Tracking Business Continuity & Disaster Recovery in APM

Zach Allen1
Tera Contributor

‎04-07-2025 01:02 PM

Hello all!

 

I am working to better connect our application owners, architects, security teams and leaders on initiatives around BC/DR plans. Specifically, answering:

 

  1. Do we have one for said application?
  2. Last time it was reviewed/updated?
  3. Last time a tabletop exercise or test was completed?
  4. Is this still in compliance?

We are not licensed for GRC currently. Has anyone done anything within EA to provide this type of detail? Currently, we are using the related URL related list to link to an external source. I would like to get a bit more dynamic, so I was thinking of leverage certifications or audits but also want to follow best practice. Any thoughts?

 

Thanks,

Zach

Labels:
0 Helpfuls
  • 631 Views
1 REPLY 1

mcastoe
ServiceNow Employee
ServiceNow Employee

‎04-15-2025 05:36 AM

Hi Zach,

On several implementations, I have seen a variety attributes added to support continuity and recovery.  The most common i see are add attributes for Recovery Time Objective (RTO) and Recovery Point Objective (RPO).  A clever use of these is that based on the RTO/RPO, you can determine a DR/BC Criticality score/rating so there would be an attribute for that.   This in turn helps determine recovery order.

For other BC/DR additions, i've seen addition of a "Last DR Test Date" that is required to be less that 18 months old and when the date is empty of times out, you can use flow, desired state audits etc to drive a round of testing.  Next, the test results can be "published" as an architecture artifact which in turn can be governed.   In fact, the results artifact version carries a date with it so you could configure a little governance with flows around it such that the artifact acts as the "date tested" and is required every NN months.

Just some thoughts and possibilities.

0 Helpfuls