Security questionnaire answers › Infrastructure
Do you have a business continuity and disaster recovery plan? How to answer it in a security questionnaire
Why buyers ask this
Buyers depend on your service, so they want to know how quickly it returns after a major failure.
What a strong answer includes
- State recovery time objective (RTO) and recovery point objective (RPO).
- Say how often the plan and backup restores are tested.
- Describe multi-zone or multi-region design if applicable.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. We maintain a documented BC/DR plan with an RTO of [X hours] and RPO of [Y minutes/hours]. Backups are [automated/encrypted] and restore tests run [quarterly]. The service runs across [multiple availability zones] in [region].
Evidence to attach
- BC/DR plan
- Latest restore test record
- Architecture diagram
Common mistakes
- Backups without proven restores.
- RTO/RPO numbers nobody has tested.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.