Crossfoot
Crossfoot / Controls / Business continuity and disaster recovery
Draft v0.1.06 of 6 frameworks

Business continuity and disaster recovery

Documented and tested plans to continue critical operations and recover systems after disruption.

Where it appears

SOC 2
CC9.1Identifies, selects and develops risk mitigation activities for business disruptions
A1.2Environmental protections, software, data backup processes and recovery infrastructure
A1.3Tests recovery plan procedures
PCI DSS 4.0
12.10.1Incident response plan includes business recovery and continuity procedures
NIST CSF 2.0
PR.IR-03Mechanisms are implemented to achieve resilience requirements
RC.RPIncident recovery plan execution
ISO 27001:2022
A.5.29Information security during disruption
A.5.30ICT readiness for business continuity
HIPAA Security Rule
164.308(a)(7)Contingency plan
NIST 800-53 r5
CP-2Contingency plan
CP-4Contingency plan testing
CP-10System recovery and reconstitution

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Business continuity and disaster recovery plans with RTO/RPO
  • Business impact analysis
  • DR test or exercise results within the last 12 months with remediation of findings
  • Evidence of plan review and approval

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0