A CCP shall regularly review and update it business continuity policy to include all critical functions and the most suitable recovery strategy for them.

A CCP shall regularly review and update its disaster recovery plan to include the most suitable recovery strategy for all critical functions.

Updates to the business continuity policy and disaster recovery plan shall take into consideration the outcome of the tests and recommendations of independent reviews and other reviews and of competent authorities. CCPs shall review their business continuity policy and disaster recovery plan after every significant disruption, to identify the causes and any required improvements to the CCP’s operations, business continuity policy and disaster recovery plan.