Creating and maintaining thorough documentation is a crucial aspect of ensuring business continuity and operational resilience. In this article, we'll explore the importance of documentation, who should care about it, and how to make it happen.

Where did this come from?

CSA Cloud Controls Matrix v4.0.10 - 2023-09-26. You can download the full matrix here.

Who should care?

• Business continuity managers with the need to ensure smooth operations during disruptions
• IT administrators with the responsibility of maintaining and recovering systems
• Security professionals with the goal of minimizing the impact of incidents

What is the risk?

Lack of proper documentation can lead to:

• Longer recovery times during incidents due to confusion and lack of guidance
• Misconfiguration of systems, leading to vulnerabilities and security gaps
• Inefficient onboarding of new team members, slowing down operations

BCR-05 helps mitigate these risks by ensuring that all necessary documentation is readily available and up-to-date.

What's the care factor?

For organizations heavily reliant on their IT systems, the care factor for BCR-05 should be high. Downtime can lead to significant financial losses and reputational damage. Having comprehensive documentation can make the difference between a minor hiccup and a major disaster.

When is it relevant?

BCR-05 is relevant for:

• Complex IT environments with many moving parts
• Organizations with high availability requirements
• Companies with strict compliance obligations

It may be less critical for smaller, simpler setups where the systems are well-understood by the entire team.

What are the trade-offs?

Creating and maintaining documentation takes time and effort. It can be seen as a distraction from "real work". However, the investment pays off in smoother operations and faster recovery times.

There's also a balance to strike between detail and clarity. Too much detail can make documents hard to navigate, while too little can leave gaps in understanding.

How to make it happen?

1. Identify the critical systems and processes that need documentation
2. Determine the types of documentation needed (e.g., architecture diagrams, runbooks, user guides)
3. Assign ownership for creating and maintaining each document
4. Establish a standard format and storage location for documentation
5. Create the initial versions of the documents
6. Set up a regular review cycle to keep the docs up-to-date
7. Ensure all relevant stakeholders have access to the documentation
8. Incorporate documentation into onboarding and training processes

What are some gotchas?

• Ensure that the people creating the documentation have the necessary knowledge and permissions (e.g., ec2:DescribeInstances for documenting AWS EC2 setups)
• Be aware of security considerations when storing and sharing documentation. Sensitive information should be properly protected.
• Keep an eye out for documentation drift, where the docs fall out of sync with reality. Automate where possible to mitigate this.

What are the alternatives?

While there's no direct alternative to having good documentation, some related practices can help:

• Implementing infrastructure as code to have a versioned, reproducible system definition
• Automating common tasks to reduce the need for manual intervention
• Investing in cross-training to spread knowledge across the team

Explore further

• CIS Control 3: Data Protection: Procedures and tools for properly handling data
• CIS Control 11: Data Recovery Capabilities: Proper data backup and recovery

For more on business continuity and disaster recovery, check out the AWS Well-Architected Framework - Reliability Pillar.

‍