Plan vs. Program Gap Checklist
A 15-question self-audit to determine whether you have a tested recovery program — or a document that satisfies an audit.
Answer each question honestly. "Mostly" or "it used to" counts as No. Count your No answers and read the result at the end.
Your DR/BC plan has been reviewed or updated within the last 12 months.
Every plan owner listed in the document still holds that role today.
The plan reflects your current system architecture, not the environment you had 2+ years ago.
RTOs and RPOs in the plan have been validated against actual recovery testing, not estimated at write-time.
You have run a tabletop exercise, of any kind, in the last 12 months.
Your most recent test included people outside the BC/DR team, not just the practitioners who wrote the plan.
At least one recovery procedure has been executed end-to-end (not just discussed) in the last 24 months.
Findings from your last exercise were tracked to closure, not just documented and filed.
Your BC/DR program has a named executive sponsor who reviews it at least annually.
The board or audit committee has seen programmatic results, not just the existence of a plan, in the last 12 months.
You can produce evidence of testing on demand for an auditor without a multi-week scramble.
Recovery capability, not just plan existence, is part of your enterprise risk register.
Your BC/DR plan is explicitly integrated with your cyber incident response plan, not maintained as a separate, parallel document.
Cloud and third-party vendor dependencies are mapped and included in recovery scope.
A system or vendor change triggers a defined process to update the affected recovery plan.