Disaster Recovery Program Initiation and Governance
What the exam tests
Program initiation and governance questions ask who authorizes DR, how scope is bounded, and how recovery decisions are controlled across business, IT, and suppliers.
Core rules
- Start with an executive mandate and a DR policy approved by top management. The policy states scope, objectives, principles, roles, and review cycle.
- The DR program should align with the BCMS (ISO 22301) and ICT readiness guidance (ISO/IEC 27031), but it is not a one-off project.
- Governance needs a steering committee, a DR manager with authority, business owners for critical services, and clear RACI for declaration, failover, and return-to-normal.
- Scope must name sites, services, data, dependencies, and exclusions. Legal, regulatory, contractual, and supply-chain obligations belong in scope.
- Fund through an approved budget; track maturity, exercise results, corrective actions, and management review.
Worked example
A payment processor includes its cloud-hosted card service and two third-party gateways in DR scope, but excludes the marketing site. Reasoning: the card service supports a regulatory obligation and revenue; gateway failure can stop payments even if internal systems run. Marketing is excluded only with business sign-off and a documented workaround. The RACI names the CIO as declaration authority, service owners as recovery coordinators, and procurement as owner of gateway contracts.
Traps
No executive sponsor; scope copied from an old IT list; unclear who can declare a disaster; treating supplier DR as out of scope; and measuring success by plan existence rather than exercise outcomes.