risk
Absent or untested business continuity / disaster recovery plan
No BCP/DR plan, or plans that exist but have never been exercised end-to-end, so a natural disaster, pandemic, civil unrest, or infrastructure failure disables critical processes with no tested recovery path.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- business_continuity
- domain
- Business Continuity & Disaster Recovery
- Risk Assessment & Management
- taxonomy
- enterprise-risk
- coso-erm-risk
- iso-27005-vulnerability
- inherent_rating
- high
Details
- risk_id
- bcdr-no-tested-continuity-plan
- category
- business_continuity
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- enterprise-risk
- coso-erm-risk
- iso-27005-vulnerability
Source
No record-specific source URL is provided.
Connections
- UC-BCDR-10 — Test recovery capabilities and train contingency personnel mitigates Absent or untested business continuity / disaster recovery plan
- strength
- primary
- rationale
- annual exercises, failover/restore tests, and gap remediation directly cure the untested-plan condition
- UC-BCDR-01 — Maintain business continuity and disaster recovery plans mitigates Absent or untested business continuity / disaster recovery plan
- strength
- primary
- rationale
- maintaining a documented, approved, annually-reviewed BCP/DR plan directly cures the absent-plan condition
- UC-BCDR-02 — Establish and govern an ICT operational resilience framework mitigates Absent or untested business continuity / disaster recovery plan
- strength
- related
- rationale
- the framework requires a defined resilience/recovery strategy, driving plans to exist
- UC-ASSET-12 — Operate scheduled processing, backup, and availability monitoring mitigates Absent or untested business continuity / disaster recovery plan
- strength
- related
- rationale
- periodic recovery-capability testing exercises the restore path
- UC-ACCESS-17 — Execute, monitor, and recover production processing mitigates Absent or untested business continuity / disaster recovery plan
- strength
- related
- rationale
- periodic restoration testing exercises the recovery path
- UC-RISK-18 — Categorize systems and components by impact and criticality mitigates Absent or untested business continuity / disaster recovery plan
- strength
- related
- rationale
- Criticality analysis identifies critical components, functions and dependencies, informing which processes continuity/recovery planning must prioritize.