Business Continuity for Confluence

Confluence Business Continuity Plan

The evidence a business continuity plan can show for Confluence — a copy outside the platform, proof it is current, and a tested restore — produced by acs2md and acp2md as files you control.

Teams working under ISO 9001, ISO 27001 and ISO 27017, SOC 2 or NIS 2 need more than an export. They need backups that are verified, recoveries that are rehearsed, and records they can hand to an auditor. Climakers is not certified under these frameworks; the tools produce the artefacts your own controls rely on.

Three things a plan must prove

Each one maps to a command that runs on your machine and leaves a file behind.

A readable copy outside Confluence

acs2md space convert --sync keeps a Markdown continuity copy of every space in Git, an archive or a static site, readable when Confluence is not. acp2md page convert does the same for the pages a plan names explicitly.

A current, verified backup

acs2md space get writes a native backup with attachments, labels, properties and a manifest. acs2md space check --fail-on-drift compares it with the live space every night and fails loudly, with a JSON record, when anything drifted.

A tested way back

acs2md space restore --create-space rehearses recovery into a scratch space without touching the original; page restore does it for one page. Both show their plan first, resume if interrupted and never delete anything.

How the evidence maps to common frameworks

Clause references use the public control titles. Your plan decides which apply, and your auditor decides what satisfies them.

ISO/IEC 27001:2022

A.8.13 Information backup, A.5.29 Information security during disruption and A.5.30 ICT readiness for business continuity: verified backups, a readable copy during disruption and a rehearsed restore.

ISO/IEC 27017

Cloud-service guidance that shares backup responsibility between provider and customer: Atlassian keeps Confluence running; the customer keeps the copy.

SOC 2 (Availability)

Backup processes and recovery infrastructure, and criterion A1.3 on tested recovery plan procedures: the quarterly restore into a scratch space is the test, its JSON check the record.

NIS 2, Article 21(2)(c)

Business continuity, such as backup management and disaster recovery: scheduled backups, verification that fails loudly, and a documented, rehearsed restore.

ISO 9001:2015, clause 7.5.3

Control of documented information: availability, protection and retention of the procedures, policies and records a quality system keeps in Confluence.

Climakers itself is not certified under SOC 2, ISO 27001, ISO 27017 or other equivalent attestations. References to these frameworks describe the design intent of the tools and are not a representation of certification; customers remain responsible for their own assessments, evidence and controls.

The evidence, as commands

Four scheduled runs cover a space. Keep the directory on storage you control and retain the JSON records for your retention period.

Nightly: a restorable native backup

$ acs2md space get by-key DOCS --output-dir /backups

Nightly: verify it, keep the record

$ acs2md space check by-key DOCS --backup-dir /backups --fail-on-drift -f json > /backups/DOCS.check.json

Quarterly: rehearse recovery into a scratch space

$ acs2md space restore by-key DOCS-DR --backup-dir /backups/DOCS --create-space --mode all --yes

Weekly: a readable continuity copy

$ acs2md space convert by-key DOCS --output-dir /continuity --sync

Access review belongs in the same plan: acs2md space permissions and space properties export who can reach each space. The full recipe, with the two cautions a rehearsal needs, is in the documentation.

Jira Automation is part of the plan too

Automation rules are the operational glue of a Jira site, and Jira keeps no copy of them you own. ajat exports every rule to JSON, detects drift between snapshots, grades risk, and restores rules with a confirmation-first import.

Start with the scope your plan names

A whole documentation estate or a handful of critical pages: the commands, the licence model and the evidence they leave behind are the same.