Questions 92 to 99 — business continuity and disaster recovery

Table 1 lists who is responsible for answering each question. Both your government organisation and the service provider need to answer question 99.

Context and help for questions 92 to 99

Questions to answer

92. Does the service provider have business continuity and disaster recovery plans?
93. Will the service provider allow your government organisation to review its business continuity and disaster recovery plans?
94. Do the service provider’s plans cover the recovery of information or only the restoration of the service?
95. If the service provider’s plans cover the restoration of information, is the recovery of customer data prioritised?
    
    1. If yes — how? In other words, are customers prioritised based on size and contract value?
96. Does the service provider formally test its business continuity and disaster recovery plans on a regular basis?
    
    1. If yes — how regularly are such tests performed?
    2. Will they provide customers with a copy of the associated reports?
97. Does your government organisation have its own business continuity and disaster recovery plan in place to ensure that it can recover from the service provider:
    
    • having a service outage
    • going out of business
    • withdrawing the service?
98. Does your government organisation require its own data backup strategy to ensure that it can recover from the service provider:
    
    • having a service outage
    • going out of business
    • withdrawing the service?
99. Are the backups, whether performed by the service provider or government organisation, encrypted using an:
    
    • approved encryption algorithm
    • appropriate key length?

Where to find the service provider’s answers

You can get the answers to the service provider’s questions from a combination of:

• direct communication with the provider
• the provider’s policies and audit reports on their website
• previous assessments by other government organisations.

If you do not have the service provider’s answers

If you need higher assurance for the information, consider a different public cloud service if:

• the provider does not give you their answers or other information you need for your risk assessment
• you cannot get acceptable third-party assurance
• there are no ways to lessen the risk of this incomplete information.

Independent assurance reports — New Zealand Information Security Manual

Context and help for questions 92 to 99

The following guidance gives you context and help for answering questions about business continuity and disaster recovery.

Direct contracts — check for information you can use

Another NZ government organisation may have previously assessed the public cloud service you’re looking to use. See which organisation to contact for information by:

• joining the Cloud Capabilities Network (CCN), if you’re not already a member
• searching the CCN’s chart of risk assessments for public cloud services.

NZ government agreements and contracts — check for certification documents you can use

You can use certification documents to help with your risk assessment of using either:

• an all-of-government agreement
• a Marketplace contract.

To get these, contact the security team at the Department of Internal Affairs at ictassurance@dia.govt.nz.

Check the service provider’s plans

See if the service provider has plans in place that meet the levels you require for:

• business continuity
• disaster recovery.

Check your organisation’s plans

Government organisations must also have plans in place for business continuity and disaster recovery. They should be tested regularly to make sure your organisation can keep offering its services during an outage.

Backup plan — data

Government organisations must meet their obligations under NZ legislation, which requires them to backup their data to keep its integrity.

Integrity of the information

Backup plan — public cloud service

Another reason for backing up data is so you can switch the public cloud service your government organisation is using. This can happen because:

• you’ve found a better option — one of the benefits of public cloud services
• the provider has either stopped trading or is withdrawing the service.