1 NIST SP , Revision 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY
2 1 Table Of Contents Introduction to NIST SP Summary of Changes in NIST SP Revision 1 NIST Future Plans Questions
3 2 Introduction to NIST SP National Institute of Standards and Technology (NIST) is responsible for developing standards and guidelines for providing adequate information security for all agency operations and assets. NIST has a series of Special Publications (SP) and Federal Information Processing Standards (FIPS) that provide federal agencies with standards and guidelines for most aspects of information systems security. NIST security Publications can be found at: NIST SP Contingency Planning Guide for Information Technology (IT) Systems -was first published in June 2002, and provides instructions, recommendations, and considerations for government IT contingency planning. Contingency Planning refers to interim measures to recover IT services following an emergency or system disruption. While designed for federal systems, NIST SP has been used as the guideline for contingency planning throughout much of the private sector.
4 3 Need for the Revision to NIST SP Aligns NIST SP Rev. 3, contingency planning security controls (CP-family). FIPS 199 impact levels Annual testing for FIPS 199 low impact systems Incorporates contingency planning into the six phases of the Risk Management Framework.
5 4 Overall Changes to NIST SP Revision 1 covers three common types of platforms, making the scope more inclusive (Client/servers, Telecommunications systems, and Mainframes). There is a bigger focus on the Information System Contingency Plan (ISCP) as it relates to the differing levels of FIPS 199 impact levels. General Support Systems (GSS) and Major Applications (MA) categories have been removed. Introduces the concept of resiliency and shows how ISCP fits into an organization s resiliency effort. Works to more clearly define the different types of plans included in resiliency, continuity and contingency planning. Throughout the guide, call out boxes clarify the specific differences and relationships between COOP and ISCP.
6 5 Resiliency is a concept that is gaining widespread acceptance in the continuity and contingency planning Department of Homeland Security (DHS) defines resiliency as the ability to resist, absorb, recover from or successfully adapt to adversity or a change in conditions. Resiliency is not a process, but rather an end-state for organizations. Resilient organizations continually work to adapt to changes and risks that can affect their ability to continue critical functions. An effective resiliency program includes risk management, contingency and continuity planning, and other security and emergency management activities. The Goal of A Resilient Organization Continue Mission Essential Functions at All Times During Any Type of Disruption
7 6 NIST SP Revision 1 provides more clarity to the role and function of various contingency and continuity plans Plan Purpose Scope Plan Relationship Business Continuity Plan (BCP) Continuity of Operations (COOP) Plan Crisis Communications Plan Critical Infrastructure Protection (CIP) Plan Provides procedures for sustaining business operations while recovering from a significant disruption. Provides procedures and guidance to sustain an organization s mission essential functions at an alternate site for up to 30 days; mandated by federal directives. Provides procedures for disseminating internal and external communications; means to provide critical status information and control rumors. Provides policies and procedures for protection of national critical infrastructure components, as defined in the National Infrastructure Protection Plan. Addresses business processes at a lower or expanded level from COOP mission essential functions Addresses the mission essential functions; facility- based plan; information systems are addressed based only on their support to the mission essential functions. Addresses communications with personnel and the public; not information system focused. Addresses critical infrastructure components that are supported or operated by an agency or organization. Mission/business process focused plan that may be activated in coordination with a COOP plan to sustain nonmission essential functions. Mission essential function focused plan that may also activate several business unitlevel BCPs, ISCPs, or DRPs, as appropriate. Incident-based plan often activated with a COOP or BCP, but may be used alone during a public exposure event. Risk management plan that supports COOP plans for organizations with CI/KR assets.
