Establishes the processes for ensuring business continuity and IT disaster recovery capabilities, enabling resilience to disruptions.
Focuses on the planning, testing, and execution of BCDR strategies to ensure business resilience. Includes Business Impact Analysis (BIA), RTO/RPO setting, and recovery plan testing.
The increasing reliance on cloud and third-party services makes it harder to test and validate recovery capabilities, while ransomware poses new challenges to traditional BCDR.
| Control ID | Control Name | Category & Type | Criticality | Status | Requirements | Action |
|---|---|---|---|---|---|---|
| BCM-001 | Business Continuity & Disaster Recovery (BCDR) Program Establishes BCDR program including gover... |
Operational
Preventive
|
Critical | Active | 📋 10 Reqs | View → |
| BCM-002 | Business Continuity & Disaster Recovery Planning Establishes BCDR planning including busi... |
Operational
Preventive
|
Critical | Active | 📋 10 Reqs | View → |
| BCM-003 | Business Impact Analysis (BIA) Establishes BIA including critical proce... |
Operational
Detective
|
High | Active | 📋 10 Reqs | View → |
| BCM-004 | BCDR Testing & Exercising Establishes BCDR testing including table... |
Operational
Detective
|
High | Active | 📋 10 Reqs | View → |
| BCM-005 | Backup & Recovery Management Establishes backup and recovery includin... |
Operational
Corrective
|
Critical | Active | 📋 10 Reqs | View → |
| BCM-006 | Recovery Infrastructure Management Establishes recovery infrastructure incl... |
Operational
Corrective
|
Critical | Active | 📋 10 Reqs | View → |
The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.
| REQUIREMENT ID | REQUIREMENT TITLE & DETAILS | MAPPED CONTROL | TYPICAL OWNER | ACTION |
|---|---|---|---|---|
| BCM-001-R001 | BCDR Governance Framework The organization shall establish a Busin... | BCM-001 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, CISO, Executive Management | View ↗ |
| BCM-001-R002 | Program Scope The organization shall define a document... | BCM-001 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, CISO, Executive Management | View ↗ |
| BCM-001-R003 | Roles & Responsibilities The organization shall clearly define an... | BCM-001 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, CISO, Executive Management | View ↗ |
| BCM-001-R004 | BCDR Policy The organization shall establish a BCDR... | BCM-001 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, CISO, Executive Management | View ↗ |
| BCM-001-R005 | Program Resources The organization shall ensure the BCDR p... | BCM-001 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, CISO, Executive Management | View ↗ |
| BCM-001-R006 | Program Monitoring The organization shall monitor BCDR prog... | BCM-001 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, CISO, Executive Management | View ↗ |
| BCM-001-R007 | Executive Reporting The organization shall provide executive... | BCM-001 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, CISO, Executive Management | View ↗ |
| BCM-001-R008 | Program Review The organization shall conduct periodic... | BCM-001 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, CISO, Executive Management | View ↗ |
| BCM-001-R009 | Program Metrics The organization shall define and track... | BCM-001 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, CISO, Executive Management | View ↗ |
| BCM-001-R010 | Continuous Improvement The organization shall establish a conti... | BCM-001 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, CISO, Executive Management | View ↗ |
| BCM-002-R001 | Planning Framework The organization shall establish a BCDR... | BCM-002 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, IT Operations, Business Owners | View ↗ |
| BCM-002-R002 | Business Continuity Plan The organization shall develop a compreh... | BCM-002 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, IT Operations, Business Owners | View ↗ |
| BCM-002-R003 | Disaster Recovery Plan The organization shall develop a compreh... | BCM-002 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, IT Operations, Business Owners | View ↗ |
| BCM-002-R004 | Recovery Procedures The organization shall develop and maint... | BCM-002 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, IT Operations, Business Owners | View ↗ |
| BCM-002-R005 | Plan Approval The organization shall approve BCDR plan... | BCM-002 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, IT Operations, Business Owners | View ↗ |
| BCM-002-R006 | Plan Distribution The organization shall distribute BCDR p... | BCM-002 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, IT Operations, Business Owners | View ↗ |
