Key takeaways
- Make sure your IT can recover in line with business continuity needs.
- Technology is what most business processes depend on.
- Start here: run a business impact analysis to set recovery time and recovery point objectives.
Purpose
Make sure your IT can recover in line with business continuity needs.
Requirement
Requirement summaryICT readiness shall be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.
Why it matters
Technology is what most business processes depend on. You need to know how fast you can recover it.
How to implement
- Run a business impact analysis to set recovery time and recovery point objectives.
- Design ICT recovery arrangements that meet those objectives.
- Test recovery regularly and record results.
- Update plans after tests and system changes.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.30. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your IT recovery plan, with recovery targets: how fast systems must be back (RTO) and how much data you can afford to lose (RPO).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.30 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Your business impact analysis showing which systems matter most.
- Recovery test results showing targets were met.
- Actions taken to fix problems found in tests.
Things you should be able to show or explain
- IT should be able to explain recovery roles and steps.
How much to show: The latest test for each critical system.
Common mistakes
- Recovery never tested.
- Failed test with no follow-up.
- Recovery objectives that nobody has tested.
- Plans that cover servers but not cloud services.
- Tip: Test restores and failovers, not just backups.
Policies & documents to have
- Incident Response Plan
- Business Continuity and Disaster Recovery Plan
FAQ
Is A.5.30 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.30?
Be ready to explain how the control works in your organisation and to provide things like: Your IT recovery plan, with recovery targets: how fast systems must be back (RTO) and how much data you can afford to lose (RPO)…