8 7 NIST SP Revision 1 provides more clarity to the role and function of various contingency and continuity plans Plan Purpose Scope Plan Relationship Cyber Incident Response Plan Disaster Recovery Plan (DRP) Information System Contingency Plan (ISCP) Occupant Emergency Plan (OEP) Provides procedures for mitigating and correcting a system cyber attack, such as a virus, worm, or Trojan horse. Provides procedures for relocating information systems operations to an alternate location. Provides procedures and capabilities for recovering an information system. Provides coordinated procedures for minimizing loss of life or injury and protecting property damage in response to a physical threat. Addresses mitigation and isolation of affected systems, cleanup, and minimizing loss of information. Activated after major system disruptions with long-term effects. Location-independent plan that focuses on the procedures needed to recovery a system at the current or an alternate location. Focuses on personnel and property particular to the specific facility; not business process or information system-based. Information system focused plan that may activate an ISCP or DRP, depending on the extent of the attack. Information system focused plan that activates one or more ISCPs for recovery of individual systems.. Information system focused plan that may be activated independent from other plans or as part of a larger recovery effort coordinated with a DRP, COOP, and/or BCP. Incident-based plan that is initiated immediately after an event, preceding a COOP or DRP activation.
9 8 A new graphic has been developed to better convey the relationships of the different types of plans to the organization
10 9 The Business Impact Analysis (BIA) was revised to more closely tie to Federal standards and guidelines The process for the BIA has been revised to closely tie to FIPS 199 impact levels and NIST SP Rev. 3 Contingency Planning (CP) controls. The BIA process now takes into consideration that impact levels are determined as part of the security categorization process. Federal Information Processing Standard (FIPS 199) - PUB-199-final.pdf The term Maximum Tolerable Downtime (MTD) is defined and discussed in relation to Recovery Time Objective (RTO) and Recovery Point Objective (RPO). The BIA discussion addresses the differences between BIAs required for systems and those required by Federal Continuity Directives (FCD) -1 and 2 for Continuity of Operations (COOP) Mission Essential Functions (MEF).
11 10 NIST SP Recommended Security Controls for Federal Information Systems and Organizations define 9 CP controls Control No. Control Name Security Control Baselines Low Moderate High CP-1 Contingency Planning Policy and Procedures CP-1 CP-1 CP-1 CP-2 Contingency Plan CP-2 CP-2 (1) CP-2 (1) (2) (3) CP-3 Contingency Training CP-3 CP-3 CP-3 (1) CP-4 Contingency Plan Testing and Exercise CP-4 CP-4 (1) CP-4 (1) (2) (4) CP-5 Contingency Plan Update (Withdrawn) CP-6 Alternate Storage Site Not Selected CP-6 (1) (3) CP-6 (1) (2) (3) CP-7 Alternate Processing Site Not Selected CP-7 (1) (2) (3) (5) CP-7 (1) (2) (3) (4) (5) CP-8 Telecommunications Services Not Selected CP-8 (1) (2) CP-8 (1) (2) (3) (4) CP-9 Information System Backup CP-9 CP-9 (1) CP-9 (1) (2) (3) CP-10 Information System Recovery and Reconstitution CP-10 CP-10 (2) (3) CP-10 (2) (3) (4)
12 11 Testing, Training and Exercises Section is also more closely linked to other federal Standards and guidelines There is more clarity when defining testing, training and exercises (TT&E). References are included for NIST SP Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities - TT&E is also linked to FIPS 199 impact levels. For low-impact systems, a yearly tabletop exercise is sufficient For moderate-impact systems, a yearly functional exercise should be conducted For high-impact systems, a yearly full-scale functional exercise should be conducted. Sample activities are presented to assist in development of effective TT&E programs for systems.
13 12 TT&E programs and exercise types are defined to address requirements to NIST SP Rev. 3 security control CP-4 NIST SP Rev. 3 Contingency Planning (CP)-4 defines requirements for contingency plan test and exercise. A Tabletop Exercise is a Discussion-based simulation of an emergency situation in an informal, stress-free environment; designed to elicit constructive scenariobased discussions for an examination of the existing ISCP and individual state of preparedness.. A Functional Exercise is a Simulation of a disruption with a system recovery component such as backup tape restoration or server recovery. A Full-Scale Functional Exercise is a Simulation prompting a full recovery and reconstitution of the information system to a known state and ensures that staff are familiar with the alternate facility.
