Habit 18 of 18
Recover
A plan for keeping going
You know how you would keep working if your systems were down for a week.
Knowing how you would keep going for a week without your systems turns a crisis into a bad week.
Switch it on in the map Counts towards 7 articles, controls and categories
§1 How to do it
How a small firm does it
- Decide which work matters most and how long you could go without it.
- Write down how you would keep that work going: other devices, paper processes or a supplier's help.
- Say who tells staff and customers what is happening.
- Review it once a year, with the incident plan.
Evidence that shows it
- The continuity plan with priorities and a review date
Ireland: NCSC Ireland guidance on business continuity applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 1 item
-
21(2)(c) Business continuity, backups and crisis management · subset
business continuity, such as backup management and disaster recovery, and crisis management
Business continuity is named in this measure, alongside backups, disaster recovery and crisis management.
Read Art 21(2)(c) on EUR-Lex
General Data Protection Regulation 1 item
-
32(1)(b) Ongoing confidentiality, integrity and resilience · supports
the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
Article 32(1)(b) includes the resilience of systems and services.
Read Art 32(1)(b) on EUR-Lex
ISO/IEC 27001:2022 2 items
-
A.5.29 Staying secure during disruption · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control is about keeping security in place during a disruption.
About ISO/IEC 27001:2022 on ISO -
A.5.30 IT ready for business continuity · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control is about making sure IT is ready to support continuity.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 3 items
-
PR.IR Infrastructure resilience · supports
PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
A continuity plan sets out your resilience requirements. This category asks for mechanisms that meet them, such as spare equipment or a second way to work.
Read PR.IR-03 on NIST -
RC.RP Carrying out the recovery plan · supports
RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed
A continuity plan sets out which recovery actions come first.
Read RC.RP-02 on NIST -
RC.CO Recovery communication · supports
RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders
A good plan says how you would tell staff and customers during recovery.
Read RC.CO-03 on NIST
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.