Audit checklist for Disaster Recovery (DR) testing

Is all the user representatives included in the DR test?

Is all the critical DR activities, the sequence and time required to completed the tasks documented? For example Pre-restoration activities, restoration activities, checking of reports after restoration, system configuration and setup of user profile, installation of necessary tools, etc.

Is the system performance monitored in terms of time required to complete the necessary tasks? Is it within the estimated time?

Can the necessary reports and documents be printed successfully?

Have the users representative and IT personnel sign-off the test?

DRP = IT BCP.

DR is the IT portion of the BCP Business Continuity Planning. It handles the recovery of the computer systems (for example if the data centre is on fire or the server breakdowns).

DRP = IT BCP.

BCP takes care of the business processes recovery for example if the factory or the business premises is burnt down. There must be a business resumption strategy to recover the critical business processes.

Before developing a BCP (including IT BCP), a BIA (Business Impact Analysis) should be conducted to determine the criticality of the business processes and the recovery priority.

A good example of IT BCP template are available from:-

NIST IT Contingency Planning Guide

csrc.nist.gov/publications/nistpubs/800-34/sp800-34.pdf

IT Control - BCP | BRP

Some called it "Business Continuity Planning (BCP)", others called it "Business Resumption Planning (BRP)". Well, whatever the term is, the most important aspect is the plan, not the term.

Besides the BCP, there is the DRP (Disaster Recovery Planning), that is the IT aspect of the BCP. DRP = IT BCP.

The most important thing is to plan for the worst case scenario and ensure that all critical business processes and mission critical systems are covered under the plan.

For auditing purposes, the detailed information of BCP are available in:-

• FFIEC (BCP booklets)
• COBIT IT Processes (item DS4 ensure continuous service)