NIST SP 800-34

---

Contingency Planning Guide for Information Technology Systems (NIST 800-34)

• includes:
  • continuity of operations plans (COOP)
    • focuses on mission-essential functions (MEF)
    • sustain for 30 days
  • critical infrastructure protection (CIP)
    • “critical infrastructure and key resources (CIKR) which are those components of the national infrastructure that are deemed so vital that their loss would have a debilitating effect on the safety, security, economy, and/or health of the United States”
  • information system contingency plan (ISCP)
    • concerned with assessment and recovery of a system following some disruption

Seven-Step Process for BCP and DRP Projects

1. Develop the contingency planning policy statement
   • formal policy provides the authority and guidance necessary to develop and effective contingency plan
2. Conduct the business impact analysis (BIA)
   • BIA is used to identify and prioritize information systems and components critical to supporting the organization’s mission/business functions
3. Identify preventative controls
   • measures taken to reduce the effects of system disruptions can increase system availability and reduce contingency life-cycle costs
4. Create contingency strategies
   • thorough strategies ensure that the system may be recovered quickly and effectively following a disruption
5. Develop and information system contingency plan
   • contingency plan should contain detailed guidance and procedures for restoring a system based on the system’s security impact level and recovery requirements
6. Plan testing and training
   • Ensure the BCP and DRP are tested and staff are trained in these plans
7. Plan maintenance
   • plan should be updated frequently to remain current with system and organizational changes