Business continuity and disaster recovery policy
**Document control**
| Field | Value | |---|---| | Organization | [COMPANY NAME] | | Owner | [OWNER NAME / ROLE] | | Approver | [APPROVER NAME / ROLE] | | Version | [VERSION] | | Effective date | [YYYY-MM-DD] | | Next review | [YYYY-MM-DD] |
**Mapped controls:** SOC 2 A1.2, CC7.4; ISO/IEC 27001:2022 A.5.29, A.5.30, A.8.13, A.8.14 (educational mapping).
1. Purpose and scope [COMPANY NAME] maintains capabilities to continue or restore critical services following disruptive events. This policy applies to in-scope products, production infrastructure, supporting personnel, facilities, vendors, and information assets.
2. Policy 1. [COMPANY NAME] performs a business impact analysis at least annually and after material product or dependency changes. 2. Each critical service has an owner, dependencies, approved recovery time objective (RTO), recovery point objective (RPO), and recovery procedure. 3. Production data is backed up or replicated according to approved RPOs. Backups are encrypted, access-restricted, monitored, and periodically restored in a test. 4. Recovery architecture addresses loss of a component, availability zone, region, key vendor, and essential personnel where applicable. 5. The incident commander may activate continuity or disaster recovery plans using documented severity and decision criteria. 6. Exercises occur at least annually and include technical recovery and business communications. Findings receive owners and due dates. 7. Material changes to architecture require review of recovery documentation and assumptions.
3. Response and communications The activated plan identifies command roles, escalation paths, customer and regulator decision owners, status channels, and return-to-normal criteria. Emergency contact details are maintained outside the primary production dependency.
4. Evidence and exceptions Retain impact analyses, backup results, restore logs, exercise records, findings, and approvals. Exceptions require documented risk acceptance by [APPROVER NAME / ROLE] and an expiry date.
---
**Disclaimer:** Educational template only — not legal advice, an audit opinion, or a guarantee of compliance. Adapt with qualified counsel and your auditor or assessor. ComplianceBase is vendor-neutral and independent.