A1.3 Recovery plan procedures support system recovery from failures
Tests recovery plan procedures supporting system recovery to meet its objectives.
5
artefacts
0
held by a system
4
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Test results recording what was recovered, the time taken and whether the recovery objectives were met · Source control / CI pipeline
- Evidence of actual restoration of data from backup, verified for completeness and integrity, not only that a job reported success · Backup / DR tooling
- Records of issues identified during testing and evidence of their remediation · Document repository
- Evidence of the frequency of testing and that it covers the systems within the availability commitment · Document repository
governing documentDocuments that govern the control
- The recovery test plan for the period, showing scope, scenario, participants and the objectives being tested · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Testing limited to a walkthrough or a single file restore, which does not test the recovery plan procedures the criterion names
- Restore performed with no verification the recovered data was complete and usable
- Results recorded as successful with no measurement against the recovery time and recovery point objectives
- Issues found in the test carried forward to the next test unresolved
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA1.2 Environmental protections, data backups, and recovery infrastructure support availability · C1.1 Confidential information is identified and protected during receipt, processing, storage