NIST Privacy Framework, Protect-PPR.PO-P8

Establish and maintain an enterprise disaster recovery program, and validate it against severe but plausible scenarios that test your backup and recovery capabilities and critical third-party technologies and integration points.

Develop, manage and test ICT business-continuity policies and ICT response and recovery plans as part of your business continuity plan, in line with DORA Article 11 (Section 82^4(2)).

Include in the ICT business continuity policy the objectives, scope, timeframe, activation and deactivation criteria, governance and recovery objectives set out in Article 24(1). If you are a central counterparty, set a maximum recovery time for your critical functions of not longer than 2 hours. If you are a central securities depository, ensure a recovery time objective of not longer than 2 hours for your critical or important functions. If you are a trading venue, ensure that trading can be resumed within or close to 2 hours of a disruptive incident and that the maximum amount of data lost is close to zero (Article 24(2) to (4)). Test the plans on scenarios that simulate potential disruptions, including severe but plausible scenarios, include the ICT services provided by ICT third-party service providers where applicable, document the results, and report identified deficiencies to the management body (Article 25).

If you are an entity referred to in Article 16(1) of Regulation (EU) 2022/2554, apply the simplified framework of Title III: have an internal governance and control framework with the management body responsibilities set out in Article 28, and meet Articles 29 to 41 on the information security policy, the classification of assets, ICT risk management, physical and environmental security, access control, ICT operations security, data, system and network security, ICT security testing, acquisition, development and maintenance, project and change management, the business continuity plan and the review report. Test your business continuity plans at least once every year for the back-up and restore procedures, or upon every major change of the plan (Article 40).

Put in place a comprehensive ICT business continuity policy and ICT response and recovery plans, and conduct a business impact analysis of your exposures to severe business disruptions. Test the continuity and the response and recovery plans at least yearly and on substantive changes to systems supporting critical or important functions, and test your crisis communication plans. Keep readily accessible records of activities before and during disruption events. Unless you are a microenterprise, include cyber-attack and switchover scenarios in the tests, have a crisis management function, and report to your competent authority on request an estimate of the aggregated annual costs and losses caused by major ICT-related incidents (Article 11).

As a credit institution or investment firm, have contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, established, managed and tested in accordance with Article 11 of the DORA Regulation (regulation 4).

If you are a CRR institution in Luxembourg, keep adequate contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, and establish, manage and test them in accordance with Article 11 of the DORA Regulation (Loi du 1er juillet 2024, Article 5).

The Department says you should consider whether your logging and security event alerting capabilities are sufficient to address heightened threats, and review and test your threat-relevant operational resilience procedures, which may require more frequent use as AI-enabled cyber capabilities evolve.

The Department says you should consider testing the integrity, immutability and restorability of backups, including validation of recovery time objectives, and reviewing and testing threat-relevant operational resilience procedures, such as incident response and business continuity plans, to protect and restore critical functions, information systems and nonpublic information.

Test your incident response and business continuity and disaster recovery plans with all staff and management critical to the response, and your ability to restore critical data and information systems from backups, periodically and at least annually, and revise the plans as necessary.