The business continuity plan focuses on maintaining the organization’s tasks and business processes during and after the interruption. An example of a business process can be an organization’s payroll process or a customer service process. Business continuity plans can be written for tasks/business processes within a single business unit or the entire organization’s processes.
The focus is to restore an organization’s basic functions in another location and ensure that these can only operate normally for 30 days before normal operations are restored. The business continuity plan can handle other functions or functions at the field office level.
The organization should use a crisis communication plan to document standard procedures for internal and external communication in an outage event. A crisis communication plan is usually developed by an organization responsible for public outreach. The plan provides various communication formats suitable for events. Crisis communication plans usually designate specific individuals as the sole authority to answer public questions or provide the public with information about emergency response.
Hi Zibai, Crisis communication plan should be prepared from the company in case there is a crisis that will damage the business’s continuity. Sometimes it will have authority conflict with the public relation department, but they should be working together when a crisis happened.
One of the kind of business continuity plane is cyber incident response plane. It establishes procedures to address cyber attacks against an organization’s information system. These procedures are designed to enable security personnel to identify, mitigate, and recover from malicious computer incidents, such as unauthorized access to a system or data which includes malicious logic, such as virus, worm, or Trojan horse. The purpose of the plane is to provide procedures for mitigating and correcting a cyber attacks, such as virus, worms, or Trojan horse. The scope of the plane is to addresses mitigation and isolation of affected systems, cleanup, and minimizing loss of information. The plan relationship is that information system focused plan that may activate an ISCP or DRP depending on the extent of the attack.
Information system contingency planning represents a broad scope of activities designed to sustain and recover critical system services following an emergency event. There are several other different plan, and their purpose and scope relative to information system contingency planning. One of them is Disaster Recovery Plan (DRP), which provides procedures for relocating information systems operations to an alternate location. The DRP will help an organization resolve data loss and recover system functionality, and ensure that it can perform after an incident. Before develop the Disaster Recovery Plan, the organization need to implement a business impact analysis and risk analysis, because disaster recovery planning usually involves an analysis of business processes and continuity needs.
Hi, Xinyi, thank you for sharing your sharing, I’d like to add a point to you, This document will following seven-step contingency planning process that an organization may apply to develop and maintain a viable contingency planning program for their information systems. These seven progressive steps are designed to be integrated into each stage of the system development life cycle.
Disaster recovery plan (DRP) is a documented and structured approach that describes how an organization can recover and restore system functionality, data, and infrastructure to quickly resume work after an unplanned incident. Absence of a disaster recovery plan will pose many risks such as: inability for the company to operate effectively, inability to recover systems and data in the event of a disaster, inability to recover from financial loss, and reputational damage for poor handling of the disaster. DRP plan is important as it contains strategies to minimize the effects of a disaster so the organization can continue its operations. Typical steps in a DRP plan are as follows:
• Data gathering
• Business impact analysis
• Risk analysis
• Recovery strategies
• Build DRP plan
• Test and validate DRP plans
• Establish plan maintenance
• Audit and update plans
Hi Priyanka,
I agree with your opinion. IT departments often spend a lot of time designing and analyzing physical disaster recovery computing environments, rather than adding value through coding and testing. To test a disaster recovery plan, the data center team tests the requirements, receive, frame, stack, and install hardware with the associated operating system and all the latest patches. They create disaster recovery user accounts, deploy frameworks or application server environments, and install test tools. Programmers can spend half their time on common disaster recovery infrastructure problems, rather than on actual test programs.
Great summary on the disaster recovery plan. It is one of the most important items for a system to have because there is always the potential for it to fail at any moment. Without a proper plan in place the business can be affected tremendously in loss in profits, reputational, and more.
It is very important to have contingency strategies for not only large organizations but also small companies. One of the big risk areas where many small companies do not back up regularly. Since they do not have a hug of activities and employees, they think that it is not necessary to implement a backup plan, or they even do not have relevant information system policy to support the security requirements. When they create a business contingency plan, they most often consider cost-effect, including software, hardware, testing, training programs, awareness programs, and labor hours, etc. Additionally, some employees do not have awareness of information security because the companies do not provide a thorough training program. It could be a big risk area where the companies need to eliminate it and improve security. It is dependent on the management decisions how it wants to employ.
