BCD

Business Continuity & Disaster Recovery

61 controls

Maintain resilient capabilities to sustain business-critical functions and recover from disruptions through documented, tested and maintained continuity and recovery processes.

SCF #	Control Name	Weight	NIST CSF	Frameworks
BCD-01	Business Continuity & Disaster Recovery Policy	10 — Critical	Govern	18
BCD-02	Business Continuity Management System (BCMS)	10 — Critical	Govern	117
BCD-02.1	Defined Operational Resilience Requirements	8 — High	Govern	11
BCD-03	Operational Resilience Capabilities	5 — Medium	Protect	9
BCD-04	Business Continuity & Disaster Recovery (BC/DR) Plans	9 — Critical	Protect	22
BCD-04.1	Recovery Time / Point Objectives (RTO / RPO)	5 — Medium	Recover	51
BCD-05	Recovery Operations Criteria	6 — Medium	Govern	15
BCD-06	Recovery Operations Communications	3 — Low	Govern	10
BCD-06.1	Alternate Communications Channels	5 — Medium	Protect	16
BCD-07	Ongoing Contingency Planning	8 — High	Recover	42
BCD-07.1	Contingency Planning Components	8 — High	Recover	6
BCD-07.2	Contingency Plan Update Notifications	5 — Medium	Recover	3
BCD-07.3	Coordinate with Related Plans	5 — Medium	Recover	33
BCD-07.4	Coordinate With External Service Providers	5 — Medium	Recover	25
BCD-08	Resume All Missions & Business Functions	8 — High	Recover	27
BCD-08.1	Continue Essential Mission & Business Functions	8 — High	Recover	31
BCD-08.2	Resume Essential Missions & Business Functions	8 — High	Recover	21
BCD-09	Contingency Training	5 — Medium	Recover	36
BCD-09.1	Simulated Events	3 — Low	Recover	16
BCD-09.2	Automated Training Environments	1 — Low	Recover	4
BCD-10	Contingency Plan Testing & Exercises	6 — Medium	Recover	74
BCD-10.1	Coordinated Testing with Related Plans	3 — Low	Recover	19
BCD-10.2	Contingency Plan Testing For Alternate Storage & Processing Sites	5 — Medium	Recover	10
BCD-11	Contingency Plan Root Cause Analysis (RCA) & Lessons Learned	9 — Critical	Detect	48
BCD-12	Alternate Storage Site	9 — Critical	Protect	32
BCD-12.1	Separation from Primary Storage Site	7 — High	Protect	20
BCD-12.2	Primary Storage Site Accessibility	5 — Medium	Protect	15
BCD-13	Alternate Processing Site	9 — Critical	Protect	37
BCD-13.1	Separation from Primary Processing Site	7 — High	Protect	20
BCD-13.2	Alternate Processing Site Accessibility	5 — Medium	Recover	20
BCD-14	Alternate Site Priority of Service	6 — Medium	Recover	15
BCD-15	Preparation for Use	5 — Medium	Protect	8
BCD-16	Inability to Return to Primary Site	5 — Medium	Protect	5
BCD-16.1	Personnel Transfer to Alternate Processing / Storage Site	5 — Medium	Recover	5
BCD-17	Telecommunications Services Availability	6 — Medium	Recover	25
BCD-17.1	Telecommunications Priority of Service Provisions	6 — Medium	Recover	16
BCD-17.2	Separation of Primary / Alternate Providers	5 — Medium	Protect	15
BCD-18	Technology Assets, Applications and/or Services (TAAS) Recovery & Reconstitution	9 — Critical	Protect	58
BCD-18.1	Restore Within Time Period	5 — Medium	Respond	10
BCD-18.2	Recovery Images	8 — High	Recover	11
BCD-19	Isolated Recovery Environment	5 — Medium	Recover	9
BCD-20	Reserve Hardware	7 — High	Recover	2
BCD-21	Redundant Secondary System	5 — Medium	Protect	17
BCD-22	Failover Capability	8 — High	Recover	15
BCD-23	Resilient Data Backup Architecture	9 — Critical	Protect	14
BCD-24	Data Backups	10 — Critical	Protect	117
BCD-24.1	Transfer to Alternate Storage Site	5 — Medium	Protect	16
BCD-24.2	Separate Storage for Critical Information	8 — High	Protect	44
BCD-24.3	Cryptographic Protection	9 — Critical	Protect	45
BCD-25	Redundant Copies of Business-Critical Data	9 — Critical	Protect	6
BCD-26	Transaction Recovery	9 — Critical	Recover	19
BCD-27	Data Replication	7 — High	Recover	1
BCD-28	Data Archiving	6 — Medium	Protect	4
BCD-29	Continuous Data Protection (CDP)	5 — Medium	Recover	0
BCD-30	Data Backup Access	9 — Critical	Protect	10
BCD-31	Data Backup & Restoration Hardware Protection	8 — High	Protect	15
BCD-31.1	Restoration Integrity Verification	7 — High	Govern	4
BCD-32	Testing for Reliability & Integrity	9 — Critical	Recover	63
BCD-32.1	Test Restoration Using Sampling	5 — Medium	Protect	28
BCD-33	Data Backup Modification and/or Destruction	9 — Critical	Protect	10
BCD-33.1	Dual Authorization For Sensitive / Regulated Backup Media Destruction	5 — Medium	Protect	7

The Secure Controls Framework (SCF) is maintained by SCF Council. Use of SCF content is subject to the SCF Terms & Conditions.

Business Continuity & Disaster Recovery

Manage SCF Controls in SCF Connect