14 13 The flow for steps performed during a contingency event have been revised in the ISCP development The flow has switched activation and notification steps in the assumption that an ISCP would not be considered for routine downtimes, but would be used for major issues. The original SP had notification followed by activation This sometimes created confusion on how to follow a plan s notification procedures without activating the plan itself. An organization should activate an ISCP to be able to follow the procedures for notifying assessment and recovery teams. The first step after activating an ISCP is to notify the key stakeholders and to start assessing the disruption. Escalation and notification has been added to convey the need to continually provide updates and escalation problems as necessary for resolution. Procedures have been added to keep upper management informed of the progress of recovery efforts and to escalate the recovery as needed to more specialized or trained personnel.
15 14 While overall ISCP primary sections have been reduced, several sub sections have been added to Reconstitution and Deactivation Reconstitution and Deactivation are now a single primary section. Reconstitution has been reworked to include data validation and functionality testing, a declaration of the end of recovery efforts, and more details regarding deactivation. Declaration of the end of recovery efforts is a key addition to the process. This step defines the return of the system to operational status, and stops the recovery effort clock, to determine if the RTO and RPO objectives have been met during the incident. More work is required to have the organization ready for the next event. Deactivation now includes: Notification of the end of recovery and return to operations, cleanup of recovery documentation, returning backup data to offsite storage, performing a baseline data backup, and documenting the event, lessons learned, and updating the ISCP. Deactivation of the ISCP after a contingency event and plan activation may take several days, weeks, or months to complete. The intent is to provide defined processes for an organization to ready itself and improve the ISCP.
16 15 The Technical Considerations section has been updated to better reflect current trends and standards in common platforms Technical Considerations (Section 5) have been simplified to emphasize options for contingency planning for different types of platforms, rather than technologies, and with less emphasis in explaining the different types. Section 5 now focus on three common platform types: Client/servers, Telecommunications systems, and Mainframes. The old categories, including desktop computers, servers, web sites, local area networks, wide area networks and distributed systems have been consolidated into the three defined platform types. Older technologies and terminologies (Zip drives, 3.5 floppies, etc.) have been removed and more generic technologies incorporated to reduce obsolescence. Cloud computing is not included, as the technology is still emerging and not yet stabilized. Contingency Considerations and Contingency Solutions for each type of system are still included in the Technical Considerations.
17 16 Appendices to NIST SP have been expanded and include more ISCP templates There are now 3 templates, 1 each for low, moderate and high FIPS 199 impact levels. The templates also provide more instruction and explanation for filling out separate sections. The templates also include ISCP appendices appropriate to the system s impact level that can provide complementary information to assist in recovery efforts. The sections in the templates have been rearranged to keep the main body of the ISCP focused on the steps required for recovery, with supplemental and supporting information put into ISCP Appendices. Templates now include suggested ISCP appendices.
18 17 The appendices have been sorted to provide the more critical information needed up front, and background and supplemental information toward the back The Appendices are suggestions, and a planner may use none, some or all of them. Suggested Appendices Appendix A Personnel Contact List Appendix B Vendor Contact List Appendix C Detailed Recovery Procedures Appendix D Alternate Processing Procedures Appendix E System Validation Test Plan Appendix F Alternate Storage, Site and Telecommunications* Appendix G Diagrams (System and Input/Output) Appendix H - System Inventory Appendix I Interconnections Table Appendix J Test and Maintenance Schedule Appendix K Associated Plans and Procedures Appendix L Business Impact Analysis Appendix M Document Change Page * Note that Appendix F is only required for Moderate and High impact systems, and is not included in the Low Impact template
19 18 Appendices within NIST SP have been expanded and changed in Revision 1 An updated Business Impact Analysis template is provided in Appendix B. Appendix C is the Frequently Asked Questions section. Personnel Considerations in Continuity Planning (Appendix D) now includes the use of social networking as part of communications with personnel. Since social networking is an evolving concept, guidance is geared more towards why to use it and what to be aware of rather than what tools to use. Appendix E has been added to provide the contingency planning (CP) controls from NIST SP , Rev. 3.
20 19 The System Development Lifecycle (SDLC) has been moved from the main body of the guide to Appendix F SDLC steps are tied to SP CP controls and FIPS 199 impact levels to clarify when to get contingency planning included in an SDLC effort. Very little in the SDLC has changed, other than tying CP controls into the process. This revision better integrates the three major areas of consideration (contingency planning, SDLC and controls).
