster Recovery Guidance
|
|
|
|
**Document owner:** [Owner/Role]
|
|
**Approved by:** [Steering Committee / CISO]
|
|
**Effective date:** [YYYY-MM-DD]
|
|
**Review cadence:** [Annually]
|
|
|
|
---
|
|
|
|
## 1. Purpose & Scope
|
|
Implementation guidance for the [Business Continuity & Disaster Recovery Policy](business_continuity_dr_policy.md). Applies to IT, system owners, and business continuity coordinators.
|
|
|
|
---
|
|
|
|
## 2. BIA — Practical Approach
|
|
- Interview each business unit: "if this system is down for 4 hours / 24 hours / a week, what breaks?"
|
|
- Convert answers into RTO/RPO, then map to the tier table in policy §2.2 — don't let every system owner claim "critical," that defeats the tiering.
|
|
|
|
## 3. Backup — 3-2-1-1 Pattern
|
|
- **3** copies of data, **2** different media/storage types, **1** offsite, **1** offline/immutable — the extra "1" beyond the classic 3-2-1 is specifically to survive ransomware that targets connected backup systems.
|
|
|
|
## 4. Greenfield Rebuild — What "Tested" Means
|
|
- Not: "we have Terraform files somewhere."
|
|
- Yes: a scheduled exercise (can be non-production) that actually runs the documented rebuild process end-to-end and records how long it took and what broke in the documentation.
|
|
- Treat gaps found during the exercise as findings, feeding [Authentication Policy §2.12](authentication_policy.md) structural learning.
|
|
|
|
## 5. DR Test Checklist
|
|
✅ Full failover test run annually for kill-chain/critical systems, with results documented.
|
|
✅ Backup restoration spot-tested quarterly for kill-chain systems.
|
|
✅ Break-glass access confirmed to work if the primary IdP is the thing that's down (test this specifically — it's the scenario people forget).
|
|
✅ Greenfield rebuild capability exercised at least once every 5 years, findings tracked.
|
|
|
|
---
|
|
|
|
## 6. References
|
|
- **[NIST SP 800-34 Rev. 1](https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final)**
|
|
- **[ISO 22301:2019](https://www.iso.org/standard/75106.html)**
|