What it covers. NIST guidance on planning for the disruption of information systems. It describes a contingency planning process that includes a business impact analysis, preventive controls, recovery strategies, plan development, testing and maintenance, and explains how system plans relate to wider continuity planning.
In practice. Organisations perform a business impact analysis to set recovery time and recovery point objectives, select backup and recovery strategies to meet them, and write plans with clear roles and procedures. Plans are tested through tabletop and technical exercises and updated after changes. Evidence includes impact analyses, plans, test reports and corrective actions.
Common gaps. Common gaps are plans that do not reflect current architecture or cloud dependencies, recovery objectives that were never tested, and no scenario for ransomware affecting backups.