Requirement:
The cybersecurity requirements for business continuity management must include at least the following:
Sub-Controls:
3-1-3-1:
Requirement:
Ensuring the continuity of cybersecurity systems and procedures.
Control Implementation Guidelines:
- Define and document the requirements of this ECC in the cybersecurity requirements document and approve them by the representative
- Laws and regulations related to business continuity in the organization must be defined
- Include high-risk cybersecurity incidents as a rationale for activating the organization's business continuity plan
- Develop Business Continuity Management Program in the organization
- Document and approve business continuity plans, including but not limited to:
- Procedures for assessing risks that may affect the organization's business continuity
- Business Impact Analysis
- Definition of the cybersecurity systems, procedures and assets and their importance to the organization
- Cybersecurity-related systems continuity procedures, including technical requirements such as high availability, and regulatory requirements, such as the presence of a deputy that replaces the operators of cybersecurity systems when needed
- Definition of cybersecurity services and their importance to the organization and develop a plan to ensure the continuity of these services
- Review the organization's business continuity plans periodically and update them if necessary
Expected Deliverables:
- A document (such as approved policy or procedure) indicating the identification and documentation of the requirements related to this control
- Documented and approved business continuity management program for the organization
- Documented and approved business continuity plans for the organization
- Formal approval by the head of the organization or his/her deputy on such documents (e.g., via the organization's official e-mail, paper or electronic signature)
- Reports on the implementation of the organization's business continuity plans tests
- Report showing the sharing of the periodic meetings for sharing cybersecurity business continuity plans with the enterprise business continuity and involvement of stakeholders
3-1-3-2:
Requirement:
Developing response plans for cybersecurity incidents that may affect the business continuity.
Control Implementation Guidelines:
- Define and document the requirements of this ECC in the cybersecurity requirements document and approve them by the representative
- Develop the plans for cybersecurity incident response that may affect the organization's business continuity, including (but not limited to):
- An explanation of the types of accidents and their classification according to their impact on the organization's business continuity
- Roles and responsibilities for responding to cybersecurity incidents affecting the organization's business continuity
- Definition of incident response phases, including (but not limited to):
- Planning and Preparation
- Detection and Analysis
- Containment, Eradication and Recovery
- Review and Learn
- Utilizing NCA published incident response playbooks
- Include high-risk cybersecurity incidents as a rationale for activating the cybersecurity incident response plans
- Draft a report on cybersecurity incidents affecting the organization's business continuity upon the completion of the response to include (but not limited to):
- Persons involved in responding to the incident and the means of communication
- Basic information of the incident, including but not limited to:
- Date and time
- Scope of incident
- Severity Level
- Summary of the incident
- Containment and removal steps
- Current and future recommendations
- Review the response plans for cybersecurity incidents that may affect the organization's business continuity periodically and update them if necessary
Expected Deliverables:
- A document (such as approved policy or procedure) indicating the identification and documentation of the requirements related to this control
- Approved plans to respond to cybersecurity incidents that may affect the business continuity of the organization
- Formal approval by the head of the organization or his/her deputy on such documents (e.g., via the organization's official e-mail, paper or electronic signature)
3-1-3-3:
Requirement:
Developing disaster recovery plans.
Control Implementation Guidelines:
- Define and document the requirements of this ECC in the cybersecurity requirements document and approve them by the representative
- Develop disaster recovery plans, including (but not limited to):
- Identify disaster recovery team
- Identify and assess disaster risk
- Conduct Business Impact Analysis (BIA) to identify critical systems within the organization
- Define backup and external storage procedures
- Test disaster recovery plans
- Establish a disaster recovery center for critical systems
- Conduct periodic tests to ensure the effectiveness of disaster recovery plans
- Identify the requirements of periodic copies of the organization's systems to the recovery center
Expected Deliverables:
- A document (such as approved policy or procedure) indicating the identification and documentation of the requirements related to this control
- Organization-approved disaster recovery plans
- Reports on the implementation of disaster recovery plans tests at the organization
- Formal approval by the head of the organization or his/her deputy on such documents (e.g., via the organization's official e-mail, paper or electronic signature)
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you
CMMC Level 1 Compliance
Become compliant, provide compliance services, or verify partner compliance with CMMC Level 1 Basic Safeguarding of Covered Contractor Information Systems requirements.
NIST SP 800-171 & CMMC Level 2 Compliance
Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC Level 2 requirements.
HIPAA Compliance
Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
ISO 27001 Compliance
Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.
FAR 52.204-21 Compliance
Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.