Sometimes an unexpected event, such as a fire, flood, or equipment failure, can cause downtime. In order to be able to continue operations as quickly and smoothly as possible, continuity planning is carried out, i.e. planning the operations in advance for these exceptional situations.
Each continuity plan shall contain at least the following information:
The organization must maintain a top-level strategy for continuity planning. The strategy should include at least:
In order to develop a strategy, it may be necessary to make use of general good practices, such as ISO 22300.
The organization should define requirements for the continuity of information security management during a crisis or disaster.
Information security management can either assume that the requirements are the same in adverse situations as in normal operating conditions, or seek to determine separately the security requirements applicable to adverse situations.