Do you have a disaster recovery plan?
A foundations question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Yes. Recovery from a major outage follows a written plan with a recovery time objective of [4 hours] and a recovery point objective of [24 hours]. The plan was last tested in [month and year].
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- The plan itself, or a summary of it
- Notes from the last test, including what went wrong
If you don't do this yet
Give the targets your architecture actually supports, and say whether the plan has been tested. An untested plan honestly described is a better answer than an RTO you can't meet.
Related questions
Do you back up customer data?A model answer, the evidence behind it, and what to say if you don't do it yet.Do you enforce multi-factor authentication?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.