BCM-002 Disaster Recovery Plan
Description
A documented Disaster Recovery Plan (DRP) defines the procedures for recovering IT systems and services after a significant disruptive event. The DRP specifies recovery sequences, responsible roles, and technical procedures for restoring from backups or failover infrastructure. It is reviewed and updated at least annually.
Rationale
A BCP covers the business response to disruption; the DRP covers the technical restoration of systems. Both are required and serve distinct purposes.
Framework Mappings (4)
| BCR-09 | Disaster Response Plan | full |
| 5.30 | ICT readiness for business continuity | partial |
| CP-10 | System Recovery and Reconstitution | full |
| A1.2 | Environmental Protections, Software, Data Back-Up Processes, and Recovery Infrastructure | partial |
Evidence (2)
Documented Disaster Recovery Plan defining recovery sequences, responsible roles, and technical restoration procedures for critical IT systems and services.
Example: Disaster Recovery Plan document (version-controlled, approved within last 12 months) including system recovery runbooks, failover procedures, and backup restoration steps for each critical service
Test: Request the current DRP. Verify: (1) recovery procedures are defined for each critical system; (2) roles and responsibilities are named with current contact information; (3) the plan references technical restoration procedures (backup locations, failover targets, recovery commands); (4) the document has been reviewed and approved within the last 12 months.
DRP review record showing the plan was formally updated following the last DR test or annual review cycle.
Example: DRP version history or change log showing last update date, reason for update, and approver sign-off — particularly confirming updates made after the most recent DR test
Test: Request the DRP version history and most recent review record. Verify: (1) the DRP was reviewed within the last 12 months; (2) lessons from the most recent DR test are reflected in the current version; (3) a named approver signed off the current version.
Questions (2)
Does your organisation have a documented Disaster Recovery Plan (DRP) that defines recovery sequences, responsible roles, and technical restoration procedures for critical IT systems and services?
The DRP is distinct from the BCP — it should contain specific technical runbooks for recovering each critical system from backup or failover infrastructure.
What does the Disaster Recovery Plan include?
All six elements are expected in a production-grade DRP. A plan containing only high-level guidance without specific recovery procedures is insufficient for audit purposes.