Skip to main content
All measures

Measure · ISO 27001 and other standards

Prepare IT emergency response and recovery

Turn business objectives from the BIA into accessible contacts, prepared response procedures and executable service cards. Reuse existing testing and incident processes.

Accountable: IT operations and business continuity ownersReviewed

Reuse existing records

Take objectives and dependencies from the BIA. Reuse existing operating procedures and restore or failover tests. Actual events, decisions and approvals remain in the existing incident record.

What to do

  1. 1

    Use business objectives and dependencies

    Use the BIA to identify which activities and ICT services are needed first during an outage. Take the approved time objectives with their start trigger, required data state, performance and capacity. Clarify shared prerequisites such as identity services, networks and external providers.

  2. 2

    Prepare executable procedures

    Define activation, decision-making authority and alternative communications. Name the services concerned directly in the plan. Prepare their recovery, safeguards, stopping criteria and approval. Test access to the emergency copy, contacts and required procedures without the unavailable IT; credentials remain at their protected authoritative location.

  3. 3

    Test and address gaps

    Check the required procedures against business objectives through suitable exercises and technical tests. Cover the services and dependencies needed. Record deviations, ownership and the next step in the existing test or task process. Update the plan when relevant changes or findings arise.

Worked example

The CRM depends on the identity service

Fictitious example: An outage makes the CRM unavailable. Recovery requires a working identity service. The BIA contains the minimum service level and time objectives.

Sequence and prerequisites
DecisionThe plan considers the identity service before the CRM that depends on it. Required procedures and responsible roles are named for both.
EvidenceBIA reference and prepared service cards or equivalent existing operating procedures.
Approve return to use
DecisionBusiness and security roles check minimum service level, data state, access and safeguards. The decision and actual results remain under the same case identifier.
EvidenceExisting test or incident record with the results and decision.

Record the result

  • Approved plan with its BIA reference, reachable owners and usable service procedures, including security and approval criteria.
  • Results of suitable exercises and tests. Open corrections and their checked completion are tracked in the existing process.

Common implementation mistakes

The plan is accessible only through the unavailable IT

Keep the required version, contacts and procedures independently usable. The emergency copy also contains the scope description needed or an extract with its version identified.

One test is treated as evidence for everything

Test the services and dependencies needed within the scope. A successful failover test replaces neither the other procedures nor business and security approval.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.30 · IKT-Bereitschaft für Business ContinuityGerman guide

    Prepared service cards connect BIA objectives with responsibilities, dependencies, recovery and planned exercises. Suitable infrastructure, competence and actual testing must still be implemented in operation.

  • A.5.29 · Informationssicherheit bei StörungenGerman guide

    The plan defines safeguards, approved alternative controls and security checks during emergency operation. Their suitability and actual application must still be verified.

  • TISAX · 5.2.8

    VDA ISA 6.0.3 · Partial overlap

    Activation, alternative communications, accessible recovery procedures and planned testing support continuity planning. Applicable protection-need additions, technical implementation, partner coordination and actual test results must still be addressed separately.

    Reference

Templates for your implementation

Related resources

Sources and further reading