A recovery process for disasters and information/cybersecurity incidents shall be developed and executed as appropriate.
The organization’s functions and services shall be continued with little or no loss of operational continuity and continuity shall be sustained until full system restoration.