I learned about the scope of the Information System Contingency Plan and how the plan basically covers activation and notification of the plan, recovery of the system and reconstitution of the system. The scope of the plan is to recover the system within the recovery time objectives outlined in the scope and that it does not cover replacement or purchase of new equipment or short term disruptions lasting less than the recovery time objectives or the loss of data at onsite facility or at user desktop levels. Also the plan includes assumptions that the impact level of system is high, alternate processing sites established, current backups of software and data are intact and available at the offsite storage facility, alternate facilities are established and available, system is inoperable and cannot be recovered in RTO and key personnel have been identified and trained in their recovery roles. It is interesting to me that the plan is so carefully templated and that variation is limited across agencies.
In addition to the Business Continuity Plan and Disaster Recovery plan we’ve previously learned, there are many other types of plans that an organization might want to consider. One major plan is the Cyber Incident Response Plan (CIRP). This plan is in place to determine how best to solve issues of cyber attacks on an organization’s information systems. This includes unauthorized access, DoS attacks, malware, and Trojans and viruses. A part of this plan could be security awareness training, as phishing email scams could provide the credentials to allow some cyber attacks to occur. If the attack is severe enough, this could trigger the DRP. The goal of any BCP is to make sure what is essential stays operational, and the goal of the DRP is to fix things as soon as possible to make sure the organization can go back to a 100% operational state.
Hi Krish…..I agree with you….I learned about different plan types that all support Business Contingency planning and differentiating between a recovery of a system due to new or faulty hardware requiring replacement, software needing upgraded or patched and an outage due to a cybersecurity event or an availability issue. The difference in scope for the various plan types was what interested me.
The business impact analysis is one key component of a business continuity plan. It’s goal is to determine critical business processes that a system supports and the impact if the system is disrupted. Additionally, it allows the business to determine key metrics such as RPO and RTO. Another benefit of the BIA is that it helps identify key resources that needs to be involved in the recovery process. An organization can use this information to establish a plan in the event of a disaster and quickly restore key business processes that are needed for daily operations.
Great points! Business impact analysis helps in identifying situations that could potentially cause losses to the business. The business can then come up with a place for investment for recovering, mitigation and prevention strategies. Five phases of a business impact analysis are:
1. Preparation
2. Information gathering
3. Information review & analysis
4. BIA report creation
5. BIA recommendation implementation
Within this document you can gain the knowledge to develop a thorough business contingency plan. One part of this document which is interesting is the concept of alternate sites. With today’s environment, many homes are now ‘hot sites’. This is because many homes have sufficient broadband speed and powerful enough laptops to allow them to perform their duties remotely. With so many cloud providers and end users being able to work from anywhere, the business contingency plan and the concept of cold/warm/hot sites seem to be evolving everyday.
I agree with your assessment. Especially in the post-pandemic world, more and more workers rely solely on remote access to perform their work. The problem is making sure the necessary security protocols are in place for remote work to be done safely, as even though our home bandwidths are sufficient, they are not enterprise level security networks.
NIST Special Publication 800-34, Rev. 1, Contingency Planning Guide for Federal Information Systems, provides instructions, recommendations, and considerations for federal information system contingency planning. And this guide addresses specific contingency planning recommendations for three platform types and provides strategies and techniques common to all systems: 1, Client/server systems; 2.Telecommunications systems; and 3. Mainframe systems. Also, This guide defines the following seven-step contingency planning process that an organization may apply to develop and maintain a viable contingency planning program for their information systems. These seven progressive steps are designed to be integrated into each stage of the system development life cycle. The Activation/Notification Phase describes the process of activating the plan based on outage impacts and notifying recovery personnel. The Recovery Phase details a suggested course of action for recovery teams to restore system operations at an alternate site or using contingency capabilities. The Reconstitution, includes activities to test and validate system capability and functionality and outlines actions that can be taken to return the system to normal operating condition and prepare the system against future outages.
