Disaster Recovery Plans and Runbooks
Identifies disaster recovery and IT continuity plans that contain populated recovery detail: numeric recovery objectives, system hosts/addresses, numbered recovery steps or recovery commands. Plan titles alone are discovery-only.
- Type
- regex
- Confidence
- medium
- Confidence justification
- Medium confidence: titles are discovery-only; enforcement requires populated objectives, hosts, steps or commands and 85 adds a second structure and failover context.
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- CIS Controls, DISP, ISO 27001, NIST CSF, SOC 2
- Data categories
- technology, security
- Scope
- narrow
- Risk rating
- 8
Should match
Disaster recovery plan - Payroll platform (v3.2) RTO: 4 hours RPO: 15 minutes Primary: pay-db01.example.internal (10.20.4.11) DR site: pay-db01-dr.example.internal (10.60.4.11) Step 1: Confirm replication lag on the standby is under 15 minutes. Step 2: Promote the standby and repoint DNS for payroll.example.internal.— High tier (85) - RTO/RPO values, hosts and numbered steps with DR site/replication contextIT recovery procedure for the records system: RTO 8 hours, restore order agreed with the business owner.— Medium tier (75) - recovery objective value onlyDR runbook for the GIS server: Step 1: stop the map tile cache before restoring the database.— Medium tier (75) - numbered recovery step onlyThe disaster recovery plan is due for its annual review in March.— Discovery tier (65) - plan title only
Should not match
Policy statement: every business unit should maintain a disaster recovery plan that sets an RTO and RPO for each critical system.— Policy text without valuesDisaster recovery plan template System: ________ RTO: ____ hours RPO: ____ minutes DR site: ________— Blank templateTraining course exercise: participants draft a DR plan for a made-up shop with an RTO of 4 hours.— Training framing with an objective value must not enforceNews report: the airline said its disaster recovery plan worked as intended after the data centre fire.— News framing
Known false positives
- Natural disaster, economic or health recovery plans and business continuity guidance. Mitigation: Primary requires disaster recovery / DR / IT or system recovery wording; enforcement needs populated RTO/RPO values, hosts, steps or commands, and guidance/training/news/template framing is excluded.