Continuity plan, backups and crisis management

Catalog reference

Keep a business continuity and disaster recovery plan, based on your risk assessment, that sets purpose, scope, roles, contacts, activation and deactivation conditions, recovery plans and objectives, the resources needed and the return to normal. Run a business impact analysis and set continuity requirements for your systems. Test and update the plans on a schedule and after significant incidents or changes. Keep backups with backup plans covering recovery times, complete and accurate copies (configuration and cloud data included), storage at a safe, separate location, access controls, restoration, and retention. Check backup integrity regularly, keep at least partial redundancy of systems, assets, people and communication channels, and test restores and redundancy and record the results. Run a crisis management process covering roles, communication with the competent authorities, and security measures during a crisis, handle information received from the CSIRT or authority, and test and update the crisis plan. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Narrative — how we satisfy this requirement