Yes, DR is very important, but not the topic of this thread.

I'm focusing on ISO 27001 standards which focus on information security.

For the moment, MS SQL Security best practices is what I'm guided by.