Incidents, emergency plans, BCM and recovery

Incidents

Incidents records detection, impact, affected assets, responsibilities, timeline and reporting obligations. For NIS2 and GDPR, the application separates report type, actual submission date, channel, reference and evidence. Deadlines derive from the incident and the respective obligation.

Close an incident only when assessment, measures and required reports are recorded. Record a submitted-report correction as a correction, not by overwriting original evidence.

Emergency plans

Emergency plans hold scenario, content, responsible persons, priority, visibility, test date and versions. Every change creates a new version. Plan and record tests against the plan version used. Archive plans with test evidence instead of deleting them.

BCM

BCM maintains business processes, BIA assessments, dependencies, objectives and exercises. A BC exercise contains scenario, team, checklist, findings, lessons learned and tasks. Transfer open items into measures so they appear in the dashboard.

Recovery plan and backup jobs

The Recovery plan assigns recovery steps, roles and dependencies to critical assets and processes. Review sequence and contacts after material infrastructure changes.

Backup jobs documents strategy, destination, interval, retention, encryption, key custody, restore access and RPO assessment. Add backup runs and restore tests as evidence. Derived RPO and 3-2-1 assessments are calculated from the recorded data.

Automated backup evidence

The extension after v1.25.0 provides domain actions for backup runs and restore test completion, plus a separate push channel for technical observations. The Veeam example exports completed VM backup sessions. Restore points and SureBackup reports need separate mappings appropriate to the vendor version.

Ingest evaluation detects RPO deviations from valid reported restore points and tracks failures and unknown states as integration cases. It does not create artificial BCM exercises or automatically complete measures.