NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson Pauline Bowen Amy Wohl Phillips Dean Gallup David Lynes NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson Pauline Bowen Amy Wohl Phillips Dean Gallup David Lynes May 2010 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Director Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There are references in this publication to documents currently under development by NIST in accordance with responsibilities assigned to NIST under the Federal Information Security Management Act of 2002. The methodologies in this document may be used even before the completion of such companion documents. Thus, until such time as each document is completed, current requirements, guidelines, and procedures (where they exist) remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new documents by NIST. Individuals are also encouraged to review the public draft documents and offer their comments to NIST. All NIST documents mentioned in this publication, other than the ones noted above, are available at http://csrc.nist.gov/publications. National Institute of Standards and Technology Special Publication 800-34 Natl. Inst. Stand. Technol. Spec. Publ. 800-34, 150 pages (May 2010) CODEN: NSPUE2 CONTINGENCY PLANNING GUIDE FOR FEDERAL INFORMATION SYSTEMS Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. ii CONTINGENCY PLANNING GUIDE FOR FEDERAL INFORMATION SYSTEMS Authority This document has been developed by the National Institute of Standards and Technology (NIST) in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), \"Securing Agency Information Systems,\" as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III. This guideline has been prepared for use by federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright. Attribution would be appreciated by NIST. Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. NIST Special Publication 800-34, Revision 1, 150 pages (May 2010) National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 iii CONTINGENCY PLANNING GUIDE FOR FEDERAL INFORMATION SYSTEMS Compliance with NIST Standards and Guidelines NIST develops and issues standards, guidelines, and other publications to assist federal agencies in implementing the Federal Information Security Management Act (FISMA) of 2002 and in managing costeffective programs to protect their information and information systems. Guidance documents and recommendations are issued in the NIST Special Publication (SP) 800series. Office of Management and Budget (OMB) policies (including OMB FISMA Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management) state that, for other than national security programs and systems, agencies must follow NIST guidance. 1 1 Federal Information Processing Standards (FIPS) are developed by NIST in accordance with FISMA. FIPS are approved by the Secretary of Commerce and are compulsory and binding for federal agencies. Since FISMA requires that federal agencies comply with these standards, agencies may not waive their use. Other security-related publications, including NIST interagency and internal reports (NISTIRs) and ITL Bulletins, provide technical and other information about NIST's activities. These publications are mandatory only when so specified by OMB. While agencies are required to follow NIST guidance in accordance with OMB policy, there is flexibility within NIST's guidance in how agencies apply the guidance. Unless otherwise specified by OMB, the 800-series guidance documents published by NIST generally allow agencies some latitude in the application. Consequently, the application of NIST guidance by agencies can result in different security solutions that are equally acceptable, compliant with the guidance, and meet the OMB definition of adequate security for federal information systems. When assessing federal agency compliance with NIST guidance, auditors, evaluators, and assessors should consider the intent of the security concepts and principles articulated within the particular guidance document and how the agency applied the guidance in the context of its specific mission responsibilities, operational environments, and unique organizational conditions. iv CONTINGENCY PLANNING GUIDE FOR FEDERAL INFORMATION SYSTEMS Acknowledgements The authors, Marianne Swanson and Pauline Bowen of the National Institute of Standards and Technology (NIST), Amy Wohl Phillips, Dean Gallup, and David Lynes of Booz Allen Hamilton, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content. The authors would like to acknowledge Kelley Dempsey, Esther Katzman, Peter Mell, Murugiah Souppaya, Lee Badger, and Elizabeth Lennon of NIST, and David Linthicum of Booz Allen Hamilton for their keen and insightful assistance with technical issues throughout the development of the document. v CONTINGENCY PLANNING GUIDE FOR FEDERAL INFORMATION SYSTEMS Table of Contents Executive Summary....................................................................................................................1 Chapter 1. 1.1 1.2 1.3 1.4 Introduction ....................................................................................................1 Purpose....................................................................................................................... 1 Scope.......................................................................................................................... 2 Audience ..................................................................................................................... 3 Document Structure .................................................................................................... 4 Chapter 2. Background ....................................................................................................5 2.1 Contingency Planning and Resilience ........................................................................ 5 2.2 Types of Plans ............................................................................................................ 7 2.2.1 Business Continuity Plan (BCP) ......................................................................8 2.2.2 Continuity of Operations (COOP) Plan............................................................8 2.2.3 Crisis Communications Plan............................................................................9 2.2.4 Critical Infrastructure Protection (CIP) Plan.....................................................9 2.2.5 Cyber Incident Response Plan ......................................................................10 2.2.6 Disaster Recovery Plan (DRP) ......................................................................10 2.2.7 Information System Contingency Plan (ISCP)...............................................10 2.2.8 Occupant Emergency Plan (OEP).................................................................10 Chapter 3. Information System Contingency Planning Process................................13 3.1 Develop the Contingency Planning Policy Statement ............................................... 