What organizations are not required to have a recovery plan