Wombat

WAF-REL-130 – Disaster recovery plans MUST be tested at least annually and updated based on test results

Pillar: Reliability | Severity: 🟠 High | Category: Backup Recovery | Automatable: Low

Description

Every critical workload MUST have a documented disaster recovery plan with defined RTO and RPO. DR plans MUST be exercised at least annually through tabletop, failover, or full recovery tests. Test results and corrective actions MUST be documented and tracked to completion. DR runbooks MUST be reviewed after each test and after significant architecture changes.

Rationale

Risk Description

Risk

Untested DR plans often miss critical gaps in network, identity, or data dependencies.

Risk

Outdated DR procedures extend recovery time and increase data loss during real disasters.

Requirements

  • Every critical workload MUST have a documented disaster recovery plan with defined RTO and RPO.

  • DR plans MUST be exercised at least annually through tabletop, failover, or full recovery tests.

  • Test results and corrective actions MUST be documented and tracked to completion.

  • DR runbooks MUST be reviewed after each test and after significant architecture changes.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-rel-130.config.dr-plan-documented

Engine: config | Provider: any | Automated: No

DR plan with RTO/RPO must be documented

DR plan with RTO/RPO must be documented

Scope: file — docs/reliability/disaster-recovery-plan.md

Assertions: * exists attribute_exists — DR plan must define RTO, RPO, and test schedule.

Remediation: DR plan with RTO/RPO must be documented

Compliant
# Example compliant with waf-rel-130.config.dr-plan-documented
Non-Compliant
# Example non-compliant with waf-rel-130.config.dr-plan-documented

waf-rel-130.config.dr-test-evidence

Engine: config | Provider: any | Automated: No

Annual DR test evidence must exist

Annual DR test evidence must exist

Scope: file — docs/reliability/dr-test-evidence.md

Assertions: * exists attribute_exists — DR test evidence within last 12 months must exist.

Remediation: Annual DR test evidence must exist

Compliant
# Example compliant with waf-rel-130.config.dr-test-evidence
Non-Compliant
# Example non-compliant with waf-rel-130.config.dr-test-evidence

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls

  • WAF-REL-010

  • WAF-REL-040

  • WAF-REL-070

  • WAF-OPS-030

  • WAF-OPS-060

  • WAF-SOV-120 == Regulatory Mapping

  • ISO 27001:2022: A.8.13 – Information backup, A.8.14 – Redundancy of information processing facilities

  • BSI C5:2020: OPS-06 – Operational continuity / Exit management

  • DORA: Art. 12 – ICT-related incident management

  • GDPR: Art. 32 – Security of processing

  • SOC 2 Type II: A1.2 – Failover and recovery

  • NIST SP 800-53: CP-4 – Contingency Plan Testing