• Critical systems and data are backed up with cross-region replication and immutable, encrypted storage.
• Recovery procedures are documented and tested, including periodic recovery testing.
• A disaster recovery plan defines priority applications and recovery objectives (RTO/RPO) and is independently reviewed.

Framework Alignment: NIST CSF RC.RP, PR.IR; CIS Control 11; GDPR Art. 32(1)(c); ISO 27001:2022 A.8.13, A.8.14