CCSP: Certified Cloud Security Professional

A regulatory change alone does not necessarily require a BCDR exercise. Testing is necessary at least annually and after significant changes to the system, supported business processes, recovery resources, or recovery plan. Software updates and major configuration changes can directly affect recovery capability, while a regulatory change requires testing only when it results in a material operational or plan change. NIST SP 800-34 Rev. 1 identifies annual and significant-change testing requirements.