Information Technology Reference
In-Depth Information
Security
contains disaster recovery requirements. The HIPAA Final Security Rule
requires a contingency plan that specifically calls for the inclusion of a disaster recov-
ery plan. FISMA requires plans and procedures to ensure the continuity of operations;
although FISMA does not specifically name disaster recovery, a safe assumption is
that it is part of the intent. DoD Instruction 8500.2:
Information Assurance Imple-
mentation
contains 24 controls under the Continuity section; the Continuity control
numbered “CODP-3” specifically calls for disaster and recovery planning.
8.15.2
Policy
Disaster recovery policies exist throughout government and commercial environ-
ments. Examples include the U.S. Customs
Information Systems Security Policy and
Procedures Handbook
and Chairman of the Joint Chiefs of Staff Instruction (CJCSI)
6510.01C:
Information Assurance and Computer Network Defense
. Any organization
that does not have a disaster recovery policy needs one. This is a general security
policy format that also accommodates disaster recovery:
n
−
Purpose and objectives
The purpose of the disaster recovery policy is to satisfy legislative require-
ments pertaining to <TBD>; these include:
<Enumerate requirements>
The primary objectives of disaster recovery policy are:
To establish a plan for the restoration of key business operations fol-
lowing a disaster
To communicate responsibilities to key personnel and supporting
personnel
Policy statement
Each key [business unit | major location | agency | etc.], as identified in the
BIA report, must have a disaster recovery plan that provides <TBD>.
The focus of the plan must be on [business | mission] resumption, recov-
ery, and restoration, in that order.
n
−
n
n
n
−
−
The above is not comprehensive, but presents the start of an outline.
8.15.3
Practice
Disaster recovery strategies fall into the following categories:
n
n
n
n
Hot site solution
Warm site solution
Cold site solution
Use of development environment