21 20 Conclusions NIST SP Rev.1 is the first major update to a contingency planning guideline that is being used by all federal agencies, as well as many state and local agencies. The guide is also commonly used for contingency plan development within the private sector, and is the most downloaded NIST standard in their library. Revision 1 focuses more on systems recovery, and incorporates guidance and requirements from NIST SP , FIPS 199, and FCD-1 and 2. The flow for recovery has been redefined and expanded to provide guidance in all aspects of recovery after a disaster or contingency event. New templates have been provided, with more instruction and detail for the contingency planner to better develop effective ISCPs.
22 21 Future NIST Activities NIST SP , Enterprise-wide Risk Management: Organization, Mission, and Information Systems View Public Draft: June 2010 NIST SP Rev. 1, Guide for Conducting Risk Assessments Public Draft: July 2010 NIST SP A Rev.3, Guide for Assessing the Security Controls in Federal Information Systems and Organizations Public Draft: June 2010 NIST SP Rev.2, Guide for Developing Security Plans for Federal Information Systems and Organizations Public Draft: October 2010 Questions?
23 22 For more information, Marianne Swanson Senior Advisor for Information System Security, National Institute of Standards and Technology Address: 100 Bureau Drive, Stop 8930, Gaithersburg, MD Work Phone: (301)
NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson Pauline Bowen Amy Wohl Phillips Dean Gallup David Lynes NIST Special Publication 800-34
NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson Pauline Bowen Amy Wohl Phillips Dean Gallup David Lynes NIST Special Publication 800-34
ITL BULLETIN FOR JULY 2010 CONTINGENCY PLANNING FOR INFORMATION SYSTEMS: UPDATED GUIDE FOR FEDERAL ORGANIZATIONS Shirley Radack, Editor Computer Security Division Information Technology Laboratory National
University Information Technology Services Information System Contingency Plan Instructions Prepared by Victor Font UITS Business Continuity / Disaster Recovery Coordinator January 2013 Table of Contents
Business Continuity Plan October 2007 Agenda Business continuity plan definition Evolution of the business continuity plan Business continuity plan life cycle FFIEC & Business continuity plan Questions
NIST Special Publication 800-34 Contingency Planning Guide for Information Technology Systems Recommendations of the National Institute of Standards and Technology Marianne Swanson, Amy Wohl, Lucinda Pope,
Business Continuity Planning 2014 NABRICO Conference September 19, 2014 6 CityPlace Drive, Suite 900 St. Louis, Missouri 63141 314.983.1200 1520 S. Fifth Street, Suite 309 St. Charles, Missouri 63303 636.255.3000
State of South Carolina Policy Guidance and Training Policy Workshop All Agencies Business Continuity Management Policy June 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy
Temple university Auditing a business continuity management BCM November, 2015 Auditing BCM Agenda 1. Introduction 2. Definitions 3. Standards 4. BCM key elements IT Governance class - IT audit program
Disaster Recovery Planning Procedures and Guidelines A Mandatory Reference for ADS Chapter 545 New Reference: 06/01/2006 Responsible Office: M/DCIO File Name: 545mal_060106_cd44 Information System Security
Business Continuity Planning 101 Presentation Overview What is business continuity planning Plan Development Plan Testing Plan Maintenance Future advancements in BCP Question & Answer What is a Disaster?