| BCM-002-R007 | Plan Maintenance The organization shall maintain BCDR pla... | BCM-002 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, IT Operations, Business Owners | View ↗ |
| BCM-002-R008 | Plan Review The organization shall conduct periodic... | BCM-002 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, IT Operations, Business Owners | View ↗ |
| BCM-002-R009 | Plan Accessibility The organization shall ensure BCDR plans... | BCM-002 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, IT Operations, Business Owners | View ↗ |
| BCM-002-R010 | Continuous Improvement The organization shall establish a conti... | BCM-002 Business Continuity & Disaster... | Business Continuity, Disaster Recovery, IT Operations, Business Owners | View ↗ |
| BCM-003-R001 | BIA Framework The organization shall establish a Busin... | BCM-003 Business Impact Analysis (BIA) | Business Continuity, Business Owners, Risk Management, IT Recovery | View ↗ |
| BCM-003-R002 | Critical Business Process Identification The organization shall identify critical... | BCM-003 Business Impact Analysis (BIA) | Business Continuity, Business Owners, Risk Management, IT Recovery | View ↗ |
| BCM-003-R003 | Dependency Analysis The organization shall conduct dependenc... | BCM-003 Business Impact Analysis (BIA) | Business Continuity, Business Owners, Risk Management, IT Recovery | View ↗ |
| BCM-003-R004 | Business Impact Assessment The organization shall conduct business... | BCM-003 Business Impact Analysis (BIA) | Business Continuity, Business Owners, Risk Management, IT Recovery | View ↗ |
| BCM-003-R005 | Recovery Time Objectives (RTO) The organization shall define Recovery T... | BCM-003 Business Impact Analysis (BIA) | Business Continuity, Business Owners, Risk Management, IT Recovery | View ↗ |
| BCM-003-R006 | Recovery Point Objectives (RPO) The organization shall define Recovery P... | BCM-003 Business Impact Analysis (BIA) | Business Continuity, Business Owners, Risk Management, IT Recovery | View ↗ |
| BCM-003-R007 | Recovery Prioritization The organization shall establish recover... | BCM-003 Business Impact Analysis (BIA) | Business Continuity, Business Owners, Risk Management, IT Recovery | View ↗ |
| BCM-003-R008 | BIA Reporting The organization shall report on BIA res... | BCM-003 Business Impact Analysis (BIA) | Business Continuity, Business Owners, Risk Management, IT Recovery | View ↗ |
| BCM-003-R009 | BIA Review The organization shall conduct periodic... | BCM-003 Business Impact Analysis (BIA) | Business Continuity, Business Owners, Risk Management, IT Recovery | View ↗ |
| BCM-003-R010 | Continuous Improvement The organization shall establish a conti... | BCM-003 Business Impact Analysis (BIA) | Business Continuity, Business Owners, Risk Management, IT Recovery | View ↗ |
| BCM-004-R001 | Exercise Framework The organization shall establish a BCDR... | BCM-004 BCDR Testing & Exercising | Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator | View ↗ |
| BCM-004-R002 | Tabletop Exercises The organization shall conduct regular t... | BCM-004 BCDR Testing & Exercising | Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator | View ↗ |
| BCM-004-R003 | Technical Recovery Testing The organization shall conduct technical... | BCM-004 BCDR Testing & Exercising | Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator | View ↗ |
| BCM-004-R004 | Disaster Recovery Exercises The organization shall conduct full disa... | BCM-004 BCDR Testing & Exercising | Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator | View ↗ |
| BCM-004-R005 | Business Continuity Exercises The organization shall conduct business... | BCM-004 BCDR Testing & Exercising | Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator | View ↗ |
| BCM-004-R006 | Test Result Validation The organization shall validate BCDR tes... | BCM-004 BCDR Testing & Exercising | Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator | View ↗ |
| BCM-004-R007 | Lessons Learned The organization shall capture and docum... | BCM-004 BCDR Testing & Exercising | Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator | View ↗ |
| BCM-004-R008 | Corrective Action Tracking The organization shall track corrective... | BCM-004 BCDR Testing & Exercising | Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator | View ↗ |
| BCM-004-R009 | Exercise Review The organization shall conduct periodic... | BCM-004 BCDR Testing & Exercising | Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator | View ↗ |
| BCM-004-R010 | Continuous Improvement The organization shall establish a conti... | BCM-004 BCDR Testing & Exercising | Business Continuity, Disaster Recovery, IT Operations, Exercise Coordinator | View ↗ |
