Disaster Recovery Plans and Runbooks

Name: Disaster Recovery Plans and Runbooks
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Detects disaster recovery plans and operational recovery runbooks, including RTO/RPO targets, recovery procedures, failover steps, service restoration sequences, and infrastructure dependency detail used for continuity and incident recovery.

Type: regex
Confidence: medium
Confidence justification: Medium confidence: keyword-based detection requires corroborative evidence for accurate identification.
Jurisdictions: global
Regulations: SOCI Act 2018 (Cth), TIA Act 1979 (Cth)
Frameworks: CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2
Data categories: technology, security
Scope: narrow
Risk rating: 8

Should match

Disaster recovery plan — Low-tier probe - plan title without recovery targets
Disaster recovery plan: RTO four hours and RPO one hour. — Medium-tier probe - quantified recovery objectives without failover implementation
DR plan: RTO four hours, RPO one hour, with failover to the warm site and tested failback. — High-tier probe - recovery objectives plus failover and recovery-site evidence

Should not match

Disaster relief fund — Humanitarian-disaster sibling
Recovery from illness — Personal recovery prose
The public website describes why every agency needs a disaster recovery plan. — Public guidance mentions only the plan title
Template example: disaster recovery plan with RTO four hours, RPO one hour, and failover to a warm site. — Template contains otherwise high-tier evidence
unrelated generic text — No relevant phrase context (merged from companion SIT)
placeholder value 12345 — Random text should not match phrase marker (merged from companion SIT)
generic policy prose without anchors — Should reject generic mentions without structural anchor terms (merged from companion SIT)
template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present (merged from companion SIT)

Known false positives

Natural disaster or health recovery references. Mitigation: Require IT-specific terms like RTO, RPO, failover, or DR plan.