Wombat

WAF-REL-130 – Disaster-Recovery-Pläne müssen jährlich getestet und dokumentiert sein

Säule: Reliability | Schweregrad: 🟠 Hoch | Kategorie: Backup Recovery | Automatisierbar: Low

Beschreibung

Every critical workload MUST have a documented disaster recovery plan with defined RTO and RPO. DR plans MUST be exercised at least annually through tabletop, failover, or full recovery tests. Test results and corrective actions MUST be documented and tracked to completion. DR runbooks MUST be reviewed after each test and after significant architecture changes.

Begründung

Risiko Beschreibung

Risk

Untested DR plans often miss critical gaps in network, identity, or data dependencies.

Risk

Outdated DR procedures extend recovery time and increase data loss during real disasters.

Anforderungen

  • Every critical workload MUST have a documented disaster recovery plan with defined RTO and RPO.

  • DR plans MUST be exercised at least annually through tabletop, failover, or full recovery tests.

  • Test results and corrective actions MUST be documented and tracked to completion.

  • DR runbooks MUST be reviewed after each test and after significant architecture changes.

Implementierungsleitfaden

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Reifegrade

Level Name Kriterien

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-rel-130.config.dr-plan-documented

Engine: config | Provider: any | Automated: Nein

DR-Plan mit RTO/RPO muss dokumentiert sein

DR-Plan mit RTO/RPO muss dokumentiert sein

Scope: file — docs/reliability/disaster-recovery-plan.md

Assertions: * exists attribute_exists — DR plan must define RTO, RPO, and test schedule.

Remediation: DR-Plan mit RTO/RPO muss dokumentiert sein

Compliant
# Beispiel konform zu waf-rel-130.config.dr-plan-documented
Non-Compliant
# Beispiel nicht konform zu waf-rel-130.config.dr-plan-documented

waf-rel-130.config.dr-test-evidence

Engine: config | Provider: any | Automated: Nein

Jährliche DR-Test-Evidenz muss existieren

Jährliche DR-Test-Evidenz muss existieren

Scope: file — docs/reliability/dr-test-evidence.md

Assertions: * exists attribute_exists — DR test evidence within last 12 months must exist.

Remediation: Jährliche DR-Test-Evidenz muss existieren

Compliant
# Beispiel konform zu waf-rel-130.config.dr-test-evidence
Non-Compliant
# Beispiel nicht konform zu waf-rel-130.config.dr-test-evidence

Evidenz

  • Terraform-Konfiguration, die die Anforderung umsetzt.

  • Policy, ADR oder Standard, der die Anforderung dokumentiert.

  • Optionale Cloud-Konsolen- oder API-Ausgaben, die den Laufzeit-Zustand bestätigen.

Verwandte Controls

  • WAF-REL-010

  • WAF-REL-040

  • WAF-REL-070

  • WAF-OPS-030

  • WAF-OPS-060

  • WAF-SOV-120 == Regulatorisches Mapping

  • ISO 27001:2022: A.8.13 – Information backup, A.8.14 – Redundancy of information processing facilities

  • BSI C5:2020: OPS-06 – Operational continuity / Exit management

  • DORA: Art. 12 – ICT-related incident management

  • GDPR: Art. 32 – Security of processing

  • SOC 2 Type II: A1.2 – Failover and recovery

  • NIST SP 800-53: CP-4 – Contingency Plan Testing