Requirement
The entity tests recovery plan procedures supporting system recovery to meet its objectives.
Points of Focus
Implements Business Continuity Plan Testing
Requirement: Business continuity plan testing is performed on a periodic basis to test the entity’s ability to respond to, recover from, and resume operations through significant disruptions. Testing includes (1) development of testing scenarios based on threat likelihood and magnitude; (2) consideration of system components from across the entity and vendors that can impair availability; (3) scenarios that consider the potential for the lack of availability of key personnel or vendors; and (4) revision of continuity plans and systems based on test results.
Tests Integrity and Completeness of Backup Data
Requirement: The integrity and completeness of backup information is tested on a periodic basis.
Explanation
A recovery plan only counts if it has been proven to work. This criterion requires periodic testing of business continuity procedures and of backup data integrity and completeness. Auditors ask for test scenarios, results, and evidence that plans were revised after tests exposed gaps.
