A.5.30 ICT Readiness for Business Continuity
Control Objective
ICT readiness shall be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.
Policy Statement
anDREa aligns its ICT readiness and infrastructure resilience directly with organizational business continuity objectives. Architecture requirements, failover capabilities, and testing schedules are governed via the Disaster Recovery Plan (DRP) and prioritized based on our formal Confidentiality, Integrity, and Availability (CIA) asset classifications.
Continuity Framework and Recovery Targets
To ensure continuous availability of the myDRE platform, readiness planning is split into standard operations and extreme disaster scenarios:
- Standard Operational Disruption: Under normal operating conditions, anDREa commits to a Maximum Tolerable Downtime (MTD), which is explicitly defined within the aService Level Agreement.
- The Role of RTO and RPO: Because myDRE is natively hosted on hyperscale infrastructure, standard Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are intrinsically bound to Microsoft Azure’s underlying infrastructure capabilities and regional resiliency guarantees.
- Catastrophic Failover: For severe outages, disruptions, or disaster scenarios that fall outside of standard Microsoft Azure automated recovery procedures, anDREa invokes the Baseline Recovery of myDRE Service protocol to manually restore platform operations.
For a detailed evaluation of environmental risks, asset impacts, and infrastructure threat modeling, see: