This requirement exists to plan, conduct, analyze, report, review, and improve operational resilience testing and response readiness, with specific focus on recovery validation, so that critical services remain resilient against disruption and decisions are accountable and traceable.
Establish and document the process for recovery validation. Define accountable owners, required inputs and outputs, assessment or approval criteria, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process consistently to critical services and their dependencies, and integrate it with risk management, business continuity, incident management, technology operations, and third-party management where relevant.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.13-3.3.3 – Testing of BCP; §2.13-3.3-IV – IT DR Recovery Planning |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 19) Incident Response & Management – 19.5 Resilience capabilities and coordinated testing across interconnected systems, vendors and partners; 19) Incident Response & Management – 19.6 Crisis communications, reputation management and capacity planning in resilience testing |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.5 GV.RM: Risk Management; 2.2 ID.RA: Risk Assessment |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 24(1) – Digital operational resilience testing programme Article 25 – Testing of ICT tools and systems Article 26 – Advanced testing of ICT tools, systems and processes based on threat-led penetration testing |
EU
Regulation
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.30 – ICT readiness for business continuity |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(c) – Business continuity, including backup management, disaster recovery and crisis management |
EU
Directive
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.03 – Develop and implement a business continuity response. 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.02 – Maintain business resilience. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: RC.RP – Incident Recovery Plan Execution | RC.RP-02 – Recovery actions are selected, scoped, prioritized, and performed |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.6 – CONTINGENCY PLANNING; CP-10 – SYSTEM RECOVERY AND RECONSTITUTION |
NIST
Control Catalog
|
vRev. 5 | View → |
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 11 – Data Recovery: 11.5 – Test Data Recovery |
CIS
Best Practice
|
vv8 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Testing – Re-assessment and Closure |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: A1.3 – Availability – The entity tests recovery plan procedures supporting system recovery to meet its objectives. CC9.1 – Risk Mitigation – The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions. CC7.5 – System Operations – The entity identifies, develops, and implements activities to recover from identified security incidents. |
AICPA
Audit Framework
|
vLatest | View → |