(a) As part of its cybersecurity program, each covered entity shall establish written plans that contain proactive measures to investigate and mitigate cybersecurity events and to ensure operational resilience, including but not limited to incident response, business continuity and disaster recovery plans.

1. (1) Incident response plan. Incident response plans shall be reasonably designed to enable prompt response to, and recovery from, any cybersecurity event materially affecting the confidentiality, integrity or availability of the covered entity’s information systems or the continuing functionality of any aspect of the covered entity’s business or operations. Such plans shall address the following areas with respect to different types of cybersecurity events, including disruptive events such as ransomware incidents:

   1. (i) the goals of the incident response plan;
   2. (ii) the internal processes for responding to a cybersecurity event;
   3. (iii) the definition of clear roles, responsibilities and levels of decision-making authority;
   4. (iv) external and internal communications and information sharing;
   5. (v) identification of requirements for the remediation of any identified weaknesses in information systems and associated controls;
   6. (vi) documentation and reporting regarding cybersecurity events and related incident response activities;
   7. (vii) recovery from backups;
   8. (viii) preparation of root cause analysis that describes how and why the event occurred, what business impact it had, and what will be done to prevent reoccurrence; and
   9. (ix) updating of incident response plans as necessary.

2. (2) Business continuity and disaster recovery (BCDR) plan. BCDR plans shall be reasonably designed to ensure the availability and functionality of the covered entity’s information systems and material services and protect the covered entity’s personnel, assets and nonpublic information in the event of a cybersecurity-related disruption to its normal business activities. Such plans shall, at minimum:

   1. (i) identify documents, data, facilities, infrastructure, services, personnel and competencies essential to the continued operations of the covered entity’s business;
   2. (ii) identify the supervisory personnel responsible for implementing each aspect of the BCDR plan;
   3. (iii) include a plan to communicate with essential persons in the event of a cybersecurity-related disruption to the operations of the covered entity, including employees, counterparties, regulatory authorities, third-party service providers, disaster recovery specialists, the senior governing body and any other persons essential to the recovery of documentation and data and the resumption of operations;
   4. (iv) include procedures for the timely recovery of critical data and information systems and to resume operations as soon as reasonably possible following a cybersecurity-related disruption to normal business activities;
   5. (v) include procedures for backing up or copying, with sufficient frequency, information essential to the operations of the covered entity and storing such information offsite; and
   6. (vi) identify third parties that are necessary to the continued operations of the covered entity’s information systems.

(d) Each covered entity shall periodically, but at a minimum annually, test its:

1. (1) incident response and BCDR plans with all staff and management critical to the response, and shall revise the plan as necessary; and
2. (2) ability to restore its critical data and information systems from backups.