Formal plans exist for maintaining critical business operations during and after a significant disruption
Approved plans describing how critical operations continue during a major disruption support this control's requirement, but a general business continuity plan does not by itself guarantee that information security is maintained through the disruption.
Approved plans for maintaining critical operations during a disruption set the scope that the ICT recovery capability in this control must be able to support.