NIST drafts contingency guidance

"Contingency Planning Guide for Information Technology Systems"

The National Institute of Standards and Technology released a draft guide Jan. 15 to help agencies develop contingency plans for information technology systems so they can continue to perform their mission during and after an emergency.

The special publications developed by NIST's Computer Security Resource Center are intended to provide guidance for agencies trying to comply with congressional mandates and Office of Management and Budget requirements.

The draft "Contingency Planning Guide for Information Technology Systems" is the latest in a series addressing some of the most prevalent security issues facing agencies, and it is particularly relevant in the homeland security environment.

An IT contingency plan is only part of an overall continuity of operations plan, and the guide looks only at what it needed in order to deal with IT systems disruptions, not the larger issues of business or personnel disruptions.

The guide defines a seven-step process for agencies to make part of the planning for and management of every information system. It includes:

* Developing a formal contingency planning policy, with the necessary authority and guidance for future plans.

* Conducting a business impact analysis to identify and prioritize critical systems.

* Identifying preventive controls to reduce the effects of system disruptions.

* Developing recovery strategies.

* Developing a detailed, step-by-step contingency plan.

* Testing the plan to identify gaps and training personnel to prepare them for any incident.

* Maintaining and updating the plan to keep it current as systems change.

The guide also includes a sample format for developing a contingency plan, splitting a plan into three phases: notification/activation, recovery and reconstitution.

The notification/activation section outlines how to develop a "call tree" to ensure the correct people are notified in the correct order, to perform an initial damage assessment and move into the recovery phase.

For recovery, the guide suggests developing step-by-step procedures for dealing with every detail, including mundane problems such as obtaining the necessary office supplies, space and power to support the emergency operations.

In the reconstitution section, the guide recommends specifying teams responsible for each action that must be taken to return to normal operations. This includes backing up the data created while on the contingency system and uploading it to the restored system so that no work is lost.

The guide also includes a cost-consideration chart to help agencies decide what kind of alternate or backup sites they should chose for each system.

Featured

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    OPM nominee plans focus on telework, IT, retirement

    Kiran Ahuja, a veteran of the Office of Personnel Management, told lawmakers that she thinks that the lack of consistent leadership in the top position at OPM has taken a toll on the ability of the agency to complete longer term IT modernization projects.

  • Defense
    Soldiers from the Old Guard test the second iteration of the Integrated Visual Augmentation System (IVAS) capability set during an exercise at Fort Belvoir, VA in Fall 2019. Photo by Courtney Bacon

    IVAS and the future of defense acquisition

    The Army’s Integrated Visual Augmentation System has been in the works for years, but the potentially multibillion deal could mark a paradigm shift in how the Defense Department buys and leverages technology.

Stay Connected