What it asks for. This control expects the organisation to plan how to maintain information security at an appropriate level during disruption. Its purpose is to protect information and other associated assets when normal operations are interrupted.
In practice. Good practice means considering security within continuity and recovery planning, so that controls such as access control, logging and encryption still work when operating from backup sites, using workarounds or manual processes. Where security has to be relaxed, this is decided in advance with compensating measures. Auditors look for continuity plans that address security and exercise results showing it was tested.
Common gaps. Common gaps are continuity plans that ignore security, emergency access with no logging and recovery environments that are less protected than production. Temporary arrangements made during disruption are also often not reversed afterwards.