By not having a DR/BCP, Primary and secondary Low Moderate Compliance with DTMB 1390.00 results in the Agency’s systems located in Policy - Information Technology inability to prepare for, different hosting Continuity of Business Planning. respond to, manage, and centers. recover from adverse Completion of Business Application events that may affect its Backups of system are Criticality Request (DTMB-208) by mission. performed and stored in Agency and DTMB/Agency off site location Services If the DR/BCP is not reviewed/updated at least Compliance with NIST 800-53; annually for CP-2 Contingency Plan system/Agency changes or CP-10 Info Systems Recovery and when problems are Reconstitution encountered during system implementation, Create and review the DR/BCP at 4. Lack of DR/BCP execution, or testing, the least annually to address and update plan may not accurately system/Agency changes, or reflect the mission, problems encountered during the functions, or business system implementation, execution or processes supported by the testing. Revise the plan necessary information system, and for these changes and communicate therefore not be a viable updates to appropriate plan and could result in: organizational elements responsible for related plans. Resource ramifications to Agency Efficiency ramifications to customer. Inability to provide required federal reports. 5. Lack of testing and DR/BCP must be Compliance with NIST 800-53; training of DR/BCP maintained in a of CP-3 Contingency Training & readiness, which must CP-4 Contingency Plan Testing and include having personnel Exercises trained to fulfill their roles and responsibilities within a plan, having plans exercised in a secure environment to validate their content, and having systems and system components tested to ensure their operability in an operational environment specified by the plan. Lack of a tested DR/BCP will hinder the Agency’s ability to prepare for, respond to, manage, and recover from adverse events that may affect its mission.
4. Lack of DR/BCP and update By not having a DR/BCP, results in the Agency’s inability to prepare for, respond to, manage, and recover from adverse events that may affect its mission. If the DR/BCP is not reviewed/updated at least annually for system/Agency changes or when problems are encountered during system implementation, execution, or testing, the plan may not accurately reflect the mission, functions, or business processes supported by the information system, and therefore not be a viable plan and could result in: Resource ramifications to Agency Efficiency ramifications to customer. Inability to provide required federal reports. Primary and secondary systems located in different hosting centers. Backups of system are performed and stored in off site location Low Moderate Compliance with DTMB 1390.00 Policy - Information Technology Continuity of Business Planning. Completion of Business Application Criticality Request (DTMB-208) by Agency and DTMB/Agency Services Compliance with NIST 800-53; CP-2 Contingency Plan CP-10 Info Systems Recovery and Reconstitution Create and review the DR/BCP at least annually to address system/Agency changes, or problems encountered during the system implementation, execution or testing. Revise the plan necessary for these changes and communicate updates to appropriate organizational elements responsible for related plans. 5. Lack of testing and training of DR/BCP DR/BCP must be maintained in a of readiness, which must include having personnel trained to fulfill their roles and responsibilities within a plan, having plans exercised in a secure environment to validate their content, and having systems and system components tested to ensure their operability in an operational environment specified by the plan. Lack of a tested DR/BCP will hinder the Agency’s ability to prepare for, respond to, manage, and recover from adverse events that may affect its mission. Compliance with NIST 800-53; CP-3 Contingency Training & CP-4 Contingency Plan Testing and Exercises