14 3.2 Conduct the Business Impact Analysis (BIA)............................................................ 15 3.2.1 Determine Business Processes and Recovery Criticality..............................16 3.2.2 Identify Resource Requirements ...................................................................19 3.2.3 Identify System Resource Recovery Priorities ..............................................19 3.3 Identify Preventive Controls ...................................................................................... 19 3.4 Create Contingency Strategies ................................................................................. 20 3.4.1 Backup and Recovery ...................................................................................20 3.4.2 Backup Methods and Offsite Storage............................................................21 3.4.3 Alternate Sites ...............................................................................................21 3.4.4 Equipment Replacement ...............................................................................24 3.4.5 Cost Considerations ......................................................................................25 3.4.6 Roles and Responsibilities ............................................................................26 3.5 Plan Testing, Training, and Exercises (TT&E) .......................................................... 27 3.5.1 Testing...........................................................................................................27 3.5.2 Training..........................................................................................................28 3.5.3 Exercises .......................................................................................................29 3.5.4 TT&E Program Summary ..............................................................................29 3.6 Plan Maintenance ..................................................................................................... 31 Chapter 4. Information System Contingency Plan Development...............................34 4.1 Supporting Information.............................................................................................. 35 4.2 Activation and Notification Phase ............................................................................. 36 4.2.1 Activation Criteria and Procedure..................................................................36 4.2.2 Notification Procedures .................................................................................36 4.2.3 Outage Assessment ......................................................................................38 4.3 Recovery Phase........................................................................................................ 39 4.3.1 Sequence of Recovery Activities ...................................................................39 vi CONTINGENCY PLANNING GUIDE FOR FEDERAL INFORMATION SYSTEMS 4.3.2 Recovery Procedures ....................................................................................39 4.3.3 Recovery Escalation and Notification ............................................................40 4.4 Reconstitution Phase ................................................................................................ 41 4.5 Plan Appendices ....................................................................................................... 42 Chapter 5. Technical Contingency Planning Considerations.....................................43 5.1 Common Considerations .......................................................................................... 43 5.1.1 Use of the BIA ...............................................................................................44 5.1.2 Maintenance of Data Security, Integrity, and Backup....................................44 5.1.3 Protection of Resources ................................................................................46 5.1.4 Adherence to Security Controls.....................................................................46 5.1.5 Identification of Alternate Storage and Processing Facilities.........................46 5.1.6 Use of High Availability (HA) Processes........................................................48 5.2 Client/Server Systems .............................................................................................. 48 5.2.1 Client/Server Systems Contingency Considerations .....................................49 5.2.2 Client/Server Systems Contingency Solutions ..............................................51 5.3 Telecommunications Systems .................................................................................. 52 5.3.1 Telecommunications Contingency Considerations........................................53 5.3.2 Telecommunications Contingency Solutions.................................................54 5.4 Mainframe Systems .................................................................................................. 56 5.4.1 Mainframe Contingency Considerations........................................................56 5.4.2 Mainframe Contingency Solutions.................................................................56 5.5 System Contingency Planning Considerations Summary......................................... 57 Appendix A Sample Information System Contingency Plan Templates ..................... A.1-1 A.1 A.2 A.3 Sample Template for Low-Impact Systems....................................................... A.1-1 Sample Template for Moderate-Impact Systems .............................................. A.2-1 Sample Template for High-Impact Systems ...................................................... A.3-1 Appendix B Sample Business Impact Analysis (BIA) and BIA Template ...................... B-1 Appendix C Frequently Asked Questions......................................................................... C-1 Appendix D Personnel Considerations in Continuity and Contingency Planning........ D-1 Appendix E Contingency Planning Controls .................................................................... E-1 Appendix F Contingency Planning and the System Development Life Cycle (SDLC).. F-1 Appendix G Glossary..........................................................................................................G-1 Appendix H Acronyms........................................................................................................ H-1 Appendix I Resources...........................................................................................................I-1 List of Figures Figure 2-1: Contingency-Related Plan Relationships ................................................................12 Figure 3-1: Contingency Planning Process................................................................................13 Figure 3-2: Business Impact Analysis Process for the Information System...............................16 Figure 3-3: Cost Balancing ........................................................................................................18 Figure 4-1: Contingency Plan Structure.....................................................................................34 vii CONTINGENCY PLANNING GUIDE FOR FEDERAL INFORMATION SYSTEMS Figure 4-2: Sample Call Tree.....................................................................................................37 Figure 4-3: Sample Recovery Process ......................................................................................40 Figure F-1: System Development Life Cycle ........................................................................... F-1 List of Tables Table 2-1: Summary of NIST SP 800-53 Contingency Planning Controls for Low-, Moderate-, and High-Impact Systems of Contingency-Related Plans.....................................................7 Table 2-2: Type of Plans.............................................................................................................11 Table 3-1: Information System Resource/Component Table .....................................................19 Table 3-2: FIPS 199 Category Backup & Strategy Examples....................................................20 Table 3-3: Sample Alternate Site Criteria ..................................................................................23 Table 3-4: Contingency Strategy Budget Planning Template ....................................................25 Table 3-5: ISCP TT&E Activities ................................................................................................30 Table 3-6: Sample Record of Changes......................................................................................32 Table 5-1: Summary ..................................................................................................................58 Table E-1: Summary of NIST SP 800-53 Contingency Planning Controls for Low-, Moderateand High- Impact Systems of Contingency-Related Plans................................................ E-1 Table F-1: CP Control Implementation in the SDLC ................................................................ F-4 viii CONTINGENCY PLANNING GUIDE FOR FEDERAL INFORMATION SYSTEMS Errata The following changes have been incorporated into Special Publication 800-34, Revision 1, as of the date indicated in the table. DATE 5/21/2010 5/21/2010 TYPE Editorial Editorial CHANGE Remove hyphenation from \"Wohl Phillips\" Change \"mission/business functions\" to \"mission/business processes\" 5/21/2010 Editorial Remove hyphenation from \"mission essential\" 5/21/2010 Editorial 5/21/2010 Editorial 5/21/2010 5/21/2010 5/21/2010 Editorial Editorial Substantive 5/21/2010 Editorial 5/21/2010 5/21/2010 Editorial Substantive 5/21/2010 Editorial 5/21/2010 5/21/2010 Editorial Editorial 5/21/2010 5/21/2010 Editorial Substantive 5/21/2010 Substantive 5/21/2010 Editorial 5/21/2010 Editorial 5/21/2010 Editorial Correct number of Contingency Planning security controls to 9 Change \"information system contingency plan\" to \"ISCP\" Change caption from \"Plan Types\" to \"Types of Plans\" Change \"mission essential functions\" to \"MEFs\" Clarify the relationship between Mean Tolerable Downtime and Recovery Point Objective Change \"continuity planners\" to \"contingency planners\" Change \"missions\" to \"mission\" Add \"and scope\" to the description of system backup policies specifications Change \"Information Systems Planning\" to \"ISCP\" in footnote Change \"applications\" to \"systems\" Change \"information technology systems\" to \"information systems\" Change \"Special Publication\" to \"SP\" Clarify the Contingency Plan Test/Exercise requirement for Contingency Plan Control-4 (CP-4). Change \"All\" to \"Low Impact = Yes Mod. Impact = Yes High Impact = Yes\" Add Contingency Plan Control-4 (CP-4) to the Alternate Processing Site Recovery event; Change Moderate Impact requirement from \"Yes\" to \"N/A\" Add commas around \"as part of the organization's change management process\" in the plan maintenance description of reviewing and updating the ISCP Figure 4-2, Sample Call Tree, align and remove shadow Remove \"and applications\" from the Sequence of Recovery Activities ix PAGE NUMBER v ES-1, 1, 2, 3, 7, 8, 10, 11, 13, 15, 16, 18, 19, 20, 21, 40, 44, 47, 48, 56 A.14, A.2-4, A.3-4, B1, B-2, B-3, B-4, C1, C-2, C-3, C-4, E2, F-2, G-1, G-2 2, 5, 8, C-1, G-1, H-2 6 10 11 11, C-1, C-2 17 17 20 21 21 23, B-4 24, C-1 30 30 30 31 37 39 CONTINGENCY PLANNING GUIDE FOR FEDERAL INFORMATION SYSTEMS DATE 5/21/2010 TYPE Editorial 5/21/2010 5/21/2010 Editorial Editorial 5/21/2010 Editorial 5/21/2010 Substantive 5/21/2010 Editorial 5/21/2010 5/21/2010 Editorial Editorial 5/21/2010 5/21/2010 Editorial Editorial 5/21/2010 Substantive 5/21/2010 5/21/2010 Editorial Editorial 5/21/2010 Substantial 5/21/2010 Editorial 5/21/2010 5/21/2010 Editorial Substantive 5/21/2010 Substantive 5/21/2010 Substantive 5/21/2010 5/21/2010 Editorial Editorial 5/21/2010 5/21/2010 Editorial Editorial 5/21/2010 5/21/2010 5/21/2010 11/11/2010 Editorial Editorial Editorial Substantive CHANGE Change \"backup application\" to \"backup solution\" in the description of Backup Software Change \"discloser\" to \"disclosure\" Remove \"major applications and general support\" from system description Change \"Mission, National, or Primary Essential Functions\" to \"Mission, Primary, or National Essential Functions\" Spell out \"ISDN\" as \"Integrated Services Digital Network (ISDN)\"; add \"with a bandwith of 128Kbps\" for clarification Change \"Information System Contingency Plan (ISCP)\" to \"ISCP\" Change \"Contingency Plan\" to \"ISCP\" Change \"contingency plan coordinator\" to \"ISCP Coordinator\" Change \"be needed\" to \"need\" Change \"Section 4.1 of the plan\" to \"Section 4.2.1 of this plan\