EDUCATION, CONTINUITY, RECOVERY

💾 Continuity, backup and emergency recovery (DR)

Six topics on how an organisation experiences interference - from backup to full business continuity - by international practice (ISO 22301, ISO/IEC 27031, NIST SP 800-34). Figures and deadlines are illustrative, for training.

Basic concepts and scope

Backup - IT recovery - business continuity

Repetition of continuity disciplines Three concentric areas: a backup is part of an emergency recovery, which is part of business continuity; each has its own question and scale. Three disciplines, one goal - to survive the disturbance Each layer includes the internal but addresses the wider issue Business continuity (BCP), whole organisation People, processes, premises, suppliers, communication, IT Emergency recovery (DR), IT systems Servers, network, applications, data centres, cloud Backup, Data Copies of data from which to restore Copy does not recover until it is verified with renewal 3-2, non-replaceable, encrypted BCP: does business work? DR: Are the systems returning? Copy: is the data? ISO 22301 (BCP), ISO/IEC 27031 + NIST SP 800-34 (IT DR), ISO 27002 8.13

RFMOS is the maximum permissible loss of data, RTO - maximum permissible standstill time. Backup answers to "whether data is" - DR - "or systems return," BCP - "or business continues to work." Copies without recovery plan and plan without verified copies fail in real trouble.

In practice

Common Language of Management and IT: When it comes to data, when about systems and when about the whole business. Do not confuse layers - each one has its own responsibility and budget.

Reference

ISO 22301:2019 (BCMS), ISO/IEC 27031 (IRBC), NIST SP 800-34 Rev. 1, ISO/IEC 27002:2022 (8.13, 8.14, 5.29, 5.30).

Safety Note

The most common error - "we have backups, so we are protected." A copy without a regular renewal test is an assumption, not a guarantee.

Recovery objectives and business impact analysis

RPO ← incident → RTO, and where they are determined by BIA

RFMO and RTO around moment of incident Time axis with incident in the center; left RFMO to last copy (loss of data), right RTO to restored operation; below it MTPD and business impact analysis steps. Recovery targets around the moment of incident RFMO looking back (how data disappears), RTO looking forward (how long stands) Incident t = 0 Last copy RFMO: data loss Operation restored RTO: idle time MTPD margin (WRT) after MTPD - harm becomes irreversible uncommon copies = greater RFMO Business impact analysis (BIA) allocates each process to its RTO and RFMO 1. Map processes critical activities and their dependence 2. Assessing impacts during (financial, reputation, (legal, security) 3. Determines MTPD permissible disturbance window 4. Deviates RTO/RPO targets < MTPD; manage strategy ISO 22301 8.2 (BIA), NIST SP 800-34 Rev. 1 (3.2 BIA), RTO/RPO/MTPD/WRT

RTO and RFMO are not IT choices, but business decisions from BIA. Lower RTO/RPO costs more - therefore, targets are determined by the decline of the process, not by everyone alike.

In practice

RFMOs determine how often copies should be made; RTO determines how fast recovery should be. Both together choose DR strategy and its cost.

Reference

ISO 22301:2019 (8.2.2 business impact analysis), NIST SP 800-34 Rev. 1, ISO/IEC 27031 (in the context of RTO/RPO IT).

Safety Note

"Nule" RTO and RFMO are theoretically attractive, but rarely economical. Set fair goals and test them - promised, but unachieved RTO is more dangerous than honest.

Copies strategy and sustainability

regulation 3-2-1-1-0, copy types and non-variability

3-2-1-1-0 spare copy rule and copy types Five elements of Regulation 3-2-1-1-0 above; below which three copy types (full, incremental, differential) and non-replaceable copy explanation. 3-2-1-1-0 rule and copy types Classic 3-2-1 expanded against extortion virus and erroneous copy 3 copies original + 2 backups 2 media types disc, tape, cloud 1 off-site other object/region 1 unchangeable copy air gap, WORM 0 error restoring screened Copies types - compromise between copying speed and renewal speed Full - All data each time - Slowest copying, biggest place - Fastest, easiest restoration Base for all other copies Incremental - Changes since last copy - Fastest copy, the smallest place - Restores the entire chain in sequence One chain gap = risk Differential - Changes since last complete - Medium place, growing to full - Update: full + one difference Compromise between the two Unchangeable copy (immutable / WORM) and air gap A copy which cannot be changed or deleted for a specified period - even with the rights of the administrator. The encryptor only encrypts the reachable data - a non-replaceable or offline copy remains. GFS and PITR shall be supplemented. ISO/IEC 27002:2022 8.13 (information reserve copying), NIST SP 800-34, CISA #StopRansomware

