Basis: Certvia dev@a48c5fb als Fundament für Craftvia

Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-14 11:05:39 +02:00
commit c8e6f30a27
720 changed files with 140143 additions and 0 deletions
@@ -0,0 +1,72 @@
+# IT Emergency and Recovery Procedure (BCM)
+
+| Document information | Value |
+|-----------------------|------|
+| Document type | Procedure instruction (VA-02) |
+| Scope | {{ISMS_SCOPE}} |
+| Organisation | {{ORG_NAME}} |
+| Process owner | {{ROLE_IT_LEAD}} |
+| Approved by | {{ROLE_ISB}} |
+| Version | {{DOC_VERSION}} |
+| Date | {{DOC_DATE}} |
+| Status | {{DOC_STATUS}} |
+
+<!-- FULFILLS 1.6.3-M1, 1.6.3-S1, 5.2.8-M1, 5.2.8-S1, A.5.29-1, A.5.30-1, A.8.14-1 | POLICY R04 -->
+
+## 1. Purpose
+
+This procedure governs the maintenance and recovery of critical IT services in the event of failure or crisis. It operationalises the associated policy ({{LINK:R04}}).
+
+## 2. Scope
+
+Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
+
+## 3. Trigger
+
+Failure of critical IT services, emergency or crisis (escalation from VA-01).
+
+## 4. Inputs
+
+- List of critical IT services with RTO/RPO
+- Recovery plans
+- Backup status (VA-05)
+
+## 5. Process
+
+1. Identify & classify the emergency: assess the extent, convene the crisis team if necessary.
+2. Activate communication: inform internal/external stakeholders.
+3. Prioritise recovery: order services according to RTO/RPO.
+4. Perform recovery: restore systems/data from backup (VA-05).
+5. Confirm & document the return to normal operations.
+6. Follow-up & test update: update the plan, exercise {{BACKUP_TEST_FREQ}}.
+
+## 6. RACI
+
+| # | Step | R (Execution) | A (Accountable) | C (Consulted) | I (Informed) |
+|---|---------|------------------|------------------|-----------------|----------------|
+| 1 | Identify & classify the emergency | {{ROLE_IT_LEAD}} | {{ROLE_MANAGEMENT}} | {{ROLE_ISB}} | - |
+| 2 | Activate communication | {{ROLE_ISB}} | {{ROLE_MANAGEMENT}} | - | Employees |
+| 3 | Prioritise recovery | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - |
+| 4 | Perform recovery | {{ROLE_IT_LEAD}} | {{ROLE_IT_LEAD}} | - | - |
+| 5 | Confirm return to normal operations & | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | {{ROLE_MANAGEMENT}} |
+| 6 | Follow-up & test update | {{ROLE_IT_LEAD}} | {{ROLE_ISB}} | - | - |
+
+## 7. Result & evidence
+
+Recovered services; documented emergency/test in the ISMS tool ({{TOOL_NAME}}); updated recovery plans. Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).
+
+## 8. Key performance indicators (KPI)
+
+- Adherence to RTO/RPO
+- Success rate of recovery tests
+- Up-to-dateness of the emergency plans
+
+## 9. Related documents
+
+- Associated policy: {{LINK:R04}}
+- {{LINK:VA-01}}
+- {{LINK:VA-05}}
+- Technical security baseline: {{LINK:BASELINE}}
+- ISA mapping matrix: {{LINK:ISA_MAPPING}}
+
+<!-- Erfüllt die oben unter FULFILLS gelisteten Anforderungen; Kopplung in mapping.json. Im Lesemodus nicht sichtbar. -->