Disaster scenarios must not endanger patients, the quality of the product or the integrity of data. Business continuity guides the organization to react, recover, restart and return to an agreed operating level while disruption lasts and once it ends, while disaster recovery restores systems and data to the recovery point objective within the recovery time objective; scenarios include loss of application components, infrastructure, a service provider or premises, network failures, cyberattacks and pandemics, for large integrated systems high-availability disaster recovery may provide continuity and this is documented, disaster recovery is typically a shared responsibility with providers whose service level agreements define responsibilities and major incident communication, verified by supplier assessment and monitoring, and the extent of plans is based on a documented risk assessment; planning may be at corporate, departmental and process levels for continuity and infrastructure, application and data levels for recovery. Business continuity plans define alternative manual or system-based processes for safe continuation during prolonged disruption, are rehearsed with materials available, roles defined and personnel trained, demonstrate that critical services continue and essential functions resume in time, arise from a defined creation process with a risk assessment of failure scenarios, may span facilities, systems and organizations, include measures to reduce threats such as reviewing the recovery strategy, backup and security, building in redundancy and high availability, securing resources for alternatives, avoiding single-supplier dependence, failure detection and alternative locations, provide for re-establishing normal operation by synchronizing manual records, reprocessing data not backed up and retaining manual records, are supported by contracts for alternative arrangements with third parties included in rehearsals, and are tested by reviews, walkthroughs, partial tests, server reinstallation, hot-site switching or full tests. Disaster recovery planning starts from a documented risk assessment of the workforce, suppliers, facilities, infrastructure, applications and data against threats such as natural events, power failure, hardware and software failure, information security risks, provider failure, human error, pandemic and cyberattack, evaluated against the recovery objectives to select strategies such as spares, restoration, rerouting, reconnection to cloud services, alternative systems or premises, high availability and repair; plans set out immediate steps, recovery actions and the order of system restoration, alternative working, roles, communication and key contacts, are understood by all organizations involved, are tested periodically by risk against the recovery objectives with provider testing confirmed, define invocation and governance through incident management with a major incident team and links to provider processes, prioritize restoration across multiple failed systems and may phase restoration of current operations before historical data. Management ensures continuity plans are established, tested, followed and reported, and process and system owners ensure disaster recovery plans exist and are tested for their systems.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.