{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"business_continuity","domain":["Business Continuity & Disaster Recovery","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk","iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Abcdr-no-tested-continuity-plan","description":"No BCP/DR plan, or plans that exist but have never been exercised end-to-end, so a natural disaster, pandemic, civil unrest, or infrastructure failure disables critical processes with no tested recovery path.","details":{"category":"business_continuity","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"bcdr-no-tested-continuity-plan","taxonomies":["enterprise-risk","coso-erm-risk","iso-27005-vulnerability"],"treatment":"mitigate"},"id":"risk:bcdr-no-tested-continuity-plan","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Abcdr-no-tested-continuity-plan","sourceIds":["cobit-2019","dora","iso-27001","nist-800-53","nydfs-500","soc1","soc2","sox"],"sourceUrl":null,"title":"Absent or untested business continuity / disaster recovery plan","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1d531e42d1d715ed599e863ffe36bae6966a39a6b05d5b0d83bc9e66693e2a39","properties":{"rationale":"annual exercises, failover/restore tests, and gap remediation directly cure the untested-plan condition","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-10-602160e4.json","sourceId":"uc:UC-BCDR-10","targetDetailPath":"/data/v1/records/risk-bcdr-no-tested-continuity-plan-d4d9e7a9.json","targetId":"risk:bcdr-no-tested-continuity-plan","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2dd1693b0f792eb20e6784f0968b02a491db0771423c109c75f29f16e99c13ea","properties":{"rationale":"maintaining a documented, approved, annually-reviewed BCP/DR plan directly cures the absent-plan condition","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-01-428f23d3.json","sourceId":"uc:UC-BCDR-01","targetDetailPath":"/data/v1/records/risk-bcdr-no-tested-continuity-plan-d4d9e7a9.json","targetId":"risk:bcdr-no-tested-continuity-plan","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5471ca0c7cf01ea72d5ed6a32d4530a092810cff89582f846be3c055c2f80315","properties":{"rationale":"the framework requires a defined resilience/recovery strategy, driving plans to exist","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-02-2a51c24c.json","sourceId":"uc:UC-BCDR-02","targetDetailPath":"/data/v1/records/risk-bcdr-no-tested-continuity-plan-d4d9e7a9.json","targetId":"risk:bcdr-no-tested-continuity-plan","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9c5d51b3b12fe145f66e8e52f4fca2c356e187e231c0eaf665986fedd3066c7e","properties":{"rationale":"periodic recovery-capability testing exercises the restore path","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-12-32fbbd73.json","sourceId":"uc:UC-ASSET-12","targetDetailPath":"/data/v1/records/risk-bcdr-no-tested-continuity-plan-d4d9e7a9.json","targetId":"risk:bcdr-no-tested-continuity-plan","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a306a3d84f530dae589def12cc9c1cd68e204ef07784a630b04381d253540b95","properties":{"rationale":"periodic restoration testing exercises the recovery path","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-17-c9ecd00d.json","sourceId":"uc:UC-ACCESS-17","targetDetailPath":"/data/v1/records/risk-bcdr-no-tested-continuity-plan-d4d9e7a9.json","targetId":"risk:bcdr-no-tested-continuity-plan","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bba5dfd331464cefd508fcab32ed91229b9f2359f9b19c720153bafe6cc76af6","properties":{"rationale":"Criticality analysis identifies critical components, functions and dependencies, informing which processes continuity/recovery planning must prioritize.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-18-23752e70.json","sourceId":"uc:UC-RISK-18","targetDetailPath":"/data/v1/records/risk-bcdr-no-tested-continuity-plan-d4d9e7a9.json","targetId":"risk:bcdr-no-tested-continuity-plan","type":"mitigates"}],"schemaVersion":1}