Disaster Recovery Testing and Improvement
Certification criterion
The adequacy of the disaster recovery strategy and measures shall be tested periodically, and the recovery strategy and measures shall be supplemented to reflect changes arising from test results, information system environment changes, laws, and the like.
Key checkpoints
- To assess the effectiveness of the established IT disaster recovery framework, is a disaster recovery test plan established and implemented?
- Are the recovery strategy and measures periodically reviewed/supplemented so as to reflect changes arising from test results, information system environment changes, laws, and the like?
Detailed explanation
To assess the effectiveness of the established IT disaster recovery framework, a disaster recovery test plan shall be established/implemented.
※ Items to be included in the IT disaster recovery test plan (examples)
-
Disaster recovery test schedule (date/time and location)
-
Participating personnel
-
Scope
-
Method and scenario
-
Procedures, etc.
-
Conduct periodic testing in accordance with the test plan to check whether the recovery strategy and measures are effective, whether the members of the emergency recovery organization respond promptly in accordance with the recovery procedures, and the like
The recovery strategy and measures shall be periodically reviewed/supplemented so as to reflect changes arising from test results, information system environment changes, laws, and the like.
- Establish a formal change management procedure for the IT disaster recovery plan
- Periodically review/supplement the recovery plan by taking into account disaster recovery test results, information system environment changes, and the like
Related laws
No individual legal provision directly corresponding to this item is specified.
Evidence (examples)
- IT disaster recovery procedure document
- IT disaster recovery test plan
- IT disaster recovery test results report
Nonconformity examples
- Where disaster recovery drills were not planned/conducted, or the relevant plan and results report cannot be verified
- Where a disaster recovery drill plan was established but, without a valid reason or approval, was not carried out as planned, or the relevant results report cannot be verified
- Where a disaster recovery drill was planned and conducted but was not implemented in accordance with the procedures and forms prescribed in the relevant internal guidelines, making it difficult to regard it as a drill for evaluating the adequacy and effectiveness of the established disaster recovery procedures