We're about to deploy two racks of servers that will be in an environment that necessitate meeting NERC CIP-009 standards.
While everyone has their own methodology, how would you go about creating a backup plan that would cover the following subjects?
Exercises - An exercise of the recovery plan(s) can range from a paper drill, to a full operational exercise, to recovery from an actual incident.
Backup & Restore -The recovery plan(s) shall include processes and procedures for the backup and storage of information required to successfully restore Critical Cyber Assets. For example, backups may include spare electronic components or equipment, written documentation of configuration settings, tape backup, etc.
Testing of Backups - Information essential to recovery that is stored on backup media shall be tested at least annually to ensure that the information is available. Testing can be completed off site.
