1.9 KiB
1.9 KiB
Business Continuity & Disaster Recovery Guidance
Document owner: [Owner/Role]
Approved by: [Steering Committee / CISO]
Effective date: [YYYY-MM-DD]
Review cadence: [Annually]
1. Purpose & Scope
Implementation guidance for the Business Continuity & Disaster Recovery Policy. Applies to IT, system owners, and business continuity coordinators.
2. BIA — Practical Approach
- Interview each business unit: "if this system is down for 4 hours / 24 hours / a week, what breaks?"
- Convert answers into RTO/RPO, then map to the tier table in policy §2.2 — don't let every system owner claim "critical," that defeats the tiering.
3. Backup — 3-2-1-1 Pattern
- 3 copies of data, 2 different media/storage types, 1 offsite, 1 offline/immutable — the extra "1" beyond the classic 3-2-1 is specifically to survive ransomware that targets connected backup systems.
4. Greenfield Rebuild — What "Tested" Means
- Not: "we have Terraform files somewhere."
- Yes: a scheduled exercise (can be non-production) that actually runs the documented rebuild process end-to-end and records how long it took and what broke in the documentation.
- Treat gaps found during the exercise as findings, feeding Authentication Policy §2.12 structural learning.
5. DR Test Checklist
✅ Full failover test run annually for kill-chain/critical systems, with results documented.
✅ Backup restoration spot-tested quarterly for kill-chain systems.
✅ Break-glass access confirmed to work if the primary IdP is the thing that's down (test this specifically — it's the scenario people forget).
✅ Greenfield rebuild capability exercised at least once every 5 years, findings tracked.