The firm’s BC & DR plan should be maintained as the firm’s technology and staff changes, and tested as thoroughly as practical to ensure it achieves the intended goals if allowing the firm to continue to operate when critical services are unavailable as well as recover any lost services and data.
Some examples:
- Update the plan after major changes in office space, technology or staffing
- Conduct a quarterly tabletop exercises to simulate one of the risk scenarios identified in section 3.1 above
- Conduct a semi-annual restore tests for critical systems, demonstrating the RTO & RPO can be achieved
- Conduct an annual full review and update of the plan, considering both technology and staffing changes