ICT readiness for business continuity

What the requirement asks

ICT readiness is to be planned, put in place, kept current and tested so that it meets the continuity objectives of the business and the requirements for ICT continuity. Purpose: keep the organization's information and associated assets available during disruption. Guidance: ICT readiness is a key part of both continuity and security management, keeping objectives achievable during disruption. ICT continuity requirements come out of the business impact analysis, which uses impact types and criteria to judge how disruption to activities delivering products and services causes harm over time; the size and duration of impact identify prioritized activities, each given a recovery time objective (RTO), and then the resources those activities need, which also get RTOs and include ICT services. The analysis can be extended to set performance and capacity requirements for ICT systems and, for the information needed, recovery point objectives (RPO) for the information needed. From the impact analysis and risk assessment, the organization chooses ICT continuity strategies covering before, during and after disruption, possibly combining solutions, and builds, implements and tests plans that deliver the required ICT availability in the required time. It should ensure a suitable structure of people with the responsibility, authority and competence to get ready for disruption, limit it and react to it; ICT continuity plans with response and recovery procedures that are regularly exercised and tested and approved by management; and plans that state performance and capacity specifications from the impact analysis, the RTO of each prioritized ICT service with restoration procedures, and the RPO of prioritized information with its restoration procedures. Other information: ICT continuity lets the organization respond to and recover from ICT disruption whatever the cause, keep prioritized activities supplied with ICT, and act before disruption and once an incident that could cause one is detected; ISO/IEC 27031, ISO 22301, ISO 22313 and ISO/TS 22317 give more. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

ICT readiness is tested, not asserted. The guidance asks for the recovery objectives, the dependencies, the test, the result and the action on a failed test.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information and one live sample together.

Evidence an assessor asks for

• ICT continuityThe business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information
• ICT continuitySelected ICT continuity strategies covering before, during and after disruption
• ICT continuityManagement-approved ICT continuity plans with response and recovery procedures, capacity specifications, RTOs and RPOs
• ICT continuityExercise and test reports showing recovery achieved within RTO and RPO, with remediation of shortfalls
• ICT continuityAn ICT continuity organization chart with named roles, authority and competence records
• ICT continuityRecords of plan maintenance after changes to systems or business priorities

The question an assessor will ask

An assessor will ask for the business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information, then trace it to the system it protects. For A.5.30 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• RTOs and RPOs are set by IT without a business impact analysis
• Plans are approved but recovery has never been tested end to end
• Recovery capacity specifications do not match what prioritized activities actually need
• Cloud and third-party ICT services are left out of the continuity plans

Before the next audit

Before the next audit, check one live sample for this gap: rtos and rpos are set by it without a business impact analysis.