SAMPLE IT CONTINGENCY PLAN FORMAT This sample format provides a template for preparing an information technology (IT) contingency plan. The template is intended to be used as a guide, and the Contingency
Business Continuity and Disaster Recovery Planning Jennifer Brandt, CISA A p r i l 16, 2015 HISTORY OF STINNETT & ASSOCIATES Stinnett & Associates (Stinnett) is a professional advisory firm offering services
1. What is the most common planned performance duration for a continuity of operations plan (COOP)? A. 30 days B. 60 days C. 90 days D. It depends on the severity of a disaster. 2. What is the business
Plan Development Getting from Principles to Paper March 22, 2015 Table of Contents / Agenda Goals of the workshop Overview of relevant standards Industry standards Government regulations Company standards
State of California California Information Security Office Technology Recovery Plan Instructions SIMM 5325-A (Formerly SIMM 65A) September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF
Domain 3 Business Continuity and Disaster Recovery Planning Steps (ISC) 2 steps [Har10] Project initiation Business Impact Analysis (BIA) Recovery strategy Plan design and development Implementation Testing
RIVERSIDE: AUDIT & ADVISORY SERVICES June 30, 2009 To: Charles Rowley, Associate Vice Chancellor Computing & Communications Subject: Internal Audit of Information Technology Disaster Recovery Plan Ref:
THORNBURG INVESTMENT MANAGEMENT THORNBURG INVESTMENT TRUST Business Continuity Plan June 2012 Purpose The purpose of this Business Continuity Plan ( BCP ) is to define the strategies and the plans which
EMERGENCY PREPAREDNESS PLAN Business Continuity Plan GIS Bankers Insurance Group Powered by DISASTER PREPAREDNESS Implementation Small Business Guide to Business Continuity Planning Surviving a Catastrophic
whitepaper Why Should Companies Take a Closer Look at Business Continuity Planning? How Datalink s business continuity and disaster recovery solutions can help organizations lessen the impact of disasters
Yale University Business Continuity Planning (BCP) Quick Start Guide Introduction Yale University s mission is to create, preserve and disseminate knowledge. Each college, division, and major administrative
October 2013 Emergency Planning for Essential Staff Larry G. Wlosinski, CDP, CISSP, CISM, CAP, CRISC, CISA, ITIL v3, CBCP Prepare for Disaster: Recover Faster. 1 Larry G. Wlosinski CDP, CISSP, CISM, CAP,
Attachment to Data Center Services Multisourcing Service Integrator Master Services Agreement DIR Contract No. DIR-DCS-MSI-MSA-001 Between The State of Texas, acting by and through the Texas Department
How to write a DISASTER RECOVERY PLAN To print to A4, print at 75%. TABLE OF CONTENTS SUMMARY SUMMARY WHAT IS A DRP AND HOW CAN IT HELP MY COMPANY? CHAPTER PREPARING TO WRITE YOUR DISASTER RECOVERY PLAN
Overview of how to test a Business Continuity Plan Prepared by: Thomas Bronack Phone: (718) 591-5553 Email: firstname.lastname@example.org BRP/DRP Test Plan Creation and Exercise Page: 1 Table of Contents BCP/DRP Test
Review of the SEC s Continuity of Operations Program Review Conducted by TWM Associates, Inc. April 23, 2012 i Should you have any questions regarding this report, please do not hesitate to contact me,
STEP-BY-STEP BUSINESS CONTINUITY AND EMERGENCY PLANNING MAY 27 2015 AGENDA: Emergency Management Business Continuity Planning Q & A MONTH DAY, YEAR TITLE OF THE PRESENTATION 2 CANADIAN RED CROSS Disaster
Information Systems Disaster Recovery APPA-Institute for Facilities Management J. Craig Klimczak, D.V.M., M.S. Vice-Chancellor for Technology St. Louis Community College 300 South Broadway St. Louis, MO
Department of Budget & Management State of Maryland Information Technology (IT) Disaster Recovery Guidelines Version 4.0 July 2006 TABLE OF CONTENTS 1.0 INTRODUCTION...1 1.1 Purpose...1 1.2 Scope...1 1.3
ning DAU Marts 2013 Agenda Introduction Process definition Activation and notification Recovery Reconstruction Evaluation Examples Do and Don t Why bother? Information provided by information technology
Category Applicability Title Disaster Planning Procedures for Information Technology All Public Entities (See the Applicability section below.) Standard - A degree or level of requirement that all jurisdictions
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Information Technology Fiscal Year 2014 Federal Information Security Management Act Report: Status of EPA s Computer Security Program Report.
