This requirement exists to assign, monitor, verify, and close corrective actions arising from BCDR tests and exercises and to ensure BCDR capabilities remain aligned with business needs, recovery objectives, and organizational risk.
Establish and document the process for assign, monitor, verify, and close corrective actions arising from BCDR tests and exercises. Define accountable owners, required inputs and outputs, approval or validation points, criteria and thresholds, review frequency, exception handling, monitoring, reporting, and evidence requirements. Integrate the activity with risk management, incident response, technology operations, asset management, third-party management, and relevant business processes.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.04 – Exercise, test and review the business continuity plan (BCP) 4.3 – Build, Acquire and Implement (BAI) > BAI04 – Managed Availability and Capacity > BAI04.05 – Investigate and address availability, performance and |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 11(6)(a) – Annual testing of ICT business continuity and response/recovery plans Article 11(6)(b) – Testing of crisis communication plans Article 24(1) – Digital operational resilience testing programme |
EU
Regulation
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.13-3.3.4 – Review of BCP; §2.13-3.3.3 – Testing of BCP |
India
Guideline
|
vLatest | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 8.1 – Operational planning and control; 8.4.4 – Business continuity plans |
ISO
Standard
|
v2019 | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 10.2 – Nonconformity and corrective action |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(c) – Business continuity, including backup management, disaster recovery and crisis management |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.IR – Technology Infrastructure Resilience | PR.IR-03 – Mechanisms are implemented to achieve resilience requirements in normal and adverse situations RC.RP – Incident Recovery Plan Execution | RC.RP-01 – The recovery portion of the incident response plan is executed once initiated from the incident response process RC.RP – Incident Recovery Plan Execution | RC.RP-02 – Recovery actions are selected, scoped, prioritized, and performed |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.6 – CONTINGENCY PLANNING; CP-4 – CONTINGENCY PLAN TESTING |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Business Continuity Plan (BCP) |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.10.1 – An incident response plan exists and is |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 19) Incident Response & Management – 19.5 Resilience capabilities and coordinated testing across interconnected systems, vendors and partners; 19) Incident Response & Management – 19.6 Crisis communications, reputation management and capacity planning in resilience testing |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 6.1 RC.RP: Incident Recovery Plan Execution; 6.3 RC.IM: Improvements |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: A1.3 – Availability – The entity tests recovery plan procedures supporting system recovery to meet its objectives. CC9.1 – Risk Mitigation – The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions. CC4.2 – Monitoring of Controls – COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. |
AICPA
Audit Framework
|
vLatest | View → |