NIST SP800-34 describes the basic elements and process of emergency response plan of information system, focuses on the special consideration and influence of emergency response plan for different types of information system, and assists users to make their own emergency response plan of information security through examples. ITL improves the development and production application of information technology through development tests, test methodologies, reference data, proof-of-concept, and technical analysis. ITL’s responsibilities include the development of technical, physical, administrative, and administrative standards and guidelines applicable to federal computer systems to provide cost-effective security and privacy protection for sensitive information. IT contingency planning refers to the dynamic formulation of a strategy for recovering systems, operations, and data after an IT system outage (critical applications or common support systems). The planning process involves seven steps: developing the contingency plan policy terms, performing a business impact analysis (BIA), defining defensive controls, developing a recovery strategy, developing an IT contingency plan, testing and drill plans and training personnel, and a maintenance plan.
The planning process for the IS contingency plan is very thorough and important to each organization, regardless if they ever have to use the plan. The process of developing a plan like this is detailed and has to go over multiple scenarios. It starts with the identification regulatory requirements, thus helping the organization start to form a skeleton of the things that absolutely have to be covered. Many times people overlook the importance of this plan as they look at it as it is there to save the company and while that is true we tend to forget those that invest in the company. If the company goes down because they have an inadequate plan there are going to be many investors that are going to lose large investments that they trusted the company with.
The NIST SP 800-34 Emergency Planning Guide provides detailed information on the planning principles necessary to develop effective emergency response capabilities, business impact analysis, and other site selection and recovery strategies. One of the advantages of this standard is its detailed description of how to embed emergency plans into the development life cycle of information systems. In Appendix F, it is stated that the identification and integration of emergency strategies should be implemented at all stages of the SDLC. This method allows the owner to implement hierarchical security protection in the early stages of system development, as well as implement effective recovery strategies. In addition, when implementing contingency plans, it can reduce costs and reduce the potential impact on business processes.
NIST SP 800-34 is the golden standard for contingency planning. The seven steps of this guideline provide a consistent approach for companies to use to most effectively a holistically prevent and manage an incident.
– Contingency planning statement
– BIA – identifying and prioritizing the IT systems and components critical to the business
– Preventative controls – analysis of methods and controls to put in place to reduce risk and vulnerable areas.
– IS Contingency Plan – guidance an procedures for the restoration of the system
– Testing, training and exercise – revision of the plan, continued testing of the plan, training employees, and running through table top exercises.
– Plan Maintenance – continuous update including analysis of the current business environment and the processes.
This guide provides templates for the use of the organization and mapping to various documents that are used in support.
Hi Vanessa,
By reading what you have obtained from the NIST 800-34 publication, I am more confident in my current understanding of some of the general concepts covered in the document. Among the same procedures you listed for contingency planning, I found that the most interesting areas to briefly study include the development of contingency strategies and the development of contingency planning policies.
One of the topics that I found interesting is Maximum Tolerable Downtime (MTD). As per NIST sp 800 34R1, The MTD represents the total amount of time the system owner/authorizing official is willing to accept for a mission/business process outage or disruption and includes all impact considerations. Determining MTD is important because it could leave contingency planners with imprecise direction on selection of an appropriate recovery method, and the depth of detail which will be required when developing recovery procedures, including their scope and content.
Hi Prince, one way the organization is able to effectively plan its disaster recovery is by having clear metrics in place. Having maximum tolerable downtime, recovery time objectives, and recovery point objectives are all highly important metrics the organization can use to prioritize how resources should be distributed during recovery. As part of the BIA, the organization can have a clearer picture of what assets are high priority and how quickly they must be back online to conduct day-to-day business.
It’s essential for organizations to have the ability to withstand all hazards and sustain its mission through environmental changes Physical security refers to the protection of building sites and equipment (and all information and software contained in them) from theft, vandalism, natural disaster, man-made catastrophes, and accidental damage There are many threats organizations face when implementing physical security. Environmental Threats, Technical Threats and Human Caused threats. Environmental threats refers to the conditions in the environment that can damage and interrupt service. Organizations should focus on reducing vulnerabilities to reduce the impact of environmental threats. Ensuring that computer systems are kept between 50-90 degree Fahrenheit. HVAC systems and system cooling mechanisms should be in place to keep systems at the recommended temperatures. Fire and smoke detectors should be in place to prevent and reduce damage from fire. Automatic should be implemented along with a gas fire suppression (Halon) to prevent systems from getting water damage. This form of fire suppression is recommended in server rooms or rooms with a significant amount of electrical equipment. Organizations should also focus on reducing the impact of Human Caused Threats. Unauthorized access, theft and vandalism are human caused threats. Organizations should place locks in sensitive areas, require escort for any one outside of the company and install security cameras. Organizations focusing on these vulnerabilities will significantly reduce the impact of a threat.