University of Michigan Disaster Recovery / Business Continuity Administrative Information Systems. 1 Michigan Administrative Information Services (MAIS) MAIS is responsible for the production support of
Best Practices in Disaster Recovery Planning and Testing axcient.com 2015. Axcient, Inc. All Rights Reserved. 1 Best Practices in Disaster Recovery Planning and Testing Disaster Recovery plans are widely
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Information Technology EPA Can Better Assure Continued Operations at National Computer Center Through Complete and Up-to-Date Documentation
The PNC Financial Services Group, Inc. Business Continuity Program subsidiaries) 1 Content Overview A. Introduction Page 3 B. Governance Model Page 4 C. Program Components Page 4 Business Impact Analysis
Overview for Chief Executive Officers and Boards of Directors In light of the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council 1 (FFIEC) developed
Business Continuity and Disaster Recovery Job Descriptions Table of Contents Business Continuity Services Organization Chart... 2 Director Business Continuity Services Group... 3 Manager of Business Recovery
Archived NIST Technical Series Publication The attached publication has been archived (withdrawn), and is provided solely for historical purposes. It may have been superseded by another publication (indicated
How to Develop a BUSINESS CONTINUITY PLAN To print to A4, print at 75%. TABLE OF CONTENTS SUMMARY SUMMARY WHAT IS A BUSINESS CONTINUITY PLAN? CHAPTER PREPARING TO WRITE YOUR BUSINESS CONTINUITY PLAN CHAPTER
CITY AUDITOR'S OFFICE Disaster Recovery/Business Continuity March 6, 2015 AUDIT REPORT NO. 1511 CITY COUNCIL Mayor W.J. Jim Lane Suzanne Klapp Virginia Korte Kathy Littlefield Vice Mayor Linda Milhaven
Contingency Plan Template Business Unit CONTINGENCY PLAN Version 1.0 (Date submitted) Submitted By: Business Unit Date Version 1.0 Page 1 1 Plan Review and Updates... 3 2 Introduction... 3 2.1 Purpose...
Appendix 3 Disaster Recovery Plan December 13, 2006 Revision XXQwest Government Services, Inc. 4250 North Fairfax DriveArlington, VA 22203(Delete this page)revision history Revision Number Revision Date
Construction of a Disaster Recovery Plan David Godwin, Sr. Sales Engineer March 18, 2014 Objectives Understand What Disaster Recovery is? Why is Disaster Recovery Needed? Effectively assist customers or
Building a Disaster Recovery Program By: Stieven Weidner, Senior Manager Part two of a two-part series. If you read my first article in this series, Building a Business Continuity Program, you know that
Federal Financial Institutions Examination Council FFIEC Business Continuity Planning BCP FEBRUARY 2015 IT EXAMINATION H ANDBOOK Table of Contents Introduction 1 Board and Senior Management Responsibilities
Business Continuity Management & Disaster Recovery Planning Presented by: Shankar Gawade VP IT INFRASTRUCTURE ENAM SECURITIES PVT. LTD. 1 What is Business Continuity Management? Is a holistic management
Office of Internal Audit Business Continuity Management Review November 14, 2014 Internal Audit Team Shannon Henry Chief Audit Officer & Executive Director of Institutional Compliance Stacy Sneed Audit
U.S. D EPARTMENT OF H OMELAND S ECURITY 7 Homeland Fiscal Year 2008 HOMELAND SECURITY GRANT PROGRAM ty Grant Program SUPPLEMENTAL RESOURCE: CYBER SECURITY GUIDANCE uidelines and Application Kit (October
Information Security Policies and Procedures Development Framework for Government Agencies First Edition - 1432 AH 6 Contents Chapter 1 Information Security Policies and Procedures Development Framework
DHS Needs To Strengthen Information Technology Continuity and Contingency Planning Capabilities REDACTED OIG-13-110 August 2013 Washington, DC 20528 / www.oig.dhs.gov August 28, 2013 MEMORANDUM FOR: FROM:
CENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT JANUARY 2008 GUIDELINE ON BUSINESS CONTINUITY GUIDELINE CBK/PG/14
www.pwc.com Business Resiliency Business Continuity Management - January 14, 2014 Agenda Key Definitions Risks Business Continuity Management Program BCM Capability Assessment Process BCM Value Proposition
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Business Continuity Management Standard for IT Systems This standard is applicable to all VCU School of Medicine
SCADA Business Continuity and Disaster Recovery Presented By: William Biehl, P.E. 913-601-0104 (mobile) Bill.Biehl@we-inc.com Business Continuity Planning, a Sound Process A Business Continuity Plan: "A
