Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Creating and documenting continuity plans

Critical
High
Normal
Low

Sometimes an unexpected event, such as a fire, flood, or equipment failure, can cause downtime. In order to be able to continue operations as quickly and smoothly as possible, continuity planning is carried out, i.e. planning the operations in advance for these exceptional situations.

Each continuity plan shall contain at least the following information:

  • Event for which the plan has been made
  • Goal for recovery time
  • Responsible persons and related stakeholders and contact information
  • Planned immediate actions
  • Planned recovery steps
Connected other frameworks and requirements:
T05: Jatkuvuuden hallinta
17.1.2: Implementing information security continuity
ISO 27001
ID.SC-5: Response and recovery
NIST CSF
PR.IP-9: Response and recovery plans
NIST CSF
RC.RP-1: Recovery plan
NIST CSF

Documentation of linked risks for identified security incidents

Critical
High
Normal
Low

Organization assesses cyber security risks by responding to situations where security has been mildly or severely compromised. The documentation shall include at least the following:

  • Description of the incident
  • Risks associated with the incident
  • New tasks introduced as a result of the incident
  • Other measures taken due to the incident
Connected other frameworks and requirements:
5. Principles relating to processing of personal data
GDPR
24. Responsibility of the controller
GDPR
T05: Jatkuvuuden hallinta
No items found.