NIST sp 800-34 is a federal information system emergency planning guide. This guide provides temporary measures and emergency plans for the recovery of information system services after interruption. By standardizing the steps of defining the emergency planning process, this paper puts forward suggestions for different platform types of systems (client / server system, telecommunication system and mainframe system), and helps organizations to take specific measures after downtime, so as to minimize the adverse effects of downtime and restore the normal operation of the system.
One extremely important part of disaster recovery plan is backups. System data should be backed up regularly. Policies should specify the minimum frequency and scope of backups (e.g., daily or weekly, incremental or full) based on data criticality and the frequency that new information is introduced. Data may be backed up on magnetic disk, tape, or optical disks, such as compact disks (CDs). The specific method chosen for conducting backups should be based on system and data availability and integrity requirements. Best practices suggest to store back-up data offsite. Large back-up facilities are designed to withstand many threatening events such as fires, hurricanes, and electrical shortage. It is important to choose a reliable location for off site data. While many facilities safe guard against many natural disasters, none of them or 100%. It is best to choose a site that has a history of minimal natural disasters.
An organization must have sufficient contingency planning and resilience, The organization must have the ability to withstand all hazards sustain and even environmental impacts that may occur during operation. Rather than just identifying and mitigating these issues as they happen, the organization should build a resilient infrastructure to minimize the disruption and impacts. To plan for contingency effectively, the firm must partake in a business impact analysis, based on FIPs 199. This will have to determine the information and information system impact of the organization’s operations, assets, and individuals through the three security objectives: confidentiality, integrity, and availability.
The benefits of a BIA will help score the organizations’ assets and help develop the infrastructure around protecting the assets with the highest impact levels.
(ex High-availability options are normally expensive to set up, operate, and maintain and should be considered only for those high-impact
information systems categorized with a high-availability security objective. Lower-impact information systems may be able to use less expensive contingency options and tolerate longer downtimes for recovery or restoration of data.)
The business continuity plan focuses on maintaining the organization’s tasks and business processes during and after the interruption. An example of a business process can be an organization’s payroll process or a customer service process. Business continuity plans can be written for tasks/business processes within a single business unit or the entire organization’s processes.
The focus is to restore an organization’s basic functions in another location and ensure that these can only operate normally for 30 days before normal operations are restored. The business continuity plan can handle other functions or functions at the field office level.
The organization should use a crisis communication plan to document standard procedures for internal and external communication in an outage event. A crisis communication plan is usually developed by an organization responsible for public outreach. The plan provides various communication formats suitable for events. Crisis communication plans usually designate specific individuals as the sole authority to answer public questions or provide the public with information about emergency response.
Hi Zibai, Crisis communication plan should be prepared from the company in case there is a crisis that will damage the business’s continuity. Sometimes it will have authority conflict with the public relation department, but they should be working together when a crisis happened.
One of the kind of business continuity plane is cyber incident response plane. It establishes procedures to address cyber attacks against an organization’s information system. These procedures are designed to enable security personnel to identify, mitigate, and recover from malicious computer incidents, such as unauthorized access to a system or data which includes malicious logic, such as virus, worm, or Trojan horse. The purpose of the plane is to provide procedures for mitigating and correcting a cyber attacks, such as virus, worms, or Trojan horse. The scope of the plane is to addresses mitigation and isolation of affected systems, cleanup, and minimizing loss of information. The plan relationship is that information system focused plan that may activate an ISCP or DRP depending on the extent of the attack.
Information system contingency planning represents a broad scope of activities designed to sustain and recover critical system services following an emergency event. There are several other different plan, and their purpose and scope relative to information system contingency planning. One of them is Disaster Recovery Plan (DRP), which provides procedures for relocating information systems operations to an alternate location. The DRP will help an organization resolve data loss and recover system functionality, and ensure that it can perform after an incident. Before develop the Disaster Recovery Plan, the organization need to implement a business impact analysis and risk analysis, because disaster recovery planning usually involves an analysis of business processes and continuity needs.
