ISO 27001 A.5.30: ICT readiness for business continuity

Start with a business impact analysis (BIA) to pin down the RTOs and RPOs for all critical business processes and the ICT services behind them. Identify the maximum tolerable downtime for each process and the acceptable data loss window. These numbers drive every technical decision that follows.

Design your recovery solutions to match those targets. For critical systems needing very low RTO, look at active-active or active-passive high availability with automatic failover. For moderate RTO requirements, warm standby or rapid deployment from infrastructure-as-code works well. Where longer downtime is acceptable, cold standby or backup restoration may be enough.

Get your backup strategy right. Set backup schedules based on RPO requirements and follow the 3-2-1 rule: three copies of data, on two different media types, with one copy offsite or in the cloud. Encrypt your backups and protect them from ransomware using air-gapped or immutable storage. Test restoration regularly to verify data integrity and measure actual recovery times.

Write detailed recovery procedures for each critical system. Cover system dependencies and recovery sequence, infrastructure requirements, application installation and configuration, data restoration steps, post-recovery verification, and communication procedures during the incident.

Test regularly with different exercise types. Technical recovery tests verify individual systems can be recovered within their RTOs. Integrated tests check that dependent systems recover together properly. Full DR exercises simulate realistic scenarios end to end. Document results, identify gaps, and build action plans. Test at least annually, with critical systems tested more often.