Identifying critical functions and related assets

Critical
High
Normal
Low

The organization has a clear process, according to which it identifies the most critical functions in terms of its operations (e.g. services offered to customers), which are subject to the highest continuity requirements.

Items in the IT environment that are necessary for these activities (such as information systems, data reserves, operating processes, partners, units, hardware) are classified as critical.

Critical functions are considered with the highest priority, e.g. in continuity planning, and stricter safety requirements can be applied to them than to other objects in the environment.

Connected other frameworks and requirements:
1.1 (MIL1): Manage IT and OT Asset Inventory
C2M2
6.4 (MIL2): Address Cybersecurity in Continuity of Operations
C2M2

Identifying and testing the continuity capabilities required from ICT services

Critical
High
Normal
Low

Continuity requirements for ICT services are derived from continuity plans that are created for core processes (e.g. related to the provision of organization's products and services) and the recovery time goals included in them.

Organization must identify what recovery times and recovery points different ICT services must be able to achieve, taking into account the defined recovery goals for related processes, and ensure the ability to achieve them.

The planning must take into account in particular:

  • responsibilities are defined for preparing for, managing and responding to disruptions in ICT services
  • in particular continuity plans related to ICT services have been created, approved and are regularly tested
  • continuity plans contain information on performance requirements, recovery time requirements and recovery actions for each important ICT service, as well as recovery point requirements and restoring actions for each important ICT service
Connected other frameworks and requirements:
5.30: ICT readiness for business continuity
ISO 27001
6.4 (MIL2): Address Cybersecurity in Continuity of Operations
C2M2

Testing and reviewing continuity plans related to cyber security breaches

Critical
High
Normal
Low

The organization must test and update its response to the security breach at scheduled intervals or after significant changes. For critical parts of the organization, operational plans should be tested at least annually. Test results should be documented and communicated to improve the plan.

Connected other frameworks and requirements:
PR.IP-10: Response and recovery plan tests
NIST CSF
RS.IM-2: Response strategies update
NIST CSF
RC.IM-2: Recovery strategies
NIST CSF
6.4 (MIL2): Address Cybersecurity in Continuity of Operations
C2M2

Restoration strategy

Critical
High
Normal
Low

We have agreed and recorded policies to restore an earlier version of the software before implementing the releases.

Connected other frameworks and requirements:
12.3: Backup
ISO 27001
12.5: Control of operational software
ISO 27001
12.3.1: Information backup
ISO 27001
12.5.1: Installation of software on operational systems
ISO 27001
14.2.2: System change control procedures
ISO 27001

Preparing for quick data recovery after faults

Critical
High
Normal
Low

Restorability refers to how quickly personal data are restored to be available and accessible in the event of a physical or technical failure.

Connected other frameworks and requirements:
12.3: Backup
ISO 27001
12.3.1: Information backup
ISO 27001
17.1.2: Implementing information security continuity
ISO 27001
PR.PT-5: Mechanisms
NIST CSF
5.29: Information security during disruption
ISO 27001
No items found.