Hi, Xinyi, thank you for sharing your sharing, I’d like to add a point to you, This document will following seven-step contingency planning process that an organization may apply to develop and maintain a viable contingency planning program for their information systems. These seven progressive steps are designed to be integrated into each stage of the system development life cycle.
Disaster recovery plan (DRP) is a documented and structured approach that describes how an organization can recover and restore system functionality, data, and infrastructure to quickly resume work after an unplanned incident. Absence of a disaster recovery plan will pose many risks such as: inability for the company to operate effectively, inability to recover systems and data in the event of a disaster, inability to recover from financial loss, and reputational damage for poor handling of the disaster. DRP plan is important as it contains strategies to minimize the effects of a disaster so the organization can continue its operations. Typical steps in a DRP plan are as follows:
• Data gathering
• Business impact analysis
• Risk analysis
• Recovery strategies
• Build DRP plan
• Test and validate DRP plans
• Establish plan maintenance
• Audit and update plans
Hi Priyanka,
I agree with your opinion. IT departments often spend a lot of time designing and analyzing physical disaster recovery computing environments, rather than adding value through coding and testing. To test a disaster recovery plan, the data center team tests the requirements, receive, frame, stack, and install hardware with the associated operating system and all the latest patches. They create disaster recovery user accounts, deploy frameworks or application server environments, and install test tools. Programmers can spend half their time on common disaster recovery infrastructure problems, rather than on actual test programs.
Hi Priyanka,
Great summary on the disaster recovery plan. It is one of the most important items for a system to have because there is always the potential for it to fail at any moment. Without a proper plan in place the business can be affected tremendously in loss in profits, reputational, and more.
It is very important to have contingency strategies for not only large organizations but also small companies. One of the big risk areas where many small companies do not back up regularly. Since they do not have a hug of activities and employees, they think that it is not necessary to implement a backup plan, or they even do not have relevant information system policy to support the security requirements. When they create a business contingency plan, they most often consider cost-effect, including software, hardware, testing, training programs, awareness programs, and labor hours, etc. Additionally, some employees do not have awareness of information security because the companies do not provide a thorough training program. It could be a big risk area where the companies need to eliminate it and improve security. It is dependent on the management decisions how it wants to employ.
I learned about the scope of the Information System Contingency Plan and how the plan basically covers activation and notification of the plan, recovery of the system and reconstitution of the system. The scope of the plan is to recover the system within the recovery time objectives outlined in the scope and that it does not cover replacement or purchase of new equipment or short term disruptions lasting less than the recovery time objectives or the loss of data at onsite facility or at user desktop levels. Also the plan includes assumptions that the impact level of system is high, alternate processing sites established, current backups of software and data are intact and available at the offsite storage facility, alternate facilities are established and available, system is inoperable and cannot be recovered in RTO and key personnel have been identified and trained in their recovery roles. It is interesting to me that the plan is so carefully templated and that variation is limited across agencies.
In addition to the Business Continuity Plan and Disaster Recovery plan we’ve previously learned, there are many other types of plans that an organization might want to consider. One major plan is the Cyber Incident Response Plan (CIRP). This plan is in place to determine how best to solve issues of cyber attacks on an organization’s information systems. This includes unauthorized access, DoS attacks, malware, and Trojans and viruses. A part of this plan could be security awareness training, as phishing email scams could provide the credentials to allow some cyber attacks to occur. If the attack is severe enough, this could trigger the DRP. The goal of any BCP is to make sure what is essential stays operational, and the goal of the DRP is to fix things as soon as possible to make sure the organization can go back to a 100% operational state.
Hi Krish…..I agree with you….I learned about different plan types that all support Business Contingency planning and differentiating between a recovery of a system due to new or faulty hardware requiring replacement, software needing upgraded or patched and an outage due to a cybersecurity event or an availability issue. The difference in scope for the various plan types was what interested me.
The business impact analysis is one key component of a business continuity plan. It’s goal is to determine critical business processes that a system supports and the impact if the system is disrupted. Additionally, it allows the business to determine key metrics such as RPO and RTO. Another benefit of the BIA is that it helps identify key resources that needs to be involved in the recovery process. An organization can use this information to establish a plan in the event of a disaster and quickly restore key business processes that are needed for daily operations.