3-2-1 is a minimum; an additional fixed and offline copy (1) and verified renewal (0) is a modern response to the spying virus that targets directly on backup copies.

In practice

Practical checklist copy for architecture: how many copies, to whom, where, how isolated and or checked. The choice of types balances the copying window against the speed of renewal.

Reference

ISO/IEC 27002:2022 8.13, NIST SP 800-34 Rev. 1, CISA #StopRansomware (constant, offline copies), US-CERT 3-2-1 principle.

Safety Note

If backup copies are reachable from the same network with the same rights, the ejector viruses shall also destroy them. At least one copy shall be isolated and non-replaceable.

Emergency recovery strategies

Spectrum - less RTO/RPO, higher costs

Spectrum of emergency recovery strategies Four strategies from cheap backup copying and renewal to expensive active-active configuration; rising costs, falling right in RTO and RFMO. Spectrum of DR strategies Choose by BIA - for each process as much as required by its RTO/RPO Smaller RTO / RFMO (faster recovery) → Costs → Backup & Restore copy and restore RTO hours-days Pilot Light critical nucleus ready, scale as necessary Warm Standby reduced copy in anticipation Active-Active full duplication, RTO/RPO close to zero Cheap Strategies Updates from copies when needed - low costs, but will last for RTO and more data loss (RPO). Applies to non-critical processes with long MTPD. NIST SP 800-34 Rev. 1 (rezerves vietas: cold/warm/hot), ISO/IEC 27031, nozares DR spektrs

There is no one-size-fits-all strategy - it is active for a critical payment process, it is enough for the archive to copy-and-renew. Often within one organization there are several.

In practice

Helps to choose recovery architecture after budget and criticalness - from cheap copy-and-renew approaches to full duplication, each process according to BIA.

Reference

NIST SP 800-34 Rev.1 (cold / warm / hot site reserves), ISO/IEC 27031, models for cloud DR (Pilot Light, Warm Standby, Active-Active).

Safety Note

The hot reserve and active-active replicate the attack or damage immediately. Synchronous replication is not a back-up copy - a separate, time-shifted copy is also required.

Life Cycle of Continuity Management

ISO 22301 BCMS - and how it is checked

Life cycle of business continuity management Five steps in a cycle with a reversible loop from analysis to maintenance; below these types of tests from table exercise to full shift. BCMS life cycle (ISO 22301, PDCA) Continuous - findings of inspections return to plan Analysis BIA + risk evaluation RTO/RPO/MTPD 2. Strategy choose solutions DR, Reserve, Resources to MBCO Plan 3 BCP, DRP, roles procedures, contacts escalation 4. Verification exercises and tests proven by RTO/RPO 5. Maintenance review, update after change audit training → better plan Types of checks - from cheap discussion to real switchover Table Exercise scenario discussion low risk, fast Walking practice testing of steps no impact of production Parallel test reserve works alongside production intact Full changeover real failover highest assurance ISO 22301:2019 (8.5 exercise programme), ISO 22313, NIST SP 800-84 (test guideline) An untested plan is not a plan - it is a hypothesis

The cycle is continuous: each change in infrastructure, personal or processes can aging the plan. Regular inspections are the only way to know that RTO/RPO is realistic.

In practice

Arrange the continuity work over a cycle that can be audited and certified (ISO 22301). Checks can start cheap (table exercise) and gradually reach a real changeover (failover).

Reference

ISO 22301:2019 (BBCMS requirements), ISO 22313:2020 (guidelines), NIST SP 800-34, NIST SP 800-84 (testing and exercises).

Safety Note

A plan stored on the internal network only may not be available during an incident. Critical procedures and contacts shall also be kept offline.

