RES-04 · Resilience and Response
Continuity and recovery objectives
Critical processes have recovery objectives, a continuity plan and a tested route back to service.
4frameworks fully address it
2partially
2leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullA1.3
- ISO 27001FullA.5.29
- NIST CSFFullRC.RP-01
- PCI DSSAbsent Continuity is out of scope; the standard addresses cardholder data protection.
- HIPAAFull164.308(a)(7)
- GDPRPartialArt. 32(1)(c) Timely restoration of availability.
- EU AI ActAbsent Not addressed.
- NIST AI RMFPartialMANAGE 4.3 Contingency planning.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
BIA, RTO and RPO, plan, exercise records.
?Why it exists
Objectives set before an outage are decisions; after one they are excuses.
For a smaller organizationKnow which three processes matter and how long you can be down.