Hi Anthony,
Great points! Business impact analysis helps in identifying situations that could potentially cause losses to the business. The business can then come up with a place for investment for recovering, mitigation and prevention strategies. Five phases of a business impact analysis are:
1. Preparation
2. Information gathering
3. Information review & analysis
4. BIA report creation
5. BIA recommendation implementation
Within this document you can gain the knowledge to develop a thorough business contingency plan. One part of this document which is interesting is the concept of alternate sites. With today’s environment, many homes are now ‘hot sites’. This is because many homes have sufficient broadband speed and powerful enough laptops to allow them to perform their duties remotely. With so many cloud providers and end users being able to work from anywhere, the business contingency plan and the concept of cold/warm/hot sites seem to be evolving everyday.
Hi Jonathan,
I agree with your assessment. Especially in the post-pandemic world, more and more workers rely solely on remote access to perform their work. The problem is making sure the necessary security protocols are in place for remote work to be done safely, as even though our home bandwidths are sufficient, they are not enterprise level security networks.
NIST Special Publication 800-34, Rev. 1, Contingency Planning Guide for Federal Information Systems, provides instructions, recommendations, and considerations for federal information system contingency planning. And this guide addresses specific contingency planning recommendations for three platform types and provides strategies and techniques common to all systems: 1, Client/server systems; 2.Telecommunications systems; and 3. Mainframe systems. Also, This guide defines the following seven-step contingency planning process that an organization may apply to develop and maintain a viable contingency planning program for their information systems. These seven progressive steps are designed to be integrated into each stage of the system development life cycle. The Activation/Notification Phase describes the process of activating the plan based on outage impacts and notifying recovery personnel. The Recovery Phase details a suggested course of action for recovery teams to restore system operations at an alternate site or using contingency capabilities. The Reconstitution, includes activities to test and validate system capability and functionality and outlines actions that can be taken to return the system to normal operating condition and prepare the system against future outages.
NIST SP800-34 describes the basic elements and process of emergency response plan of information system, focuses on the special consideration and influence of emergency response plan for different types of information system, and assists users to make their own emergency response plan of information security through examples. ITL improves the development and production application of information technology through development tests, test methodologies, reference data, proof-of-concept, and technical analysis. ITL’s responsibilities include the development of technical, physical, administrative, and administrative standards and guidelines applicable to federal computer systems to provide cost-effective security and privacy protection for sensitive information. IT contingency planning refers to the dynamic formulation of a strategy for recovering systems, operations, and data after an IT system outage (critical applications or common support systems). The planning process involves seven steps: developing the contingency plan policy terms, performing a business impact analysis (BIA), defining defensive controls, developing a recovery strategy, developing an IT contingency plan, testing and drill plans and training personnel, and a maintenance plan.
The planning process for the IS contingency plan is very thorough and important to each organization, regardless if they ever have to use the plan. The process of developing a plan like this is detailed and has to go over multiple scenarios. It starts with the identification regulatory requirements, thus helping the organization start to form a skeleton of the things that absolutely have to be covered. Many times people overlook the importance of this plan as they look at it as it is there to save the company and while that is true we tend to forget those that invest in the company. If the company goes down because they have an inadequate plan there are going to be many investors that are going to lose large investments that they trusted the company with.
The NIST SP 800-34 Emergency Planning Guide provides detailed information on the planning principles necessary to develop effective emergency response capabilities, business impact analysis, and other site selection and recovery strategies. One of the advantages of this standard is its detailed description of how to embed emergency plans into the development life cycle of information systems. In Appendix F, it is stated that the identification and integration of emergency strategies should be implemented at all stages of the SDLC. This method allows the owner to implement hierarchical security protection in the early stages of system development, as well as implement effective recovery strategies. In addition, when implementing contingency plans, it can reduce costs and reduce the potential impact on business processes.
NIST SP 800-34 is the golden standard for contingency planning. The seven steps of this guideline provide a consistent approach for companies to use to most effectively a holistically prevent and manage an incident.
– Contingency planning statement
– BIA – identifying and prioritizing the IT systems and components critical to the business
– Preventative controls – analysis of methods and controls to put in place to reduce risk and vulnerable areas.
– IS Contingency Plan – guidance an procedures for the restoration of the system
– Testing, training and exercise – revision of the plan, continued testing of the plan, training employees, and running through table top exercises.
– Plan Maintenance – continuous update including analysis of the current business environment and the processes.
