Business disruption scenarios have documented mitigations and recovery options

What an auditor asks for

An assessor reads the disruption scenarios and checks that each one has a documented way to keep operating or recover.

• Disruption scenarios
• Recovery options

Evidence ShipReady collects for CC9.1

ShipReady maps CC9.1 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Connected systemopsgenie-resilience
• Configuration exportdomain-expiry-posture

Common gaps

• No artifact has been collected yet — ShipReady records the CC9.1 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).
• The supporting document exists but was not reviewed in the current audit period, so the evidence has lapsed.

Related controls

• CC9.2 — Risks arising from vendors and business partners are assessed and managed