We have a backup and recover system - is this good enough or is there some specific standard needed to comply with the ISA?

Contingency planning is addressed in the NIST document 800-34, which can be found here:

http://csrc.nist.gov/publications/nistpubs/