Appendix 10 IT Security Implementation Guide For Information Management and Communication Support (IMCS) 10.1 Security Awareness Training As defined in NPR 2810.1A, all contractor personnel with access
Cyber Security Training & Consulting Certified Disaster COURSE OVERVIEW 4 Days 32 CPE Credits $2,500 When a business is hit by a natural disaster, cyber crime or any other disruptive tragedy, how should
Best Practices in Developing an IT Disaster Recovery Plan Vijaykumar Kulkarni AGM Product Management PRESENTER PROFILE Vijaykumar Kulkarni Assistant General Manager - Product Management in Netmagic Solutions,
Overview In light of the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council 1 (FFIEC) developed the Cybersecurity Tool (), on behalf of its members,
Enabling DR with Smart Devices By Greg Streder and Philip Chukwuma 1 BCP Definitions: Business continuity planning (BCP) "identifies an organization's exposure to internal and external threats and synthesizes
Building an effective Tabletop Exercise Presented by: Ken M. Shaurette, CISSP, CISA, CISM, CRISC FIPCO Director IT Services 3/26/2013 #1 Continuity Plan Testing Flowchart 3/26/2013 #2 1 Ongoing Multi-Year
Community Bank Auditors Group Taking Your Business Continuity Plan To The Next Level June 9, 2015 By: Tracy Hall MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company,
The handouts and presentations attached are copyright and trademark protected and provided for individual use only. READINESS RESOURCES American Bar Association -- www.abanet.org Disaster Recovery: www.abanet.org/lpm/lpt/articles/slc02051.html
CISSP Common Body of Knowledge: Business Continuity & Disaster Recovery Planning Domain Version: 5.9.2 CISSP Common Body of Knowledge Review by Alfred Ouyang is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION Disaster Recovery Testing Is Being Adequately Performed, but Problem Reporting and Tracking Can Be Improved May 3, 2012 Reference Number: 2012-20-041 This
CRR Supplemental Resource Guide Volume 5 Incident Management Version 1.1 Copyright 2016 Carnegie Mellon University This material is based upon work funded and supported by Department of Homeland Security
ECP - 601: Effective Business Continuity Management: ISO 22301 This 3-day course provides an intensive, hands-on workshop covering all major aspects for the design of an effective Business Continuity Plan
Standard Operating Procedure Contingency Planning Guidance Version Date: 20080702 Effective Date: 20080707 Expiration Date: 20110707 Responsible Office: Office of the Chief Information Officer 1 Document
Portal Storm: A Cyber/Business Continuity Exercise Cyber Security Initiatives Commonwealth of Pennsylvania Office of Administration Tony Encinias, Chief Information Officer Project Initiated: January 2013
A BCP Tale: From Theory to Practice Presenter: Gord Novoselnik Problem & Configuration Manager, Enterprise Solutions Division, MTS Allstream Gord.Novoselnik@mtsallstream.com 1 10 Commandments of BCM I.
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION Corrective Actions to Address the Disaster Recovery Material Weakness Are Being Completed June 27, 2011 Report Number: 2011-20-060 This report has cleared
Business Continuity & Disaster Recovery Safety First Quality Every Time 1 Business Continuity & Disaster Recovery Planning Who here has a formal Business Continuity & Disaster Recovery plan? The purpose
Evaluation of the Railroad Retirement Board s Disaster Recovery Plan Report No. 06-08, August 14, 2006 INTRODUCTION This report presents the results of the Office of Inspector General s evaluation of the
Information Technology Disaster Recovery Policy Policy Statement This policy defines acceptable methods for disaster recovery planning, preparedness, management and mitigation of IT systems and services
Regulatory compliance is a significant factor influencing the development of your business resilience strategy. Moreover, while Business Continuity or Disaster Recovery regulations may not apply in every
IT Disaster Recovery 2012/13 Recommendation R1: A Disaster Recovery Plan should be developed and approved. As a minimum, this should include; the identification and prioritisation of key IT systems the
The Disaster Recovery Self-Assessment Guide and Validation Model Jim Kates Cognizant Technology Solutions Jim.Kates@cognizant.com How Would You Evaluate Your DRP? (Is it a Disaster Recovery Plan or a Dilbert