A plan and process for business continuity, including the backup and recovery of systems and data, must be defined and documented.

The Business Continuity Plan shall be simulated and tested at least once a year. Metrics shall be measured and identified recovery enhancements shall be filed to improve the process.

Security controls and requirements must be maintained during all Business Continuity Plan activities.