Fire suppression systems; Fire and smoke detectors; Water sensors in the computer room ceiling and floor; Heat-resistant and waterproof containers for backup media and vital non electronic records; Emergency master system shutdown switch; Offsite storage of backup media, non-electronic records, and system documentation; Technical security controls, such as cryptographic key management; and Frequent scheduled backups including the backups are stored (onsite or offsite) and how often they are recirculated and moved to storage. Step 4 Create Contingency Strategies – Contingency strategies are used to mitigate risks associated with the contingency planning family of controls in NIST SP 800-53, Rev 4, and may vary depending on the FIPS 199 impact level for the information system. As documented in NIST SP 800-34, these strategies generally cover the full range of backup, recovery, contingency planning, testing, and ongoing maintenance of the information system. Detailed backup and recovery guidance for implementing appropriate backup and recovery strategies to restore system operations following a disruption can be found in Section 3.4 of NIST 800-34. Step 5 Develop an Information System Contingency Plan – Development of the contingency plan is a critical step in the process of implementing a comprehensive contingency planning program. The plan contains detailed responsibilities, teams, and procedures associated with restoring an information system following a disruption. The CP documents the technical capabilities designed to support contingency operations. The CP format must follow NIST 800-34. CP templates for Low-, Moderate-, and High-impact systems are available in of this guide. The templates may be modified to accommodate system specific, operational, and/or organization requirements. The contingency plan has five main components as identified in Figure 2-2. The supporting information and plan appendices provide essential information to ensure a comprehensive plan. The Activation and Notification, Recovery, and Reconstitution Phases address specific actions that must be taken following a system disruption or emergency. Detailed CP development guidance can be found in Section 4 of NIST 800-34. Figure 22: Contingency Plan Structure Step 6 Ensure Plan Testing and Exercises – The contingency plan must be maintained routinely and exercised/tested at least annually to continually refine resumption and recovery procedures to reduce the potential for failure. Contingency plan tests aid in determining the plan’s overall effectiveness by enabling plan deficiencies to be identified and addressed by validating one or more of the system
Fire suppression systems; Fire and smoke detectors; Water sensors in the computer room ceiling and floor; Heat-resistant and waterproof containers for backup media and vital non electronic records; Emergency master system shutdown switch; Offsite storage of backup media, non-electronic records, and system documentation; Technical security controls, such as cryptographic key management; and Frequent scheduled backups including the backups are stored (onsite or offsite) and how often they are recirculated and moved to storage. Step 4 – Create Contingency Strategies Contingency strategies are used to mitigate risks associated with the contingency planning family of controls in NIST SP 800-53, Rev 4, and may vary depending on the FIPS 199 impact level for the information system. As documented in NIST SP 800-34, these strategies generally cover the full range of backup, recovery, contingency planning, testing, and ongoing maintenance of the information system. Detailed backup and recovery guidance for implementing appropriate backup and recovery strategies to restore system operations following a disruption can be found in Section 3.4 of NIST 800-34. Step 5 – Develop an Information System Contingency Plan Development of the contingency plan is a critical step in the process of implementing a comprehensive contingency planning program. The plan contains detailed responsibilities, teams, and procedures associated with restoring an information system following a disruption. The CP documents the technical capabilities designed to support contingency operations. The CP format must follow NIST 800-34. CP templates for Low-, Moderate-, and High-impact systems are available in of this guide. The templates may be modified to accommodate system specific, operational, and/or organization requirements. The contingency plan has five main components as identified in Figure 2-2. The supporting information and plan appendices provide essential information to ensure a comprehensive plan. The Activation and Notification, Recovery, and Reconstitution Phases address specific actions that must be taken following a system disruption or emergency. Detailed CP development guidance can be found in Section 4 of NIST 800-34. Figure 22: Contingency Plan Structure Step 6 – Ensure Plan Testing and Exercises The contingency plan must be maintained routinely and exercised/tested at least annually to continually refine resumption and recovery procedures to reduce the potential for failure. Contingency plan tests aid in determining the plan’s overall effectiveness by enabling plan deficiencies to be identified and addressed by validating one or more of the system
Contingency_Plan_CIO-IT_Security_(06-29)_Rev3__03-09-2016.docx