Best Practices for Disaster Recovery & Incident Response Playbooks in Prisma SASE

[deepakkumar29]

Hello Community,

We are reviewing our operational resilience and incident response processes for our Prisma SASE environment and would like to understand industry best practices.

We're currently looking to develop and mature playbooks covering scenarios such as:

• Prisma Access / Prisma SASE outages
• Service Connection failures
• Authentication provider outages (Entra ID / SAML / MFA)
• SIEM degradation or unavailability
• Logging and telemetry failures
• Cybersecurity incidents impacting Prisma SASE operations
• Regional or cloud provider outages

We would appreciate guidance on the following:

1. What disaster recovery (DR) scenarios do you typically include in your Prisma SASE operational playbooks?
2. Do Palo Alto provide any standard DR or Incident Response playbook templates for Prisma Access / Prisma SASE?
3. What recovery and validation steps do you perform for:
   • Service Connection failover
   • Prisma Access outages
   • Logging failures
   • Authentication failures
4. What RTO/RPO objectives have you defined for these services?
5. How frequently do you perform DR testing or tabletop exercises?
6. What evidence do you maintain for audit and customer assurance purposes?
7. Are there any lessons learned or recommendations from real-world incidents that would help improve these playbooks?

Any documentation references, operational experience, or best-practice recommendations would be greatly appreciated.