Key backup/DR procedures tested

NIST SC-12 requires that cryptographic key establishment and management procedures survive personnel and infrastructure changes. If the encryption key backup procedure exists only in one engineer's head — or in a document that has never been tested — a key loss event during an incident becomes unrecoverable data loss on top of the original incident. PCI-DSS 4.0 Req-3.7 requires key custodian procedures and documented key lifecycle controls. The FFIEC IT Handbook Business Continuity Planning section explicitly requires disaster recovery procedures be tested, not just documented. An untested DR procedure is a hypothesis, not a control.

Document the key backup and DR procedure explicitly, including the test cadence, and store it at a path your deployment checklist references (e.g., docs/key-dr-procedure.md):

# Encryption Key Backup & Disaster Recovery

## Key Storage
- Primary: AWS KMS (us-east-1, multi-region enabled to us-west-2)
- Backup: Offline HSM in secure facility

## Recovery Procedure
1. Authenticate to AWS Console with break-glass credentials
2. Retrieve CMK ARN from `docs/kms-inventory.md`
3. Verify multi-region replica in us-west-2 is active
4. Update application KMS_KEY_ID env var to replica ARN
5. Run `scripts/verify-decryption.ts` against known test ciphertext

## Test Log
| Date       | Tester    | Result | Notes              |
|------------|-----------|--------|--------------------|
| 2025-11-20 | Jane Doe  | PASS   | Replica activated  |

## Next test due: 2026-11-20

For cloud-managed KMS (AWS KMS, GCP Cloud KMS, Azure Key Vault), verify that multi-region replication is enabled in the console — this often satisfies the skip condition, but must be documented.