A Business Continuity and Disaster Recovery (BCDR) is a plan and a process that helps a business to return to normal operations if a disaster occurs.
Risk: If the disaster recovery actions are not clear, you risk slow reaction and remediation delays. This applies to cyber attacks as well as natural emergencies, such as a power outage.
Defining the protection requirement. The protection requirements for an application should consider:
Risk: Not defining the protection requirement of applications can lead to wrong prioritization, delayed remediation of critical security issues, increasing the risk of exploitation and potential damage to the organization.
On each new version (e.g. Pull Request) of source code or infrastructure components a security peer review of the changes is performed (two eyes principle) and approval given by the reviewer.
Risk: An individual might forget to implement security measures to protect source code or infrastructure components.
Each change of a system is automatically recorded and adequately logged.
Risk: The impact of a change is not controlled because these are not recorded or documented.