Requirement
"The organization shall plan how to maintain information security at an appropriate level during disruption"[1]
Explanation
The organization is required to protect the confidentiality integrity and availability of its information system even if business continuity operations are ongoing. This can include ensuring that information is stored at a secure location is encrypted and access controls are enforced.