This guide provides templates for the use of the organization and mapping to various documents that are used in support.
Hi Vanessa,
By reading what you have obtained from the NIST 800-34 publication, I am more confident in my current understanding of some of the general concepts covered in the document. Among the same procedures you listed for contingency planning, I found that the most interesting areas to briefly study include the development of contingency strategies and the development of contingency planning policies.
One of the topics that I found interesting is Maximum Tolerable Downtime (MTD). As per NIST sp 800 34R1, The MTD represents the total amount of time the system owner/authorizing official is willing to accept for a mission/business process outage or disruption and includes all impact considerations. Determining MTD is important because it could leave contingency planners with imprecise direction on selection of an appropriate recovery method, and the depth of detail which will be required when developing recovery procedures, including their scope and content.
Hi Prince, one way the organization is able to effectively plan its disaster recovery is by having clear metrics in place. Having maximum tolerable downtime, recovery time objectives, and recovery point objectives are all highly important metrics the organization can use to prioritize how resources should be distributed during recovery. As part of the BIA, the organization can have a clearer picture of what assets are high priority and how quickly they must be back online to conduct day-to-day business.
It’s essential for organizations to have the ability to withstand all hazards and sustain its mission through environmental changes Physical security refers to the protection of building sites and equipment (and all information and software contained in them) from theft, vandalism, natural disaster, man-made catastrophes, and accidental damage There are many threats organizations face when implementing physical security. Environmental Threats, Technical Threats and Human Caused threats. Environmental threats refers to the conditions in the environment that can damage and interrupt service. Organizations should focus on reducing vulnerabilities to reduce the impact of environmental threats. Ensuring that computer systems are kept between 50-90 degree Fahrenheit. HVAC systems and system cooling mechanisms should be in place to keep systems at the recommended temperatures. Fire and smoke detectors should be in place to prevent and reduce damage from fire. Automatic should be implemented along with a gas fire suppression (Halon) to prevent systems from getting water damage. This form of fire suppression is recommended in server rooms or rooms with a significant amount of electrical equipment. Organizations should also focus on reducing the impact of Human Caused Threats. Unauthorized access, theft and vandalism are human caused threats. Organizations should place locks in sensitive areas, require escort for any one outside of the company and install security cameras. Organizations focusing on these vulnerabilities will significantly reduce the impact of a threat.
NIST sp 800-34 is a federal information system emergency planning guide. This guide provides temporary measures and emergency plans for the recovery of information system services after interruption. By standardizing the steps of defining the emergency planning process, this paper puts forward suggestions for different platform types of systems (client / server system, telecommunication system and mainframe system), and helps organizations to take specific measures after downtime, so as to minimize the adverse effects of downtime and restore the normal operation of the system.
One extremely important part of disaster recovery plan is backups. System data should be backed up regularly. Policies should specify the minimum frequency and scope of backups (e.g., daily or weekly, incremental or full) based on data criticality and the frequency that new information is introduced. Data may be backed up on magnetic disk, tape, or optical disks, such as compact disks (CDs). The specific method chosen for conducting backups should be based on system and data availability and integrity requirements. Best practices suggest to store back-up data offsite. Large back-up facilities are designed to withstand many threatening events such as fires, hurricanes, and electrical shortage. It is important to choose a reliable location for off site data. While many facilities safe guard against many natural disasters, none of them or 100%. It is best to choose a site that has a history of minimal natural disasters.
An organization must have sufficient contingency planning and resilience, The organization must have the ability to withstand all hazards sustain and even environmental impacts that may occur during operation. Rather than just identifying and mitigating these issues as they happen, the organization should build a resilient infrastructure to minimize the disruption and impacts. To plan for contingency effectively, the firm must partake in a business impact analysis, based on FIPs 199. This will have to determine the information and information system impact of the organization’s operations, assets, and individuals through the three security objectives: confidentiality, integrity, and availability.
The benefits of a BIA will help score the organizations’ assets and help develop the infrastructure around protecting the assets with the highest impact levels.
(ex High-availability options are normally expensive to set up, operate, and maintain and should be considered only for those high-impact
information systems categorized with a high-availability security objective. Lower-impact information systems may be able to use less expensive contingency options and tolerate longer downtimes for recovery or restoration of data.)