NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems

Overview

The guide defines contingency planning as interim measures to recover information system services after a disruption: relocating systems to an alternate site, recovering functions on alternate equipment, or performing functions manually. It gives specific recommendations for client/server, telecommunications and mainframe systems. The seven steps are the policy statement, business impact analysis (BIA), preventive controls, contingency strategies, the information system contingency plan (ISCP), plan testing, training and exercises, and plan maintenance, designed to be integrated into every stage of the system development life cycle.

The BIA section covers determining business processes and recovery criticality, resource requirements and resource recovery priorities. Three time measures are distinguished: Maximum Tolerable Downtime (MTD), the total outage the system owner will accept; Recovery Time Objective (RTO), the longest a system resource can remain unavailable before unacceptable impact, which must normally be shorter than MTD; and Recovery Point Objective (RPO), the point in time to which data can be restored, meaning tolerated data loss, which is not part of MTD. A footnote states that systems supporting mission essential functions must meet an MTD of 12 hours or less.

Strategies are tied to the FIPS 199 availability impact level: low suggests tape backup and a relocate or cold site; moderate, optical backup, WAN/VLAN replication and a cold or warm site; high, mirrored systems, disc replication and a hot site. Alternate site types are cold, warm, hot, mobile and mirrored; the mirrored site is the most expensive and ensures virtually 100 percent availability, while cold sites are cheapest but can take substantial time to equip. A fixed site should lie in an area unlikely to be hit by the same hazard as the primary site. Equipment replacement options are vendor agreements, an equipment inventory and existing compatible equipment.

The plan is presented in three sample formats for low, moderate and high impact, each with Activation/Notification, Recovery and Reconstitution phases. The appendices include sample templates, a BIA template, frequently asked questions, personnel considerations, a summary of SP 800-53 contingency planning controls and the relation to the SDLC.

Key points

1. Seven-step process: policy, BIA, preventive controls, strategies, ISCP, testing/training/exercises, plan maintenance.
2. RTO must normally be shorter than MTD; reprocessing time is added to the RTO.
3. RPO expresses tolerated data loss and is not part of MTD.
4. Systems supporting mission essential functions must meet an MTD of 12 hours or less.
5. FIPS 199 low: tape backup, relocate or cold site; moderate: optical backup, WAN/VLAN replication, cold or warm site; high: mirrored systems, disc replication, hot site.
6. Alternate site types are cold, warm, hot, mobile and mirrored; the mirrored site is the most expensive and gives virtually 100 percent availability.
7. Mobile sites can often be delivered within 24 hours, though equipment installation adds time.
8. The alternate site should be in an area unlikely to be affected by the same hazard as the primary site.
9. The plan has three phases: Activation/Notification, Recovery and Reconstitution.
10. The plan is a living document, updated as the system and the organisation change.

Using it in design

• Derive MTD, RTO and RPO from the BIA for the data centre and translate them into UPS and generator runtime, cooling redundancy and replication architecture requirements.
• Choose the secondary site type (cold, warm, hot, mirrored) from the availability impact level and size its power and cooling to meet the RTO.
• Locate the secondary site outside the primary site's hazard area and include travel time in the RTO calculation.
• Define priority-shipment and spare-equipment inventory clauses in supplier SLAs as the equipment replacement strategy.
• Evaluate preventive controls (UPS, RAID, automatic failover, clustering, mirroring) as design requirements together with life-cycle cost.
• Add the testing, training and exercise programme and the plan maintenance cycle to operating procedures.

Who should read it

ISCP coordinators, system owners, disaster recovery and continuity planners, and data-centre operations teams.

Document contents

1. Executive Summary
2. Chapter 1. Introduction
3. Chapter 2. Background: Contingency Planning and Resilience; Types of Plans (BCP, COOP, Crisis Communications, CIP, Cyber Incident Response, DRP, ISCP, OEP)
4. Chapter 3. Information System Contingency Planning Process
5. 3.1 Develop the Contingency Planning Policy Statement
6. 3.2 Conduct the Business Impact Analysis (BIA)
7. 3.3 Identify Preventive Controls
8. 3.4 Create Contingency Strategies (Backup and Recovery; Alternate Sites; Equipment Replacement)
9. 3.5 Plan Testing, Training, and Exercises (TT&E)
10. 3.6 Plan Maintenance
11. Chapter 4. Information System Contingency Plan Development (Activation and Notification, Recovery, Reconstitution)
12. Chapter 5. Technical Contingency Planning Considerations (Client/Server, Telecommunications, Mainframe Systems)
13. Appendix A. Sample ISCP Templates
14. Appendix B. Sample BIA and BIA Template
15. Appendix E. Contingency Planning Controls
16. Appendix F. Contingency Planning and the SDLC

Related standards

• ISO 22301
• NIST SP 800-53 CP family

Read the document

Publication details

Authors

Marianne Swanson; Pauline Bowen; Amy Wohl Phillips; Dean Gallup; David Lynes

Publisher

National Institute of Standards and Technology

Year

2010

Document number

NIST SP 800-34 Rev. 1

Document language

English

Source type

Expert / community

Access

Open licence — downloadable

DOI

10.6028/NIST.SP.800-34r1

Licence

U.S. public domain — U.S. Government work; free to reuse

Licence evidence

www.copyright.gov

Citation