IT Compliance Scorecard

Offsite backups to geographically separate cloud region

RTO ≤ 4 hours for critical systems

RPO ≤ 1 hour for transactional data

Monthly restore tests documented

Backups encrypted (AES-256)

Written DRP reviewed by leadership

Emergency contact tree maintained

Failover procedures documented

Communication plan pre-approved

Annual DRP simulation conducted

Multi-region deployment (≥2 regions)

Sovereign cloud compliance (FIPA/state residency)

Automatic failover on outage

Real-time database replication (<1 sec lag)

Geographic load balancing

UPS + generator (≥8 hour runtime)

Dual internet connections

Badge-controlled server room

Environmental monitoring & alerts

Fire suppression system (non-water)

Zero Trust with MFA on all remote access

TLS 1.2+ for all communications

AES-256 encryption at rest

Role-based access control (RBAC)

Centralized logging (12-month retention)

FIPA compliance (Florida data residency)

HIPAA/PCI/SOC 2 certifications current

Data retention policy documented

Incident response plan written

Annual third-party compliance audit

100% remote work capability

Redundant communication tools

All critical documents cloud-accessible

Vendor continuity & SLA guarantees

Quarterly BC drills documented

24/7 monitoring of critical systems

Automated alert escalation

Performance baselines established

AI-powered anomaly detection

Documented response SLAs

AI agents handling routine tasks

Automated failover without manual intervention

ML models predicting failures

Self-healing infrastructure

System learning from past incidents

Pre-hurricane seasonal checklist

Backup generator fuel verified

Dual carriers confirmed operational

Staff trained on emergency procedures

Critical hardware/software pre-positioned