BCM-007 Alternate Processing and Communications
Description
Documented provisions exist for processing critical workloads from an alternate site or cloud region if the primary environment is unavailable. Communication channels for crisis coordination, including out-of-band contacts, are identified and tested. Dependencies on primary-site telecommunications are documented. The accessibility problems that an area-wide disruption would cause at the alternate processing and storage locations are identified, and each one carries a stated mitigation.
Rationale
A recovery plan that requires the primary site to activate is self-defeating. Alternate processing and out-of-band communication carry the plan once the primary is gone, so both have to be tested. Accessibility is the assumption that usually goes unchecked: an alternate region chosen for latency often shares a power grid, a carrier or a staffing pool with the primary, so the event that takes out one reaches the other. Naming the shared dependency is the point, whether or not it can be removed.
Applicability (9 profiles)
Framework Mappings (15)
| BCR-07 | Communication | full |
| BCR-07 | Communication | full |
| HIPAA-164.308.a.7.ii.C | Emergency Mode Operation Plan | informative |
| HIPAA-164.310.a.2.i | Contingency Operations | informative |
| 5.30 | ICT readiness for business continuity | informative |
| NIS2-Art.21.2.j | Multi-Factor Authentication and Secured Communications | informative |
| NIS2-CIR-13.1 | Supporting Utilities | informative |
| CP-11 | Alternate Communications Protocols | partial |
| CP-6(3) | Alternate Storage Site | Accessibility | full |
| CP-7 | Alternate Processing Site | full |
| CP-7(1) | Alternate Processing Site | Separation from Primary Site | full |
| CP-7(2) | Alternate Processing Site | Accessibility | full |
| CP-8 | Telecommunications Services | partial |
| SC-37 | Out-of-band Channels | partial |
| SC-47 | Alternate Communications Paths | full |
Evidence (3)
Alternate processing and communications plan documenting alternate site or cloud region provisions, out-of-band communication channels, and activation procedures.
Example: BCM Communication Plan and Alternate Processing Plan (section of the BCP or DRP, version-controlled) listing the alternate cloud region or site, activation steps, out-of-band contact numbers and channels, and dependency documentation
Test: Request the alternate processing and communications provisions within the BCP/DRP. Verify: (1) an alternate processing site or region is named and its capacity is documented; (2) out-of-band communication channels are listed with current contact information; (3) dependencies on primary-site telecommunications are documented; (4) activation procedures do not require access to primary-site systems.
Alternate processing and communication channel test record showing the alternate site or region was validated and out-of-band contacts were verified.
Example: DR exercise record or dedicated alternate processing test record showing the alternate cloud region was activated or traffic was redirected during the test, with measured failover time and confirmation of communication channel availability
Test: Request the most recent alternate processing test record. Verify: (1) a test of alternate processing capability was conducted within the last 12 months; (2) the test confirmed workloads could be operated from the alternate site or region; (3) out-of-band communication channels were verified (contacts reachable, channels accessible); (4) measured activation time was within the documented RTO.
Accessibility assessment for the alternate processing and storage locations, listing the problems an area-wide disruption would cause and the mitigation for each.
Example: Alternate location accessibility assessment, eu-west-2 and eu-central-1, 2026-06-09
Test: Request the accessibility assessment. Verify: (1) it names the disruption scenarios considered and why those are the relevant ones for the locations chosen, (2) each identified problem carries a mitigation with a named owner, (3) shared dependencies between the primary and alternate locations are stated, covering power region, network carrier, cloud availability zone and staffing pool, (4) the assessment was reviewed after the most recent change of alternate location, (5) a mitigation that depends on the primary location is identified as such.
Questions (2)
Do documented provisions exist for processing critical workloads from an alternate site or cloud region?
Alternate processing provisions must not depend on access to the primary site or primary-site telecommunications. Out-of-band channels (e.g. personal mobile numbers, separate messaging platform) should be verified annually.
Which alternate processing and communication provisions are documented and tested?
Options run from the most commonly documented to the least. Untested provisions and unverified contact lists are the usual gaps. Accessibility is the assumption least often checked: an alternate region picked for latency often shares a power grid, a carrier or a staffing pool with the primary, so the event that takes out one reaches the other.