Standards, frameworks and compliance

ISO 22301 to NIS2 and DORA

Landscape of standards of continuity and recovery Six standard and framework groups in two rows: international ISO, NIST, ISO 27002 controls, EU compliance, industry and plan types. Standard landscape Management system + technical readiness + control + compliance ISO (continuousity) ISO 22301:2019 BCMS requirements (certified) ISO 22313:2020 implementation guidelines ISO/IEC 27031 ICT readiness (IRBC) NIST SP 800-34 Rev.1 reserve planning, BIA SP 800-84 test and exercise program CSF 2.0 Recover funkcija ISO 27002 controls 8.13, backup 8.14, backup processing 5.29 safety during disruption 5.30 ICT Continuity links security to continuity EU / LV eligibility NIS2 21 p. (2)(c) continuity, reserves, crisis national measures National Cyber Security Act (LV) GDPR 32. renewal of availability Sector DORA (ES) financial ICT resilience SOC 2 (availability) service criterion BCI Good Practice sectoral methodology NIST BCP business continuity DRP IT emergency recovery ISCP system emergency plan COOP continuation Crisis Communications ISO 22301/22313/27031, NIST SP 800-34/800-84, ISO 27002 8.13/8.14/5.29/5.30, NIS2, DORA

Standards complement each other and not compete: ISO 22301 gives management systems, NIST SP 800-34 technical methodologies, ISO 27002 specific control, NIS2 and DORA legal obligations.

In practice

Map to search for requirements and methodology: for management of ISO 22301, for technical implementation of NIST SP 800-34, for controls of ISO 27002, for compliance with NIS2 and DORA.

Reference

ISO 22301:2019, ISO 22313:2020, ISO/IEC 27031, NIST SP 800-34/800-84, ISO/IEC 27002:2022, NIS2, DORA, national legislation.

Safety Note

Article 21 (2) (c) of the NIS2 makes continuity and reserve management a legal obligation for essential and important entities, not only good practice.

Abbreviations

All abbreviations used in the guide (original and meaning).

BCP
Business Continuity Plan - business continuity plan.
BCMS
Business Continuity Management System - Continuity Management System (ISO 22301).
DR / DRP
Disaster Recovery (Plan) - emergency recovery and its plan (IT systems).
BIA
Business Impact Analysis - Business Impact Analysis.
RTO
Recovery Time Objective - the permissible restoration time.
RPO
Recovery Point Objective - permissible amount of data loss during time.
MTPD / MAO
Maximum Tolerable Period of Disruption / Maximum Acceptable Outage - maximum permissible interference window.
WRT
Work Recovery Time - time to restore data and work after starting systems.
MBCO
Minimum Business Continuity Objective - minimum acceptable service level during the event.
3-2-1
3 copies, 2 media types, 1 out of the space (extended: +1 invariable, +0 error).
GFS
Grandfather-Father-Son - copy rotation (month/week/day).
PITR
Point-In-Time Recovery - renewal at any point through transaction logs.
WORM
Write Once Read Many - one-time writing, multiple-reading (invariable copy).
air gap
Physically or logically isolated copy without network connection.
cold/warm/hot site
Cold, warm and hot spare space - increasing readiness and costs (NIST).
Pilot Light
DR strategy - critical core ready, the rest measured as needed.
Warm Standby
DR strategy - reduced but working system copy ready.
Active-Active
DR Strategy - full duplication where both parties serve the work (RTO/RPO close to zero).
COOP
Continuity of Operations Plan (NIST).
ISCP
Information System Contingency Plan - Information System Emergency Plan (NIST).
IRBC
ICT readiness for business continuity (ISO/IEC 27031).
PDCA
Plan-Do-Check-Act - continuous improvement cycle.
CSF
Cybersecurity Framework - NIST cybersecurity framework (Recover function).
NIS2
Network and Information Security Directive 2.
DORA
Digital Operational Resilience Act - EU Financial Sector Resilience Regulation.
GDPR
General Data Protection Regulation - General Data Protection Regulation (32th p. - availability).
ISO 22301
International Business Continuity Management Standard.
NIST SP
NIST Special Publication.