Overview
An alternate site is identified that permits the restoration of all mission or business essential functions.
Threat
Environmental disasters, organized disruptions, loss of utilities/services, equipment or system failures, and serious information security incidents are potential events that could disrupt mission or business essential functions. A recovery strategy should be developed to include an alternate site to mitigate the impact of disruptive events.
Guidance
This general implementation guidance is provided for IAMs/IAOs involved in the creation of a system or organizational Continuity of Operations (COOP) plan:Identify an alternate site that has the capability to fully restore mission or business essential functions.Establish a program to ensure comprehensive and effective continuity of full functionality during a broad spectrum of emergencies or situations that may disrupt normal operations (e.g., power failures, damage to facilities caused by storms, fires, flooding, etc.)Ensure that the program includes a strategy to recover and perform full system operations at the alternate facility for an extended period of time.Full restoration of mission or business essential functions at an alternate site shall be based on a business impact analyses that identifies and ranks major information systems and mission-critical applications according to priority and the maximum permissible outage for each.A contingency plan shall be created that identifies mission-essential computing needs to include hardware, software, communication lines, applications, and data. The plan should also include the operators, management, and technical support personnel that will implement the contingency plan.
DoD classifies this control in the subject area of “Continuity” with a impact of “High”.