| BCM-005-R001 | Backup Strategy The organization shall establish a backu... | BCM-005 Backup & Recovery Management | Backup Administration, IT Operations, Storage Engineering, Disaster Recovery | View ↗ |
| BCM-005-R002 | Backup Scheduling The organization shall establish backup... | BCM-005 Backup & Recovery Management | Backup Administration, IT Operations, Storage Engineering, Disaster Recovery | View ↗ |
| BCM-005-R003 | Backup Protection The organization shall implement protect... | BCM-005 Backup & Recovery Management | Backup Administration, IT Operations, Storage Engineering, Disaster Recovery | View ↗ |
| BCM-005-R004 | Backup Retention The organization shall establish backup... | BCM-005 Backup & Recovery Management | Backup Administration, IT Operations, Storage Engineering, Disaster Recovery | View ↗ |
| BCM-005-R005 | Backup Verification The organization shall verify that backu... | BCM-005 Backup & Recovery Management | Backup Administration, IT Operations, Storage Engineering, Disaster Recovery | View ↗ |
| BCM-005-R006 | Recovery Testing The organization shall conduct regular r... | BCM-005 Backup & Recovery Management | Backup Administration, IT Operations, Storage Engineering, Disaster Recovery | View ↗ |
| BCM-005-R007 | Data Restoration The organization shall restore data from... | BCM-005 Backup & Recovery Management | Backup Administration, IT Operations, Storage Engineering, Disaster Recovery | View ↗ |
| BCM-005-R008 | Recovery Reporting The organization shall report on backup... | BCM-005 Backup & Recovery Management | Backup Administration, IT Operations, Storage Engineering, Disaster Recovery | View ↗ |
| BCM-005-R009 | Recovery Review The organization shall conduct periodic... | BCM-005 Backup & Recovery Management | Backup Administration, IT Operations, Storage Engineering, Disaster Recovery | View ↗ |
| BCM-005-R010 | Continuous Improvement The organization shall establish a conti... | BCM-005 Backup & Recovery Management | Backup Administration, IT Operations, Storage Engineering, Disaster Recovery | View ↗ |
| BCM-006-R001 | Recovery Infrastructure Framework The organization shall establish a recov... | BCM-006 Recovery Infrastructure Manage... | Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities | View ↗ |
| BCM-006-R002 | Alternate Processing Site The organization shall establish an alte... | BCM-006 Recovery Infrastructure Manage... | Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities | View ↗ |
| BCM-006-R003 | Alternate Storage Site The organization shall establish an alte... | BCM-006 Recovery Infrastructure Manage... | Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities | View ↗ |
| BCM-006-R004 | Failover Capability The organization shall implement failove... | BCM-006 Recovery Infrastructure Manage... | Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities | View ↗ |
| BCM-006-R005 | High Availability The organization shall implement high av... | BCM-006 Recovery Infrastructure Manage... | Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities | View ↗ |
| BCM-006-R006 | Recovery Resources The organization shall ensure the necess... | BCM-006 Recovery Infrastructure Manage... | Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities | View ↗ |
| BCM-006-R007 | Infrastructure Validation The organization shall validate that rec... | BCM-006 Recovery Infrastructure Manage... | Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities | View ↗ |
| BCM-006-R008 | Recovery Monitoring The organization shall monitor recovery... | BCM-006 Recovery Infrastructure Manage... | Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities | View ↗ |
| BCM-006-R009 | Recovery Review The organization shall conduct periodic... | BCM-006 Recovery Infrastructure Manage... | Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities | View ↗ |
| BCM-006-R010 | Continuous Improvement The organization shall establish a conti... | BCM-006 Recovery Infrastructure Manage... | Disaster Recovery, Infrastructure Engineering, IT Operations, Facilities | View ↗ |
| Framework Code | Framework Name & Description | Family / Category | Version | Action |
|---|---|---|---|---|
| MAPPED | ISO 22301 Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | NIST SP 800-34 Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | NFPA 1600 Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| NIST-CSF | NIST CSF (RC) The NIST Cybersecurity Framework provide... |
NIST
Framework
|
v2 | View → |
| COBIT2019 | COBIT (APO13) COBIT is an enterprise governance and ma... |
COBIT
Governance Framework
|
v2019 | View → |
| MAPPED | FFIEC BCP Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| DORA | DORA The EU Digital Operational Resilience Ac... |
EU
Regulation
|
vCurrent | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard... |
PCI
Standard
|
v4 | View → |