Recovery

What the baseline asks

Keep documented processes for bringing business activities back to normal, moving them off the stopgap measures put in place while a disruption lasted and after it.

What it means when the service runs in the cloud

Recovery is not only restoring service; it is restoring data, access and trust in the right order. State what must be true before the service is called recovered, and who confirms it.

Evidence an auditor or a customer asks for

• Documented restoration and return to normal processes
• Criteria for deciding that temporary measures can be withdrawn
• Evidence of use, from exercises or real events, including backlog clearance

Common gaps in a cloud estate

• Recovery treated as implicit once the incident is closed, with no process behind it
• No criteria for withdrawing temporary measures, so workarounds become permanent
• Backlog and data reconciliation built up during the workaround never planned for

Done well, what the file shows

Done well, this clause leaves a documented restoration and return to normal processes that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Write the exit criteria for recovery and the role that signs them.