The organization should plan, implement, maintain, and test ICT readiness aligned with business continuity objectives and ICT continuity requirements. This is done to guarantee the availability of the organization's information and other associated assets during disruptions. ICT continuity plans, including response and recovery procedures, should be regularly evaluated and approved by management.
Continuity requirements for ICT services are derived from continuity plans that are created for core processes (e.g. related to the provision of organization's products and services) and the recovery time goals included in them.
Organization must identify what recovery times and recovery points different ICT services must be able to achieve, taking into account the defined recovery goals for related processes, and ensure the ability to achieve them.
The planning must take into account in particular: