*\[Insert System Name (Acronym)\]*

*Security Categorization: \[Insert Category\]*

Information Technology Contingency Plan (ITCP)

for System

Version *\[Insert #\]*

*\[Insert Date\]*

Prepared by

***\[Insert Group/Organization/Company Name\]***

***\[Insert Street Address\]***

***\[Insert City, State, and Zip Code\]***

DOCUMENT CHANGE CONTROL

  -------------- ------------- -------------------- ------------- ----------------
  **Version**    **Release     **Summary of         **Addendum    **Name**
                 Date**        Changes**            Number**      

  ***\[Version   ***\[Insert   ***\[First Draft --  ***\[Insert   ***\[Insert
  0.1\]***       Date\]***     Initial draft.\]***  Addendum      Name\]***
                                                    #\]***        

  ***\[Version   ***\[Insert   ***\[Second Draft -- ***\[Insert   ***\[Insert
  0.2\]***       Date\]***     Incorporates         Addendum      Name\]***
                               information          #\]***        
                               collected from                     
                               working session with               
                               stakeholders.\]***                 

  ***\[Version   ***\[Insert   ***\[Third Draft --  ***\[Insert   ***\[Insert
  0.3\]***       Date\]***     Incorporates changes Addendum      Name\]***
                               from C&A Team        #\]***        
                               QC.\]***                           

  ***\[Version   ***\[Insert   ***\[Fourth Draft -- ***\[Insert   ***\[Insert
  0.4\]***       Date\]***     Incorporates changes Addendum      Name\]***
                               from validation      #\]***        
                               session with                       
                               stakeholders.\]***                 

  ***\[Version   ***\[Insert   ***\[Fifth Draft --  ***\[Insert   ***\[Insert
  0.5\]***       Date\]***     Incorporates changes Addendum      Name\]***
                               from collaboration   #\]***        
                               meeting on the ST&E                
                               plan with                          
                               stakeholders.\]***                 

  ***\[Version   ***\[Insert   ***\[Sixth Draft --  ***\[Insert   ***\[Insert
  0.6\]***       Date\]***     Incorporates changes Addendum      Name\]***
                               based on ST&E        #\]***        
                               findings.\]***                     

  ***\[Version   ***\[Insert   ***\[Ninth Draft --  ***\[Insert   ***\[Insert
  0.9\]***       Date\]***     Final Draft.\]***    Addendum      Name\]***
                                                    #\]***        

  ***\[Version   ***\[Insert   ***\[First           ***\[Insert   ***\[Insert
  1.0\]***       Date\]***     Release.\]***        Addendum      Name\]***
                                                    #\]***        
  -------------- ------------- -------------------- ------------- ----------------

Approving Signatures

As the system owner for ***\[Insert System Name\]*** (***\[Insert System
Acronym\]***), I hereby certify that the information technology
contingency plan (ITCP) is complete and that the information contained
in this ITCP provides an accurate representation of the system, its
hardware, software, and telecommunication components. I further certify
that this document identifies the criticality of the system as it
relates to the mission of the ***\[Insert Group/Organization/Company
Name\]***, and that the recovery strategies identified will provide the
ability to recover the system or system functionality in the most
expedient and cost beneficial method in keeping with its level of
criticality.

I further attest that this ITCP for ***\[Insert System Acronym\]*** will
be tested at least annually. This plan was last tested on ***\[Insert
Exercise Date\]***; the test, training, and exercise (TT&E) material
associated with this test can be found in Appendix P of this ITCP.

This document will be modified as changes occur and will remain under
version control; a copy will be provided to the ***\[Insert
Group/Organization/Company Name Security Official\]*** as well as to
those persons and sites responsible for the plan's implementation and
operation, as identified in the distribution list found in Appendix A.

**Approval Signature Note:** In accordance with OMB Circular A-130,
Appendix III, final responsibility for determining that the plan
provides for reducing risk to an acceptable level should lie with the
manager whose program operations and assets are at risk. The date of the
accreditation memo is the approval date of this document.

/s/

\_\_\_\_\_[See Approval Signature Note]{.underline}\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

***\[Insert System Owner's Name\]* Date**

***\[Insert System Owner's Job Title\]***

***\[Insert System Acronym\]***

**System Owner**

The ITCP for ***\[Insert System Acronym\]*** is approved as meeting the
organization's disaster recovery requirements and the contingency plan
requirements as part of the certification and accreditation process.

/s/

\_\_\_\_\_[See Approval Signature Note]{.underline}\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

***\[Insert DAA's Name\]*** **Date**

***\[Insert DAA's Job Title\]***

**Designated Approving Authority (DAA)**

TABLE OF CONTENTS

[1. Introduction 1](#introduction)

## [1.1 Purpose of this Plan 1](#purpose-of-this-plan) {#purpose-of-this-plan-1 .TOC-2}

### [1.1.1 Applicability 2](#applicability) {#applicability-2 .TOC-3}

## [1.2 Scope 2](#scope) {#scope-2 .TOC-2}

### [1.2.1 Planning Principles 2](#planning-principles) {#planning-principles-2 .TOC-3}

### [1.2.2 Assumptions 3](#assumptions) {#assumptions-3 .TOC-3}

## [1.3 Threats 4](#threats) {#threats-4 .TOC-2}

## [1.4 References/Requirements 6](#referencesrequirements) {#referencesrequirements-6 .TOC-2}

[2. SUPPORTING INFORMATION 7](#supporting-information)

## [2.1 System Description 7](#system-description) {#system-description-7 .TOC-2}

### [2.1.1 System Environment 7](#system-environment) {#system-environment-7 .TOC-3}

### [2.1.2 Dependencies and Interconnecting Systems 7](#dependencies-and-interconnecting-systems) {#dependencies-and-interconnecting-systems-7 .TOC-3}

### [2.1.3 System Users 8](#system-users) {#system-users-8 .TOC-3}

## [2.2 ITCP Roles and Responsibilities 8](#itcp-roles-and-responsibilities) {#itcp-roles-and-responsibilities-8 .TOC-2}

### [2.2.1 ITCP Director 9](#itcp-director) {#itcp-director-9 .TOC-3}

### [2.2.2 ITCP Coordinator 9](#itcp-coordinator) {#itcp-coordinator-9 .TOC-3}

### [2.2.3 ITCP Recovery Team(s) 10](#itcp-recovery-teams) {#itcp-recovery-teams-10 .TOC-3}

[3. NOTIFICATION AND ACTIVATION PHASE
12](#notification-and-activation-phase)

## [3.1 Notification Procedures 12](#notification-procedures) {#notification-procedures-12 .TOC-2}

## [3.2 Outage Assessment Procedures 14](#outage-assessment-procedures) {#outage-assessment-procedures-14 .TOC-2}

## [3.3 ITCP Activation 15](#itcp-activation) {#itcp-activation-15 .TOC-2}

[4. RECOVERY PHASE 17](#recovery-phase)

## [4.1 Sequence of Recovery Activities 17](#sequence-of-recovery-activities) {#sequence-of-recovery-activities-17 .TOC-2}

## [4.2 Recovery Procedures 17](#recovery-procedures) {#recovery-procedures-17 .TOC-2}

### [4.2.1 Building and Facility Services 18](#building-and-facility-services) {#building-and-facility-services-18 .TOC-3}

### [4.2.2 IT Infrastructure 18](#it-infrastructure) {#it-infrastructure-18 .TOC-3}

### [4.2.3 System Software 19](#system-software) {#system-software-19 .TOC-3}

[5. RECONSTITUTION PHASE 21](#reconstitution-phase)

## [5.1 Concurrent Processing 21](#concurrent-processing) {#concurrent-processing-21 .TOC-2}

## [5.2 Resumption Activities 21](#resumption-activities) {#resumption-activities-21 .TOC-2}

## [5.3 Plan Deactivation 22](#plan-deactivation) {#plan-deactivation-22 .TOC-2}

[ITCP APPENDICES 0](#itcp-appendices)

[APPENDIX A. DISTRIBUTION LIST AND KEY PERSONNEL ACCEPTANCE SHEET
A-1](#appendix-a.-distribution-list-and-key-personnel-acceptance-sheet)

## [A.1 Distribution List A-1](#a.1-distribution-list) {#a.1-distribution-list-a-1 .TOC-2}

## [A.2 Key Personnel Acceptance Sheet A-2](#a.2-key-personnel-acceptance-sheet) {#a.2-key-personnel-acceptance-sheet-a-2 .TOC-2}

[APPENDIX B. ITCP Org Chart B-1](#appendix-b.-itcp-org-chart)

[APPENDIX C. EMERGENCY CONTACT INFORMATION
C-1](#appendix-c.-emergency-contact-information)

## [C.1 Key Personnel C-1](#c.1-key-personnel) {#c.1-key-personnel-c-1 .TOC-2}

## [C.2 Vendor Contact Information C-2](#c.2-vendor-contact-information) {#c.2-vendor-contact-information-c-2 .TOC-2}

[APPENDIX D. APPLICATION OUTAGE ASSESSMENT REPORT
D-1](#appendix-d.-application-outage-assessment-report)

[APPENDIX E. ACTION ITEM CHECKLIST
E-1](#appendix-e.-action-item-checklist)

[APPENDIX F. SYSTEM DIAGRAM F-1](#appendix-f.-system-diagram)

[APPENDIX G. APPLICATION INVENTORY
G-1](#appendix-g.-application-inventory)

## [G.1 System Inventory G-1](#g.1-system-inventory) {#g.1-system-inventory-g-1 .TOC-2}

## [G.2 Software Inventory G-1](#g.2-software-inventory) {#g.2-software-inventory-g-1 .TOC-2}

[APPENDIX H. APPLICATION RECOVERY PROCEDURES
H-1](#appendix-h.-application-recovery-procedures)

[APPENDIX I. SECONDARY PROCESSING PROCEDURES
I-1](#appendix-i.-secondary-processing-procedures)

[APPENDIX J. DATA BACKUP INFORMATION
J-1](#appendix-j.-data-backup-information)

[APPENDIX K. APPLICATION TEST PROCEDURES
K-1](#appendix-k.-application-test-procedures)

[APPENDIX L. AFTER ACTION REPORT L-1](#appendix-l.-after-action-report)

[APPENDIX M. SERVICE LEVEL AGREEMENTS (SLA)
M-1](#appendix-m.-service-level-agreements-sla)

[APPENDIX N. BUSINESS IMPACT ANALYSIS
N-1](#appendix-n.-business-impact-analysis)

## [N.1 Administration N-1](#n.1-administration) {#n.1-administration-n-1 .TOC-2}

### [N.1.1 Background N-1](#n.1.1-background) {#n.1.1-background-n-1 .TOC-3}

### [N.1.2 Authorities/Requirements N-1](#n.1.2-authoritiesrequirements) {#n.1.2-authoritiesrequirements-n-1 .TOC-3}

### [N.1.3 Assumptions N-1](#n.1.3-assumptions) {#n.1.3-assumptions-n-1 .TOC-3}

## [N.2 Business Impact Analysis N-2](#n.2-business-impact-analysis) {#n.2-business-impact-analysis-n-2 .TOC-2}

### [N.2.1 System Purpose N-2](#n.2.1-system-purpose) {#n.2.1-system-purpose-n-2 .TOC-3}

### [N.2.2 System Stakeholders N-2](#n.2.2-system-stakeholders) {#n.2.2-system-stakeholders-n-2 .TOC-3}

### [N.2.3 Critical Business Processes and Business Unit Sub-Processes N-2](#n.2.3-critical-business-processes-and-business-unit-sub-processes) {#n.2.3-critical-business-processes-and-business-unit-sub-processes-n-2 .TOC-3}

### [N.2.4 System Resources and Business Unit Sub-Processes N-3](#n.2.4-system-resources-and-business-unit-sub-processes) {#n.2.4-system-resources-and-business-unit-sub-processes-n-3 .TOC-3}

### [N.2.5 Outage Impact on Business Unit Sub-Processes N-3](#n.2.5-outage-impact-on-business-unit-sub-processes) {#n.2.5-outage-impact-on-business-unit-sub-processes-n-3 .TOC-3}

### [N.2.6 Sub-Process Recovery Time Objectives and Recovery Point Objectives N-4](#n.2.6-sub-process-recovery-time-objectives-and-recovery-point-objectives) {#n.2.6-sub-process-recovery-time-objectives-and-recovery-point-objectives-n-4 .TOC-3}

### [N.2.7 Recovery Priorities for System Resources N-5](#n.2.7-recovery-priorities-for-system-resources) {#n.2.7-recovery-priorities-for-system-resources-n-5 .TOC-3}

## [N.3 Critical Business Processes N-5](#n.3-insert-organization-critical-business-processes) {#n.3-critical-business-processes-n-5 .TOC-2}

[APPENDIX O. RELATED CONTINGENCY PLANS
O-1](#appendix-o.-related-contingency-plans)

[APPENDIX P. TEST, TRAINING, AND EXERCISE (TT&E)
P-1](#appendix-p.-test-training-and-exercise-tte)

## [P.1 TT&E Program Overview P-1](#p.1-tte-program-overview) {#p.1-tte-program-overview-p-1 .TOC-2}

## [P.2 TT&E Program Components P-1](#p.2-tte-program-components) {#p.2-tte-program-components-p-1 .TOC-2}

### [P.2.1 Exercise Development and Preparation P-1](#p.2.1-exercise-development-and-preparation) {#p.2.1-exercise-development-and-preparation-p-1 .TOC-3}

### [P.2.2 Exercise Training and Execution P-2](#p.2.2-exercise-training-and-execution) {#p.2.2-exercise-training-and-execution-p-2 .TOC-3}

### [P.2.3 Documenting Exercise Results P-5](#p.2.3-documenting-exercise-results) {#p.2.3-documenting-exercise-results-p-5 .TOC-3}

### [P.2.4 Plan Maintenance P-5](#p.2.4-plan-maintenance) {#p.2.4-plan-maintenance-p-5 .TOC-3}

### [P.2.5 After Action and Summary Reports P-6](#p.2.5-after-action-and-summary-reports) {#p.2.5-after-action-and-summary-reports-p-6 .TOC-3}

### [P.3 TT&E Materials P-6](#p.3-tte-materials) {#p.3-tte-materials-p-6 .TOC-3}

### [P.3.1 Agenda P-6](#p.3.1-agenda) {#p.3.1-agenda-p-6 .TOC-3}

### [P.3.2 Scenario P-6](#p.3.2-scenario) {#p.3.2-scenario-p-6 .TOC-3}

### [P.3.3 Presentation Materials P-9](#p.3.3-presentation-materials) {#p.3.3-presentation-materials-p-9 .TOC-3}

### [P.3.4 After Action and Summary Reports P-10](#p.3.4-after-action-and-summary-reports) {#p.3.4-after-action-and-summary-reports-p-10 .TOC-3}

## [P.4 Exercise Results P-10](#p.4-exercise-results) {#p.4-exercise-results-p-10 .TOC-2}

### [P.4.1 Summary Report P-10](#p.4.1-summary-report) {#p.4.1-summary-report-p-10 .TOC-3}

### [P.4.2 Exercise After Action Report P-11](#p.4.2-exercise-after-action-report) {#p.4.2-exercise-after-action-report-p-11 .TOC-3}

[APPENDIX Q. GLOSSARY Q-1](#appendix-q.-glossary)

[APPENDIX R. ACRONYM LIST R-1](#appendix-r.-acronym-list)

###  {#section .TOC-3}

***\[This sample format provides a template for preparing an information
technology (IT) contingency plan (ITCP). The template is intended to be
used as a guide, and the Contingency Planning Coordinator should modify
the format as necessary to meet the system's contingency requirements
and comply with internal policies. Where practical, the guide provides
instructions for completing specific sections. Text is added in certain
sections; however, this information is intended only to suggest the type
of information that may be found in that section. The text is not
comprehensive and should be modified to meet specific considerations
related to the system. References to the appropriate GSS ITCP document
or the relevant site Disaster Recovery Plan may also be made within the
body of this plan, if applicable.\]***

# Introduction

Information technology (IT) and automated information systems are vital
to an organization's business processes, and for that reason must be
able to operate without interruption. IT contingency planning refers to
the dynamic development of a coordinated recovery strategy for IT
systems ***\[System or General Support System (GSS)\]***, operations,
and data after a disruption. The planning process requires seven steps:
develop contingency planning policy statement; conduct the business
impact analysis (BIA); identify preventive controls; develop recovery
strategies; develop the ITCP; test and exercise the plan and train
personnel; and maintain the plan.

## Purpose of this Plan

The ***\[Insert System Name\]*** (***\[Insert System Acronym\]***) ITCP
establishes procedures to recover and resume normal operations of
***\[Insert System Acronym\]*** following a disruption. The following
objectives have been established for this plan:

-   Provide a complete description of the system along with its
    boundaries and interdependencies as well as a description of the
    roles and responsibilities of key personnel (SECTION 2).

-   Maximize the effectiveness of contingency operations through an
    established plan that consists of the following phases:

    -   **Notification/Activation Phase** (SECTION 3): to detect and
        assess the system outage, to notify the proper personnel, and to
        activate the plan

    -   **Recovery Phase** (SECTION 4): to identify and prioritize
        recovery activities, to restore temporary IT operations, and to
        recover the original system

    -   **Reconstitution Phase** (SECTION 5): to resume IT system
        processing capabilities to normal operations and to deactivate
        this plan.

-   Identify the activities, resources, and procedures needed to fulfill
    system processing requirements during prolonged interruptions of
    normal operations

-   Assign responsibilities to designated ***\[Insert Organization\]***
    personnel and provide guidance for recovering ***\[Insert System
    Acronym\]*** during prolonged periods of interruption of normal
    operations

-   Ensure coordination with the ***\[Insert Organization\]*** staff or
    other ***\[Insert Organization\]*** personnel that participate in
    contingency planning strategies

-   Ensure coordination with external points of contact (POC) such as
    contractors or vendors who participate in the contingency planning
    strategies.

Supplemental information referred to in this plan will be found in the
appendices. Such information includes, but is not limited to: plan
distribution list; contact lists; system outage assessment report form;
action item checklist; system equipment inventory; recovery procedures;
the ***\[Insert Organization\]*** POC for off-site data storage and
other related data backup information; after action report form; service
level agreements (SLAs); BIA; a list of related contingency plans; and
TT&E materials.

### Applicability

The ITCP applies to the functions, operations, and resources necessary
to recover and resume ***\[Insert Organization\]***'s ***\[Insert System
Acronym\]*** operations as it is installed at ***\[Insert Primary
Location\]***. The ***\[Insert System Acronym\]*** ITCP applies to
***\[Insert Organization\]*** and all other persons associated with
***\[Insert System Acronym\]*** as identified under Section 2.2, Roles
and Responsibilities.

A system ITCP organizational chart that depicts all key personnel and
site support is shown in Appendix B of this document. Appendix F
provides a diagram that defines the boundaries of the system for the
purpose of this plan. A more detailed system description that outlines
the scope of ***\[Insert System Acronym\]*** operations is located in
Section 2 of this document.

The ***\[Insert System Acronym\]*** ITCP is supported by ***\[List other
recovery plan names for supporting GSSs, DRP, etc. This information
should correspond with those plans listed in Appendix O.\]***.
Procedures outlined in this plan are coordinated with and support those
recovery and contingency plans.

## Scope 

### Planning Principles 

This plan does not identify contingencies for every possible outage that
could occur. Rather, it helps address and plan for two outage types: 1)
minor system failures and 2) major system failures. Full contingency
plan implementation may not be required for all disruptions. In some
cases, partial implementation may be appropriate. The ***\[Insert System
Acronym\]*** ITCP is based on the following scenarios: the ITCP will not
be activated for a 'minor system failure'; however, consideration for
full implementation should be given for most 'major system failures'.
The outage types are categorized as follows:

***Minor System Failure***

A minor system failure is defined as any disruption in the availability
or operational status of the system where the disruption time is
expected to be less than the recovery time objective (RTO)[^1]. The RTO
for ***\[Insert System Acronym\]*** is ***\[Insert \# of hours\]***
hours.

Major System Failure

A major system failure is defined as any disruption in the availability
or operational status of the system where the disruption time is
expected to be [equal to or greater than]{.underline} the RTO.

This plan addresses the notification of key personnel, system recovery,
and system reconstitution as it relates to ***\[Insert System
Acronym\]***. If anything else outside the scope of this system (i.e.,
server, network, and/or facility disruption) needs to be recovered,
other plans, such as those identified in Section 1.2 will likely need to
be referred to and/or activated in parallel with this plan, as
appropriate.

### Assumptions 

Based on these principles, the following assumptions were used when
developing the ITCP:

***\[Sample Text Below\]***

-   The ***\[Insert System Acronym\]*** is inoperable at the ***\[Insert
    Primary Location\]*** and cannot be recovered within ***\[Insert \#
    of hours\]*** hours

-   The ***\##*** GSS ITCP that supports the hardware for ***\[Insert
    System Acronym\]*** will be activated in concurrence with this
    system ITCP should the damage be beyond the scope of this ITCP, as
    appropriate

-   The disaster recovery plan (DRP) for the affected location(s) will
    be activated in concurrence with this ITCP if the damage is beyond
    the scope of this ITCP and relocation is required, as appropriate

-   Key ***\[Insert System Acronym\]*** personnel have been identified
    and trained in their emergency response and recovery roles; they are
    available to activate the ***\[Insert System Acronym\]*** ITCP

-   Preventive controls (e.g., generators, environmental controls,
    waterproof tarps, sprinkler systems, fire extinguishers, and fire
    department assistance) are fully operational at the time of the
    disruption

-   Equipment, including components supporting ***\[Insert System
    Acronym\]***, is connected to an uninterruptible power supply (UPS)
    that provides ***\[Number of hours\]*** hour of electricity during a
    power failure

-   Current backups of the system software and data are intact and
    available at the offsite storage facility

-   The equipment, connections, and capabilities required to operate
    ***\[Insert System Acronym\]*** are available at the alternate site
    in ***\[Insert City, State\]***

-   SLAs have been prepared and signed by all parties, and are
    maintained with ***\[Insert System Acronym\]*** hardware, software,
    and communications providers to support the emergency system
    recovery

-   This plan is up-to-date and accessible to key personnel responsible
    for executing the plan.

The ***\[Insert System Acronym\]*** ITCP does not apply to the following
situations:

-   Emergency evacuation of personnel. The occupant evacuation plan
    (OEP) will cover personnel evacuation

-   Overall recovery of business operations. These will be covered by
    the business resumption plan (BRP)

-   Relocation of personnel and equipment as this should be covered by
    the site's DRP, as applicable

-   ***\[Insert any additional constraints\]***.

## Threats

The ***\[Insert System Acronym\]*** ITCP describes contingencies for
circumstances, events, or acts that could cause harm to ***\[Insert
System Acronym\]*** by destroying, disclosing, modifying, or denying
access to ***\[Insert Organization\]*** information resources. The plan
provides a flexible and scalable response and recovery strategy to
accommodate a variety of disruptions. Potential threats to the system's
availability are displayed in Table 1 below.

Table 1: Threats to *\[Insert System Acronym\]*

***UPDATE TABLE WITH THREATS SPECIFIC TO ORGANIZATION
LOCATION/FUNCTIONS***

  -------------------------- ----------------------------------------------------------
  Natural Threats            

  Flooding                   Flooding of the computer room and support areas from
                             sources external to the building (e.g., mudslides).

  Earthquake                 An earthquake causing structural damage to the facility
                             and surrounding area.

  Lighting Strikes           A lightning strike can cause a power surge and damage
                             electrical delivery equipment.

  Severe Storm               Facility and/or surrounding area damage due to snowstorms,
                             sand storms, hail, monsoons, dust storms, hurricanes,
                             tornadoes, or lightning not directly associated with other
                             natural threats.

  **ENVIRONMENTAL/PHYSICAL   
  THREATS**                  

  Fire                       Can include large fires (e.g., those that trigger the fire
                             suppression system, if the site is so equipped, or require
                             the involvement of trained fire fighters) and small fires
                             (e.g., those extinguishable with a hand-held
                             extinguisher).

  Heating, Ventilation, and  Failure of environmental controls, causing increased
  Air-Conditioning (HVAC)    temperature and humidity, which can damage sensitive
  Failure                    computer equipment and storage media.

  Power Loss                 Long-term power failure associated with power outages.

  Liquid Leakage             Liquid leakage resulting in flooding of the computer room
                             and support areas from an internal source (e.g., broken
                             water or sewage pipes or activated fire suppression
                             system).

  Loss of Communication      Loss of physical communication capabilities (e.g., cable
  Medium                     break).

  Human Threats              

  Accidental System Damage   The unintentional destruction or degradation of any system
                             and/or component.

  Theft                      Acquisition of data, hardware and/or software by
                             unauthorized individuals.

  Eavesdropping              Connecting to, or tapping, the voice or data transmissions
                             by an unauthorized individual to gain access to the
                             message content for the purpose of the reviewing it.

  Sabotage/ Vandalism        The deliberate destruction or degradation of any system
                             and/or component.

  Improper Handling of       The failure of authorized individuals to handle sensitive
  Sensitive Information      information (e.g., Privacy Act protected, Sensitive But
                             Unclassified, For Official Use Only, or proprietary, etc.)
                             in accordance with applicable policies and procedures,
                             possibly compromising the information.

  Resource Misuse and Abuse  The unauthorized use of any asset for a purpose other than
                             originally intended.

  Social Engineering         A method of obtaining information to be used for
                             compromising a system (e.g., a password) from an
                             individual rather than by breaking into the system. Social
                             engineering can be used over an extended period of time to
                             maintain a continuing stream of information and help from
                             unsuspecting users.

  Unauthorized External      The ability and opportunity of an external source to
  Access                     obtain information, or physical access to facilities,
                             without proper authorization or clearance.

  Unauthorized Internal      The ability and opportunity of an internal source to
  Access                     obtain information, or physical access to facilities,
                             without proper authorization or clearance.

  Terrorism                  Destruction of any system by means of information warfare,
                             system attack, system penetration, or system tampering.

  Impersonation              Misrepresentation of human or cyber identity.

  Falsified Input            Deliberately inputting inaccurate data or information into
                             a system to cause corruption of data.

  Interception               Capturing unauthorized data for malicious intent.

  Bribery                    Offering money or something of value, in order to gain
                             system access.

  Hacking                    Gaining unauthorized system access by exploiting
                             vulnerabilities.

  Unauthorized Disclosure of Providing system related information to unauthorized
  Information                user(s).

  Fraud                      An act, statement, or omission deliberately practiced to
                             gain unauthorized system access.

  Intimidation of Personnel  To coerce or inhibit employees, usually by threats, to
                             gain unauthorized access to internal networks.

  Negligence or Human Error  Failure to act carefully and responsibly, resulting in
                             unintended destruction or degradation to the system.

  Spoofing                   A technique used to reduce network overhead by having
                             devices, such as bridges and routers, answer for remote
                             devices or by manipulating internet protocol (IP)
                             addresses, so that the attacker appears to be someone or
                             something else.

  Unauthorized Modification  Unauthorized altering of information resulting in
  of Information             degradation of system and/or services.

  System Tampering           Interfering with the system in a harmful manner resulting
                             in degradation or unavailability of system and/or
                             resources.

  Blackmail                  Extorting money, system information, or something else of
                             value from an employee, by the threat of exposing
                             discreditable information.

  Malicious/Mobile Code      Distribution of worms, viruses, logic bombs, Trojan
                             horses, etc., with the intent to corrupt system data.

  Password Guessing          Attempting to obtain system passwords by unlawful methods
                             (e.g., dictionary attack, password cracker tools,
                             intercepting network packets).
  -------------------------- ----------------------------------------------------------

## References/Requirements

This ITCP complies with all applicable departmental and ***\[Insert
Organization\]*** contingency planning policy statements including, but
not limited to, the organization's policies. The plan also complies with
the following Federal and departmental policies and guidelines:

-   Public Law 107-347, E-Government Act of 2002, Title III, *Federal
    Information Security Management Act*, December 2002

-   Office of Management and Budget Circular A-130, Appendix III,
    *Security of Federal Automated Information Resources*, November 2000

-   Homeland Security Presidential Directive/HSPD-20, *National
    Continuity Policy*, May 2007

-   Department of Homeland Security (DHS), *National Response Plan*, May
    2006

-   Homeland Security Presidential Directive 7, *Critical Infrastructure
    Identification, Prioritization, and Protection*, December 2003

-   National Institute of Standards and Technology (NIST) Special
    Publication (SP) 800-34, *Contingency Planning Guide for Information
    Technology Systems*, June 2002

-   National Institute of Standards and Technology (NIST) Special
    Publication (SP) 800-53, *Recommended Security Controls for Federal
    Information Systems*, February 2005

-   National Institute of Standards and Technology (NIST) Special
    Publication (SP) 800-84, *Guide to Test, Training, and Exercise
    Programs for IT Plans and Capabilities*, July 2006

# SUPPORTING INFORMATION

## System Description

***\[The content for this section usually comes straight from Section
2.13 of the System SSP.\]***

***\[Provide a general description of system architecture and
functionality. Indicate the operating environment, physical location,
general location of users, and partnerships with external
organizations/systems. Include information regarding any other technical
considerations that are important for recovery purposes, such as system
dependencies, related GSSs, backup procedures, etc. Provide a diagram of
the architecture, including dependencies, security controls and
telecommunications connections.\]***

### System Environment

***\[The content for this section comes straight from Section 2.14 of
the System SSP.\]***

The highest level of data and information contained on the ***\[Insert
System Acronym\]*** system is sensitive. ***\[Insert System Acronym\]***
contains personally identifiable information (PII) such as the name,
phone number, email address, date of birth, and other sensitive
information. This type of information is considered privileged and
unauthorized disclosure could cause embarrassment to ***\[Insert
Organization\]*** and potential liability concerns for the ***\[Insert
Organization\]***.

Refer to Appendix F of this document for a diagram of the system\'s
system architecture.

### Dependencies and Interconnecting Systems

***\[The content for this section usually comes straight from Section
2.15 of the System SSP.\]***

***\[Insert System Acronym\]*** ***\[does/does not\]*** connect to any
other systems at this time.

***\[If the system does interconnect with other systems or systems, list
the system or system name and the nature of the interconnection.\]***

\[sample table\]

+------+--------+---------+---------+------+-------+-------+---------+
| Sy   | Organi | Type    | Authori | Date | FIPS  | C&A   | Name    |
| stem | zation |         | zations | of   | 199   | S     | and     |
|      |        | (       |         | A    | Cat   | tatus | Title   |
| Name |        | TCP/IP, | (M      | gree | egory | of    | of      |
|      |        | D       | OU/ISA) | ment |       | the   | Auth    |
|      |        | ial-up, |         |      |       | S     | orizing |
|      |        | SNA,    |         |      |       | ystem | O       |
|      |        | etc.)   |         |      |       |       | fficial |
+------+--------+---------+---------+------+-------+-------+---------+
|      |        |         |         |      |       |       |         |
+------+--------+---------+---------+------+-------+-------+---------+
|      |        |         |         |      |       |       |         |
+------+--------+---------+---------+------+-------+-------+---------+
|      |        |         |         |      |       |       |         |
+------+--------+---------+---------+------+-------+-------+---------+
|      |        |         |         |      |       |       |         |
+------+--------+---------+---------+------+-------+-------+---------+
|      |        |         |         |      |       |       |         |
+------+--------+---------+---------+------+-------+-------+---------+

### System Users

***\[The content for this section may come from portions of Section 2.13
of the System SSP or may have to be derived independently of the
SSP.\]***

***\[Describe here how user access is determined/controlled and what
types of information the user will have access to. Provide a brief
description of the user interface with the system.\]***

***\[Insert this sentence at the end of the description.\]*** "For
additional user information, refer to the ***\[Insert System
Acronym\]*** System Security Plan (SSP)."

## ITCP Roles and Responsibilities

This section discusses key ***\[Insert Organization\]*** personnel and
teams responsible for recovering ***\[Insert System Acronym\]*** and its
main components. The ITCP designates specific individuals and teams for
directing and managing the ITCP during both emergency and non-emergency
periods. Direction and management of the contingency plan is pushed
top-down through the ***\[Insert Organization\]*** organizational
structure. The roles and responsibilities outlined below are responsible
for ensuring that the plan is executed and normal operations are
restored. Appendix B provides a graphical depiction of the plan's
organizational chart and hierarchy of roles.

The key ITCP roles for this system are outlined in Table 2. Contact
information for the personnel assigned to those roles is provided in
Appendix C.

***\[The following roles and responsibilities are samples only. The
Roles and Responsibilities section should be filled in and validated in
coordination with the \[Insert Organization\] counterparts. Describe
each team separately, highlighting overall recovery goals and specific
responsibilities. Do not detail the procedures that will be used to
execute these responsibilities. These procedures will be itemized in the
appropriate phase sections***.

***NOTE: PLEASE ENSURE THAT ALL ROLES BELOW COINCIDE WITH THE ORG
CHART\]***

### ITCP Director

The ITCP Director for ***\[Insert System Acronym\]*** is the ***\[Insert
Business Unit and Job Title\]***. The ITCP Director has ultimate
responsibility for ensuring the development, execution, and maintenance
of the ***\[Insert System Acronym\]*** ITCP. The ITCP Director ensures
that the ITCP strategies in this document are developed with the
cooperation of functional and resource managers associated with the
system or the business processes supported by the system. Additionally,
the ITCP Director ensures that the plan remains a viable tool by
authorizing any future changes to the document. The ITCP Director may
delegate all or parts of the development, maintenance, and distribution
of the plan to the ITCP Coordinator or other personnel, as appropriate.

In the event of a 'major system failure', the ITCP Director will be
notified by the ITCP Coordinator after a formal system outage assessment
has been conducted. The ITCP Director will meet with the ITCP
Coordinator to confirm the expected duration of the disruption and
officially declare the ITCP activated, provided that all activation
criteria have been met (see Section 4.2). If the ITCP Director is not
available for assessing an emergency situation and directing the
activation of the plan, the Alternate ITCP Director will assume all
responsibilities. The Alternate ITCP Director for ***\[Insert System
Acronym\]*** is the ***\[Insert Business Unit and Job Title\]***.

After reviewing the outage assessment, the ITCP Director will determine
if interim secondary processing activities should be initiated to
maintain business operations during the outage. The ITCP Director is
also responsible for contacting the ITCP Coordinator and other
***\[Insert Organization\]*** personnel in the event recovery operations
are not being executed as planned or defined in any SLAs. In this
situation, the ITCP Director should ensure the event is escalated to
appropriate ***\[Insert Organization\]*** officials to ensure that
recovery operations are resumed or completed as efficiently as possible.

### ITCP Coordinator

The ITCP Coordinator for this plan is the ***\[Insert Business Unit and
Job title\]***. The ITCP Coordinator is responsible for contacting key
Recovery Team personnel to monitoring the status of contingency
activities until the system is fully recovered. When the ITCP
Coordinator is the first point of contact during an system disruption,
he/she will notify the Recovery Team who will perform a system outage
assessment to determine the expected duration of the system's outage, as
appropriate (i.e., major system failure or minor system failure). Once
completed, the ITCP Coordinator is responsible for discussing the system
outage assessment report with the ITCP Director before formal activation
of the plan. If interim secondary processing activities are initiated
during the disruption, the ITCP Coordinator is often the one who will
coordinate and instruct the users on what to do, as appropriate.

Once the system has been recovered and normal operations have been
resumed, the ITCP Coordinator is responsible for completing an
after-action report (AAR) and filing it with the ITCP Director. The ITCP
Coordinator may be assigned certain responsibilities for the periodic
maintenance, testing, and distribution of the plan by the ITCP Director,
as needed. If the ITCP Coordinator is unavailable, the Alternate ITCP
Coordinator is responsible for executing the outlined responsibilities.

### ITCP Recovery Team(s)

***\[This section should be modified to reflect the actual structure of
the recovery team and its components.\]***

The Recovery Team consists of key personnel involved in system outage
assessment, recovery, and resumption activities and is comprised of
member teams that have two specific focuses---system support and network
support. The team members are personnel who are also responsible for the
daily operations and maintenance of the system. Members of the team
consist of database and system administrators.

Activities and extent of participation is dependant on the nature of the
outage. Member teams work in concert to determine the nature and
expected duration of the outage and to recover ***\[Insert System
Acronym\]*** operations. The ITCP Coordinator monitors the status of
overall system outage assessment, recovery, and resumption activities as
performed by the Recovery Team and reports status information to the
ITCP Director, as appropriate.

***\[Update sample table below with actual roles and responsibilities
based on descriptions above.\]***

**Table 2: *\[Insert System Acronym\]* ITCP Roles and Responsibilities**

+----------+-----------+-----------------------------------------------+
| **ITCP   | **Job     | **Responsibilities**                          |
| Role     | Title**   |                                               |
| /Title** |           |                                               |
+==========+===========+===============================================+
| ITCP     | **        | -   Overall responsibility for the            |
| Director | *\[Insert |     development, execution, and maintenance   |
|          | System    |     of the ITCP                               |
|          | Acr       |                                               |
|          | onym\]*** | -   Ensures that the ITCP is developed with   |
|          |           |     the cooperation of a broad set of         |
|          | **        |     managers associated with the              |
|          | *\[Insert |     functionality and business processes      |
|          | JobT      |     supported by the system                   |
|          | itle\]*** |                                               |
|          |           | -   Confirms expected duration of the system  |
|          |           |     disruption with the ITCP Coordinator      |
|          |           |     after an system outage assessment has     |
|          |           |     been developed                            |
|          |           |                                               |
|          |           | -   Declares formal activation of the ITCP    |
|          |           |                                               |
|          |           | -   Determines if interim activities ***\[If  |
|          |           |     Applicable: "such as secondary processing |
|          |           |     procedures"\]*** should be initiated to   |
|          |           |     maintain current business operations or   |
|          |           |     if operations should be temporarily       |
|          |           |     suspended until the system has been       |
|          |           |     recovered                                 |
|          |           |                                               |
|          |           | -   Contacts ***\[Insert Organization\]***    |
|          |           |     officials in the event recovery           |
|          |           |     operations are not progressing and the    |
|          |           |     situation needs to be escalated           |
|          |           |                                               |
|          |           | -   Responsible for the testing, maintenance, |
|          |           |     and distribution of the ITCP, which may   |
|          |           |     be delegated to other personnel           |
|          |           |                                               |
|          |           | -   Authorizes all future changes to the ITCP |
+----------+-----------+-----------------------------------------------+
| ITCP     | **        | -   Monitors the status of system outage      |
| Coo      | *\[Insert |     assessment, recovery, and resumption      |
| rdinator | System    |     activities until the system is fully      |
|          | Acr       |     recovered                                 |
|          | onym\]*** |                                               |
|          |           | -   Monitors and coordinates all activities   |
|          | **        |     ensuring that contingency operations are  |
|          | *\[Insert |     being performed as planned or stated in   |
|          | JobT      |     any SLAs                                  |
|          | itle\]*** |                                               |
|          |           | -   Provides periodic updates for recovery    |
|          |           |     operations to the ITCP Director, as       |
|          |           |     appropriate                               |
|          |           |                                               |
|          |           | -   Contacts the ITCP Director and files an   |
|          |           |     AAR upon resumption of normal operations  |
|          |           |                                               |
|          |           | -   Assists the ITCP Director in testing,     |
|          |           |     maintenance, and distribution of the      |
|          |           |     plan, as needed                           |
+----------+-----------+-----------------------------------------------+
| Recovery | **        | -   Assists in determining the nature and     |
| Teams    | *\[Insert |     expected duration of the outage           |
|          | JobTitl   |                                               |
|          | e(s)\]*** | -   Assists in all recovery and resumption    |
|          |           |     activities for minor system failures, as  |
|          |           |     necessary                                 |
|          |           |                                               |
|          |           | -   Assists in all recovery and resumption    |
|          |           |     activities for major system failures, as  |
|          |           |     necessary                                 |
+----------+-----------+-----------------------------------------------+

# NOTIFICATION AND ACTIVATION PHASE

Prompt notification and activation are essential for effective plan
implementation. System disruptions may occur with or without notice.
Disruptions that typically occur with warning include hurricanes,
floods, and scheduled system outages. Disruptions that often occur
without warning include fires, hardware and software failures, power
outages, and malicious system tampering.

Early awareness allows for preparation, mitigation, and early
contingency plan implementation in conjunction with a graceful shutdown
of system operations. In the absence of advanced warning, the initial
detection of a system disruption would initiate an immediate and
simultaneous notification and outage assessment process.

NOTE: In an emergency, ***\[Insert Organization\]*** top priority is to
preserve the health and safety of its staff and all other supporting
personnel (i.e., contractors, vendors, etc). ***\[Insert
Organization\]*** staff should ensure that the emergency conditions do
not threaten the health and safety of its staff or other personnel
before proceeding to the notification and activation procedures.
Emergency phone numbers are located in Appendix C of this document.

## Notification Procedures

This phase addresses the initial actions taken to detect and assess the
***\[Insert System Acronym\]*** outage. Based on the outage assessment,
the plan may be activated by the ITCP Director. Contact information for
key personnel is located in Appendix C.

**In an emergency, *\[Insert Business Unit\]*' top priority is to
preserve the health and safety of its staff before proceeding to the
notification and activation procedures.**

***\[The information contained here is sample text and should be
tailored to meet the specific requirements of the System\]***

Once a system disruption has been detected, the following notification
procedures should be followed:

***\[Insert notification procedures\]***

If the outage assessment identifies the situation as a 'major system
failure', follow the notification procedures below:

***\[Insert notification procedures\]***

Appendix E contains an action item checklist that will guide recovery
personnel through the necessary steps in each of the recovery phases
(notification/activation, recovery, and reconstitution).

## Outage Assessment Procedures

***\[Detailed procedures should be outlined to include activities to
determine the cause of the disruption; potential for additional
disruption or damage; affected physical area and status of physical
infrastructure; status of IT equipment functionality and inventory,
including items that will need to be replaced; and estimated time to
repair services to normal operations.\]***

Upon notification that an system failure has occurred, it is imperative
that an assessment be made as quickly as possible to assess the nature
and extent of the failure. The purpose of this assessment is to gain
relevant information and to determine the best strategies for recovering
the system. Based on the nature of the disruption, the following is a
list of high-level system outage assessment procedures that may be
applicable:

1.  Designate a work area for the Recovery Team members to collaborate
    and convene.

```{=html}
<!-- -->
```
1.  Ensure that the appropriate contact information is readily available
    for the ITCP Coordinator and Alternate ITCP Coordinator (refer to
    Appendix C for contact information).

2.  Copy and distribute the system outage assessment report form to the
    appropriate Recovery Team members (refer to Appendix C).

3.  If applicable, coordinate with the Building and Facility Services
    contact to request that the computer room's power not be restored
    until an system outage assessment has been completed and determines
    that it is safe.

4.  Building access permitting, conduct a visual inspection of the
    server area. Visually inspect all ***\[Insert System Acronym\]***
    equipment for external and internal damage. **DO NOT POWER UP ANY
    EQUIPMENT PRIOR TO PASSING THIS INSPECTION**.

5.  Determine whether or not the vendor should be contacted to service
    any affected equipment.

6.  Note the position of the equipment power switch during inspection.
    If visual inspection determines that the switch is in the "on"
    position, switch it to the "off" position.

7.  Ensure that any hardware that is determined to be unsafe to operate
    is appropriately labeled. If determined to be safe, unplug equipment
    from the power source.

8.  When equipment is ready for power up testing, advise the Building
    and Facility Services contact. Stand-by until advised that power has
    been restored.

9.  Working in concert with the appropriate Recovery Team members, power
    up one-piece-at-a-time each of the ***\[Insert System Acronym\]***
    components.

10. Annotate the condition of each component on the system outage
    assessment report form.

11. Determine the status of the data stored within ***\[Insert System
    Acronym\]*** and whether data backups need to be retrieved from
    offsite storage.

12. Work with the appropriate Recovery Team members to determine the
    estimated time to repair/replace or reconstruct major elements of
    the system.

13. Based on outage assessment findings, be prepared to recommend either
    partial or full activation of the ITCP.

14. Provide a completed system outage assessment report to the ITCP
    Coordinator and brief the ITCP Coordinator on the overall system
    outage assessment findings.

The following information should be captured in the system outage
assessment report:

-   Cause of the system disruption, including type, scope, location, and
    time of disruption

-   Whether the system outage is localized (this system only) or
    widespread

-   The location of failing components and those users without service

-   The impact of the disruption or components damaged

-   The functional status of all system components (e.g., fully
    functional, partially functional, nonfunctional)

-   The potential for additional disruption or system damage

-   Identification of a single point of failure (if possible)

-   Items to be replaced (e.g., hardware, software, firmware, supporting
    materials)

-   Anticipated downtime of the system (e.g., longer than two days)

-   Classify disruption as 'minor system failure' or 'major system
    failure'.

A standard system outage assessment form is provided in the back of this
document to assist in collecting this information (see Appendix D).
Additionally, to perform an effective assessment, it is important to
have a list of available equipment, software, and data on hand (see
Appendix G). Upon completion of the system outage assessment, the ITCP
Coordinator is responsible for reporting the findings of the Recovery
Teams to the ITCP Director, so that a formal declaration can be made as
to whether the ITCP should be activated. For more information on
activating the contingency plan, refer to Section 3.3 below.

## ITCP Activation

***\[Sample text is provided below; System owners should determine their
own criteria for plan activation based on the specific requirements of
the system and the criticality as identified in the BIA.\]***

After obtaining the system outage assessment report from the Recovery
Team, the ITCP Coordinator will contact the ITCP Director to activate
the contingency plan. Although the Recovery Teams will make the initial
determination of 'minor' vs. 'major' system failure, the ITCP Director
is responsible for formal activation of the plan; therefore, to ensure
recovery operations can begin as quickly as possible, it is important
for the ITCP Coordinator, ITCP Director, and Recovery Team(s) personnel
to be familiar with the ITCP activation criteria. The disruption should
be considered a 'major system failure' and ITCP activated if one or more
of the following criteria are met:

-   The system outage assessment reveals critical ***\[Insert System
    Acronym\]*** components supporting the system will be unavailable
    for more than ***\[Insert \# of hours\]*** hours, depending on the
    nature of the disruption.

-   The system outage assessment reveals that ***\[Insert System
    Acronym\]*** software is corrupt and will require development
    activities lasting longer than ***\[Insert \# of hours\]*** hours to
    repair.

-   The outage assessment determines the facility housing failing
    components for ***\[Insert System Acronym\]*** is damaged and will
    be unavailable for more than ***\[Insert \# of hours\]*** hours,
    depending on the nature of the disruption.

-   Other criteria as necessary.

**Activation Procedures:**

-   If the plan is to be activated, the ITCP Coordinator will notify the
    Recovery Team that ITCP activation has occurred and will begin
    monitoring the status of overall recovery and resumption activities
    as performed by the Recovery Team, as appropriate.

-   Upon notification from the ITCP Coordinator, Recovery Team Leads
    will notify their respective team members. Team members will be
    informed of all applicable information and prepared to respond.

-   The Recovery Team will notify the off-site storage facility that a
    contingency event has been declared and to ship the necessary
    materials (as determined by system outage assessment) to the
    alternate site, if appropriate.

-   The Recovery Team will notify the alternate site that the ITCP has
    been activated, if applicable.

-   The ITCP Coordinator will notify remaining personnel and users (via
    notification procedures) on the general status of the disruption, as
    appropriate.

# RECOVERY PHASE

This section provides procedures for recovering and restoring
***\[Insert System Acronym\]*** services. Recovery phase activities
focus on contingency measures to recovery IT processing capabilities and
restore all supporting infrastructure. The recovery procedures provided
in this section will assist ***\[Insert System Acronym\]*** and
supporting Recovery Team personnel in recovering from a 'major system
failure'. As noted earlier, the ITCP is not activated in the recovery of
a 'minor system failure'.

## Sequence of Recovery Activities

When recovering an system, the recovery procedures should follow a
logical order based on priorities. The RTO is the overall length of time
an system's components can be in the recovery phase of the contingency
operations before negatively impacting the ***\[Insert System
Acronym\]*** mission or business processes. Recovery priorities are
based on the RTO and the other interdependencies between system
components using a 1-high priority, 2-medium priority, and 3-low
priority scoring scale to sequence activities and allocate resources.
Table 3 below identifies critical IT resources/components, outage
impact, RTOs, and recovery priorities.

**Table 3: *\[Insert System Name\]*** Component RTOs

  ------------------------------------------------------------------------------
  **Component**     **Software         **RTO/Recovery   **System Outage Impact**
                    (Name/Version)**   Priority         
                                       Sequence**       
  ----------------- ------------------ ---------------- ------------------------
  ***Primary        ***Win2k/SQL 2K*** ***4 hours/1***  ***Database not
  Database                                              accessible for the
  Server***                                             system purposes.***

  ***Primary Web    ***Win2k/Apache    ***4 hours/1***  ***Website not
  Server***         Tomcat 5.X***                       accessible to users.***

  ***Development    ***Win2K/SP4***    ***4 hours/2***  ***Development server;
  Database                                              can be brought online
  Server***                                             after primary servers
                                                        are online.***

  ***Development    ***Win2K/SP4***    ***4 hours/2***  ***Development server;
  Web/BizFlow                                           can be brought online
  Server:***                                            after primary servers
                                                        are online.***
  ------------------------------------------------------------------------------

***\[The information provided in the above table is an example and
should be updated with information specific to the system.\]***

## Recovery Procedures

The following high-level procedures detail the process for recovering
the ***\[Insert System Acronym\]*** following a significant event or
disruption. Procedures are outlined per team. ***\[The number of teams
will be dictated by the size and complexity of the System as well as by
the number of personnel assigned to the System. Also note that the same
person may appear on more than one team.\]*** Each procedure should be
executed in the sequence it is presented to maintain efficient
operations. Specific procedures for recovering key system components are
documented in Appendix H. In the event the system needs to be brought up
at another site, additional resources will likely be needed to bring up
the system at the new location while concurrently recovering the system
at the original location. Refer to Appendix C for contact information of
appropriate recovery personnel.

***\[Sample text is provided below for high-level recovery procedures to
map out the logical steps one should follow. The procedures for each
section 4.2.1-4.2.3 should be tailored to fit the System. Actual
detailed IT recovery procedures can be round in Appendix H .\]***

### Building and Facility Services

\[Note: If the facility that houses the ***\[Insert System Acronym\]***
components has not been damaged or evacuated, proceed to Section 4.2.2
below.\]

If the building that houses the failing ***\[Insert System Acronym\]***
component(s) is damaged or has been evacuated, the Recovery Team will
contact either ***\[Insert Recovery Team Contact POC\]*** (who will
recover the GSS, if necessary) or Building and Facility Services
directly for assistance on obtaining an estimated time that recovery
personnel may safely reenter the building to begin supporting
***\[Insert System Acronym\]*** contingency plan operations. During this
phase of recovery operations, the following activities should occur:

-   The Recovery Team should coordinate with ***\[Insert Recovery Team
    Contact POC\]*** and/or Building and Facility Services to obtain
    information on the physical environment of the computer room that
    houses the system and an estimated time that the building will be
    cleared for reentry by ***\[Insert Organization\]*** personnel.

-   The Recovery Team should notify the ITCP Coordinator of the status
    of the physical environment and provide the estimated time for
    building reentry.

    -   The ITCP Coordinator should adjust all recovery plan activities
        accordingly to reflect any delays in the restoration of power or
        telecommunication services that may have been temporarily
        damaged or disrupted, as appropriate.

-   Based on information provided by the Recovery Team, the ITCP
    Coordinator should provide the ITCP Director with periodic updates
    regarding the reopening of the ***\[Insert Organization\]***
    building and the restoration of facilities services. \[Note: In the
    event the computer room(s) housing the ***\[Insert System
    Acronym\]*** is not going to be available for an extended period of
    time (e.g., one month) the ITCP Coordinator and ITCP Director should
    refer to the Agency's DRP for guidance on recovery of the
    ***\[Insert System Acronym\]*** at an alternate facility, as
    appropriate.\]

### IT Infrastructure

***Personnel will most likely be involved with this section. If the
Network Operations Recovery Team and/or the System Support Recovery Team
does not apply to this system, update the text below to reflect the team
that would be appropriately fit for the system***.

\[Note: If the GSS IT infrastructure that supports the system has not
been damaged or is functioning properly, proceed to Section 4.2.3
below.\]

-   The ITCP Coordinator will contact Recovery Team personnel to monitor
    recovery status, as appropriate.

-   The Network Operations Recovery Team is responsible for recovering
    the IT infrastructure (i.e., LAN/WAN, server hardware, operating
    systems, database infrastructure, etc.).

    -   Recovery Team personnel should refer to their standard operating
        procedures for recovery of all IT components; this includes
        reinstalling hardware and software (i.e., operating system,
        etc.) that serves as the system's platform.

    -   Recovery Team personnel should contact all vendors to provide
        additional support, as needed.

-   The Network Operations Recovery Team is also primarily responsible
    for obtaining and restoring data from ***\[Insert Organization\]***
    backup facilities to assist in the restoration of all components
    (see Appendix J for data backup procedures); the Network Operations
    Recovery Team may also work in conjunction with the System Support
    Recovery Team to ensure seamless recovery.

-   The ITCP Coordinator contacts the ITCP Director to provide periodic
    updates on recovery operations as they are received from the Network
    Operations Recovery Team.

-   The Recovery Team contacts the ITCP Coordinator upon recovery of the
    GSS. If the system software has also failed, proceed to Section
    4.2.3 below to continue recovery operations.

### System Software

***Personnel will likely be involved with this section. If the Network
Operations Recovery Team and/or the System Support Recovery Team does
not apply to this system, update the text below to reflect the team that
would be appropriately fit for the system***.

The following activities should take place during the recovery of the
system:

-   The ITCP Coordinator should coordinate with the System Support
    Recovery Team to monitor the status of overall system recovery
    activities.

-   The System Support Recovery Team conducts all necessary activities
    to restore the system software and data, as appropriate (see
    Appendix H for system recovery procedures); the System Support
    Recovery Team may also work in conjunction with the Network
    Operations Recovery Team to ensure seamless recovery.

-   In certain circumstances, the System Support Recovery Team may need
    the assistance of the System Developers. The ITCP Coordination
    should help facilitate this coordination, as needed.

-   The ITCP Coordinator contacts the ITCP Director to provide periodic
    updates on recovery operations as they are received from the System
    Support Recovery Team.

-   The ITCP Coordinator contacts the ITCP Director upon the recovery of
    the system software, and recovery operations move into the
    resumption phase when the system is operating under normal
    conditions.

# RECONSTITUTION PHASE

This section discusses activities necessary to restore ***\[Insert
System Acronym\]*** operations to its original state. The goal is to
provide a seamless transition from contingency to normal operations.
Resumption and recovery activities may take place concurrently, as it
may be necessary for independent Recovery Teams to work concurrently
during recovery operations.

## Concurrent Processing

Currently, ***\[Insert System Acronym\]*** ***\[does/does not\]*** have
a designated alternate site. ***\[Insert the alternate site location if
applicable and additional information regarding how failover will occur
and concurrent processing.\]***

Concurrent processing is the process of operating an system at both the
original and alternate sites simultaneously for a period of time before
returning all operations to the original site and deactivating the
alternate site operations. In situations like this, new data will have
been generated at the alternate site that will need to be backed up and
restored at the original site before the original site returns to normal
operations. Otherwise, the data from the alternate site would be lost.

Should ***\[Insert System Acronym\]*** require switching system
operations to a backup system at an alternate site, the ITCP Coordinator
would coordinate with the appropriate management. In the event that
switch-over has occurred, all operations will be moved back to the
original system at a pre-determined date and time once it has been
agreed that the original system is fully functional and tested.
Resumption activities would then begin (see Section 5.2 for resumption
activities).

## Resumption Activities

***\[Sample text for Reconstitution Phase Activities is provided below.
These activities should be tailored for the System being addressed.\]***

The following list of resumption activities should be performed:

-   Once the affected ***\[Insert System Acronym\]*** components have
    been recovered, Recovery Team personnel should test all recovered
    components and the system using a logical sequence to ensure
    complete functionality has been restored (see Appendix K for a
    system test plan).

-   Once all testing activities have been completed, the ITCP
    Coordinator notifies the ITCP Director that the system has been
    tested and is functioning properly. The ITCP Director may now make
    the decision to deactivate the plan (see Section 5.3 for
    deactivation procedures).

-   Recovery Teams should return all materials, plans, and equipment
    used during recovery and testing back to storage or their proper
    location.

-   All sensitive materials must be destroyed or properly returned to
    safe storage, as appropriate.

-   Recovery Team personnel temporarily assisting other office locations
    during the disruption should be instructed by their respective team
    leaders to conclude their assistance and report back to their
    primary sites, if applicable.

-   The ITCP Coordinator notifies all user groups regarding the
    resumption of normal business operations ***\[If Applicable: "and to
    end secondary processing procedures"\]***.

    ITCP deactivation then begins (see Section 5.3 for deactivation
    procedures).

## Plan Deactivation

Once ***\[Insert System Acronym\]*** has been tested and is brought back
to normal operations, the ITCP Coordinator will inform the users that
the system is accessible. The ITCP Coordinator should then complete an
AAR, with the assistance of the Recovery Team, as appropriate, to
identify areas for improvement identified during plan activation and
recovery activities (see Appendix L for a sample AAR). This report is
used to document details of the disruption, actions performed during
disruption handling, and recommended steps to avoid recurrence. A copy
of this report will be provided to the ITCP Director. The ITCP Director
will then formally deactivate the plan.

# ITCP APPENDICES {#itcp-appendices .unnumbered}

***\[The following appendices are representative samples and should be
included based on system and plan requirements.\]***

# APPENDIX A. DISTRIBUTION LIST AND KEY PERSONNEL ACCEPTANCE SHEET {#appendix-a.-distribution-list-and-key-personnel-acceptance-sheet .unnumbered}

## A.1 Distribution List {#a.1-distribution-list .unnumbered}

Below is the list of key personnel that should receive a copy of this
plan as well as updates to the plan as they are made available.

  --------------------------------- ---------------- ---------------------------
  **Name, Title**                   **Work Phone     **Email Address**
                                    \#**             

  ***INSERT NAME HERE, INSERT       ***(202)         ***John.Doe@agency.gov***
  TITLE***                          000-0000***      

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}

  []{.mark}                         []{.mark}        []{.mark}
  --------------------------------- ---------------- ---------------------------

## A.2 Key Personnel Acceptance Sheet {#a.2-key-personnel-acceptance-sheet .unnumbered}

Please return a signed copy of this form to the Designated Approving
Authority (DAA) upon completion of a full examination of this report.

I, , have read and fully understand my roles and responsibilities as
noted in the ***\[Insert System Name\]*** ITCP. I understand that I may
be called on to actively perform the recovery and resumption duties
listed in this report in the event of an system disruption, to the best
of my ability.

Signature

Date

# APPENDIX B. ITCP Org Chart {#appendix-b.-itcp-org-chart .unnumbered}

***\[Update diagram according to ITCP organization for this system.\]***

![](media/image1.wmf){width="5.997916666666667in"
height="4.638888888888889in"}

# APPENDIX C. EMERGENCY CONTACT INFORMATION {#appendix-c.-emergency-contact-information .unnumbered}

***\[The rule of thumb is to have at least 3 pieces of contact info for
each individual -- if possible***.\]

## C.1 Key Personnel {#c.1-key-personnel .unnumbered}

  -------------------------------------------------------------------------------
  *\[Insert System Acronym\]* ITCP POCs                   
  --------------------------------------- --------------- -----------------------
  **Key Personnel**                       **Contact       
                                          Information**   

  ITCP Director                           Work            

  ***INSERT NAME HERE, INSERT TITLE***    Home            

  ***INSERT STREET/BUILDING ADDRESS***    Pager           

  ***INSERT ROOM NUMBER***                Cellular        

  ***INSERT CITY, STATE, AND ZIP CODE***  E-mail          

  ITCP Director -- Alternate              Work            

                                          Home            

                                          Pager           

                                          Cellular        

                                          E-mail          

  ITCP Coordinator                        Work            

                                          Home            

                                          Pager           

                                          Cellular        

                                          E-mail          

  ITCP Coordinator -- Alternate           Work            

                                          Home            

                                          Pager           

                                          Cellular        

                                          E-mail          

  Recovery Team -- System Support         Work            

                                          Home            

                                          Pager           

                                          Cellular        

                                          E-mail          

  Recovery Team -- GSS Support POC        Work            

                                          Home            

                                          Pager           

                                          Cellular        

                                          E-mail          

  Recovery Team -- Tape Storage POC       Work            

                                          Home            

                                          Pager           

                                          Cellular        

                                          E-mail          
  -------------------------------------------------------------------------------

## C.2 Vendor Contact Information {#c.2-vendor-contact-information .unnumbered}

***\[A separate table should be inserted for each vendor.\]***

+--------------------+--------------+---+---------+---------+---+------+
| **VENDOR           |              |   |         |         |   |      |
| INFORMATION**      |              |   |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Vendor Number**  |              |   |         | *       |   |      |
|                    |              |   |         | *Vendor |   |      |
|                    |              |   |         | Type**  |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Vendor Name**    |              |   |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Address**        |              |   |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **City-State-Zip** |              |   |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Vendor Phone     |              | * |         |         |   |      |
| No.**              |              | * |         |         |   |      |
|                    |              | E |         |         |   |      |
|                    |              | m |         |         |   |      |
|                    |              | e |         |         |   |      |
|                    |              | r |         |         |   |      |
|                    |              | g |         |         |   |      |
|                    |              | e |         |         |   |      |
|                    |              | n |         |         |   |      |
|                    |              | c |         |         |   |      |
|                    |              | y |         |         |   |      |
|                    |              | P |         |         |   |      |
|                    |              | h |         |         |   |      |
|                    |              | o |         |         |   |      |
|                    |              | n |         |         |   |      |
|                    |              | e |         |         |   |      |
|                    |              | N |         |         |   |      |
|                    |              | o |         |         |   |      |
|                    |              | . |         |         |   |      |
|                    |              | * |         |         |   |      |
|                    |              | * |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Primary Contact  |              | * |         |         |   |      |
| Name**             |              | * |         |         |   |      |
|                    |              | S |         |         |   |      |
|                    |              | e |         |         |   |      |
|                    |              | c |         |         |   |      |
|                    |              | o |         |         |   |      |
|                    |              | n |         |         |   |      |
|                    |              | d |         |         |   |      |
|                    |              | a |         |         |   |      |
|                    |              | r |         |         |   |      |
|                    |              | y |         |         |   |      |
|                    |              | C |         |         |   |      |
|                    |              | o |         |         |   |      |
|                    |              | n |         |         |   |      |
|                    |              | t |         |         |   |      |
|                    |              | a |         |         |   |      |
|                    |              | c |         |         |   |      |
|                    |              | t |         |         |   |      |
|                    |              | N |         |         |   |      |
|                    |              | a |         |         |   |      |
|                    |              | m |         |         |   |      |
|                    |              | e |         |         |   |      |
|                    |              | * |         |         |   |      |
|                    |              | * |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Special          |              |   |         |         |   |      |
| Instructions**     |              |   |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Product**        |              |   |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Model/Serial     |              |   |         |         |   |      |
| No.**              |              |   |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Contract No.**   |              |   |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Vendor Type      | **H          |   |         |         |   |      |
| Codes**            | Hardware**   |   |         |         |   |      |
|                    |              |   |         |         |   |      |
|                    | **S          |   |         |         |   |      |
|                    | Software**   |   |         |         |   |      |
|                    |              |   |         |         |   |      |
|                    | **O Office   |   |         |         |   |      |
|                    | Supplies**   |   |         |         |   |      |
|                    |              |   |         |         |   |      |
|                    | **F Forms**  |   |         |         |   |      |
|                    |              |   |         |         |   |      |
|                    | **M          |   |         |         |   |      |
|                    | M            |   |         |         |   |      |
|                    | aintenance** |   |         |         |   |      |
|                    |              |   |         |         |   |      |
|                    | **T          |   |         |         |   |      |
|                    | Telecomm     |   |         |         |   |      |
|                    | unications** |   |         |         |   |      |
|                    |              |   |         |         |   |      |
|                    | **A          |   |         |         |   |      |
|                    | Ad           |   |         |         |   |      |
|                    | ministrative |   |         |         |   |      |
|                    | Supplies**   |   |         |         |   |      |
|                    |              |   |         |         |   |      |
|                    | **R Recovery |   |         |         |   |      |
|                    | Services**   |   |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+
| **Last Updated**   |              |   |         |         |   |      |
+--------------------+--------------+---+---------+---------+---+------+

# APPENDIX D. APPLICATION OUTAGE ASSESSMENT REPORT {#appendix-d.-application-outage-assessment-report .unnumbered}

The following report is to be used by the Recovery Team(s) to assist
during the outage assessment of the system failure.

  ----------------------------------- ---------------- -----------------------------------
  **APPLICATION OUTAGE ASSESSMENT                      
  REPORT**                                             

  Recovery Team:                                       

  **Event Information**                                

  Date:                               Time of          
                                      Disruption:      

  Location:                           Type of Event:   

  Impact to System:                   Facility Damage: 

  Personnel Injuries:                 Disruption       
                                      Classification   
                                      ('Minor' or      
                                      'Major')         

                                                       

  **System Information**                               

  POC:                                Estimated Length 
                                      of Disruption:   

  Impact on Components:                                

                                                       

  Component Resources Affected:                        

                                                       

  Type of Damage to Resource:                          

                                                       

  Estimated Equipment Needs:                           

                                                       

  **Recovery Information:**                            

  Suggested Recovery Strategy:                         

                                                       

  Activation of Contingency Plan                       
  Recommended (Y) (N)                                  

                                                       

                                                       

  ITCP Coordinator Signature                           Date/Time

                                                       

  ITCP Director Signature                              Date/Time
  ----------------------------------- ---------------- -----------------------------------

# APPENDIX E. ACTION ITEM CHECKLIST {#appendix-e.-action-item-checklist .unnumbered}

+-------------------------------------------------+-------+-----------+
| **Task**                                        | **C   | **        |
|                                                 | omple | Completed |
|                                                 | ted** | By**      |
+-------------------------------------------------+-------+-----------+
| APPLICATION DISRUPTION---INITIAL NOTIFICATION   | ()   |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator contacts the Recovery to   |       |           |
| monitor the status of overall outage assessment |       |           |
| activities                                      |       |           |
+-------------------------------------------------+-------+-----------+
| a.  Designate a work area for the Recovery Team |       |           |
|     members to collaborate and convene.         |       |           |
+-------------------------------------------------+-------+-----------+
| b.  Ensure that the appropriate contact         |       |           |
|     information is readily available for the    |       |           |
|     ITCP Coordinator and Alternate ITCP         |       |           |
|     Coordinator (refer to Appendix C).          |       |           |
+-------------------------------------------------+-------+-----------+
| c.  Copy and distribute the system outage       |       |           |
|     assessment report form to the appropriate   |       |           |
|     Recovery Team members (refer to Appendix    |       |           |
|     C).                                         |       |           |
+-------------------------------------------------+-------+-----------+
| d.  If applicable, coordinate with the Building |       |           |
|     and Facility Services contact to request    |       |           |
|     that the computer room's power not be       |       |           |
|     restored until an system outage assessment  |       |           |
|     has been completed and determines that it   |       |           |
|     is safe.                                    |       |           |
+-------------------------------------------------+-------+-----------+
| e.  Building access permitting, conduct a       |       |           |
|     visual inspection of the server area.       |       |           |
|     Visually inspect all *\[Insert System       |       |           |
|     Acronym\]* equipment for external and       |       |           |
|     internal damage. DO NOT POWER UP ANY        |       |           |
|     EQUIPMENT PRIOR TO PASSING THIS INSPECTION  |       |           |
+-------------------------------------------------+-------+-----------+
| f.  Determine whether or not the vendor should  |       |           |
|     be contacted to service any affected        |       |           |
|     equipment.                                  |       |           |
+-------------------------------------------------+-------+-----------+
| g.  Note the position of the equipment power    |       |           |
|     switch during inspection. If visual         |       |           |
|     inspection determines that the switch is in |       |           |
|     the "on" position, switch it to the "off"   |       |           |
|     position.                                   |       |           |
+-------------------------------------------------+-------+-----------+
| h.  Ensure that any hardware that is determined |       |           |
|     to be unsafe to operate is appropriately    |       |           |
|     labeled. If determined to be safe, unplug   |       |           |
|     equipment from the power source.            |       |           |
+-------------------------------------------------+-------+-----------+
| i.  When equipment is ready for power up        |       |           |
|     testing, advise the Building and Facility   |       |           |
|     Services contact. Stand-by until advised    |       |           |
|     that power has been restored.               |       |           |
+-------------------------------------------------+-------+-----------+
| j.  Working in concert with the appropriate     |       |           |
|     Recovery Support Team members, power up     |       |           |
|     one-piece-at-a-time each of the *\[Insert   |       |           |
|     System Acronym\]* components.               |       |           |
+-------------------------------------------------+-------+-----------+
| k.  Annotate the condition of each component on |       |           |
|     the system outage assessment report form    |       |           |
|     (see system outage assessment procedures    |       |           |
|     below).                                     |       |           |
+-------------------------------------------------+-------+-----------+
| l.  Determine the status of the data stored     |       |           |
|     within *\[Insert System Acronym\]* and      |       |           |
|     whether data backups need to be retrieved   |       |           |
|     from offsite storage.                       |       |           |
+-------------------------------------------------+-------+-----------+
| m.  Work with the appropriate Recovery and      |       |           |
|     Recovery Support Team members to determine  |       |           |
|     the estimated time to repair/replace or     |       |           |
|     reconstruct major elements of the system.   |       |           |
+-------------------------------------------------+-------+-----------+
| n.  Based on outage assessment findings, be     |       |           |
|     prepared to recommend either partial or     |       |           |
|     full activation of the ITCP.                |       |           |
+-------------------------------------------------+-------+-----------+
| o.  Provide a completed system outage           |       |           |
|     assessment report to the ITCP Coordinator   |       |           |
|     and brief the ITCP Coordinator on the       |       |           |
|     overall outage assessment findings.         |       |           |
+-------------------------------------------------+-------+-----------+
| APPLICATION OUTAGE ASSESSMENT PROCEDURES        | ()   |           |
+-------------------------------------------------+-------+-----------+
| Complete an system outage assessment report     |       |           |
| (see Appendix D).                               |       |           |
+-------------------------------------------------+-------+-----------+
| a.  Check the cause of the system disruption,   |       |           |
|     including type, scope, location, and time   |       |           |
|     of disruption.                              |       |           |
+-------------------------------------------------+-------+-----------+
| b.  Check whether the outage is localized (this |       |           |
|     system only) or widespread.                 |       |           |
+-------------------------------------------------+-------+-----------+
| c.  Check the location of failing components    |       |           |
|     and those users without service.            |       |           |
+-------------------------------------------------+-------+-----------+
| d.  Check the impact of the disruption or       |       |           |
|     components damaged.                         |       |           |
+-------------------------------------------------+-------+-----------+
| e.  Check the functional status of all system   |       |           |
|     components (e.g., fully functional,         |       |           |
|     partially functional, nonfunctional).       |       |           |
+-------------------------------------------------+-------+-----------+
| f.  Check the potential for additional          |       |           |
|     disruption or system damage.                |       |           |
+-------------------------------------------------+-------+-----------+
| g.  Check the Identification of a single point  |       |           |
|     of failure (if possible).                   |       |           |
+-------------------------------------------------+-------+-----------+
| h.  Check Items to be replaced (e.g., hardware, |       |           |
|     software, firmware, supporting materials).  |       |           |
+-------------------------------------------------+-------+-----------+
| i.  Check anticipated downtime of the system    |       |           |
|     (e.g., longer than two days).               |       |           |
+-------------------------------------------------+-------+-----------+
| j.  Classify disruption as 'minor system        |       |           |
|     failure' or 'major system failure'.         |       |           |
+-------------------------------------------------+-------+-----------+
| > **MINOR APPLICATION FAILURE**                 | Comp  |           |
|                                                 | leted |           |
+-------------------------------------------------+-------+-----------+
| > **Recovery and Resumption Procedures**        | ()   |           |
+-------------------------------------------------+-------+-----------+
| The Recovery and Recovery Support Teams contact |       |           |
| the ITCP Coordinator to provide an estimated    |       |           |
| recovery time and begin repair of the           |       |           |
| components (i.e., the databases, servers,       |       |           |
| infrastructure or the system software).         |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator notifies all system users  |       |           |
| that the 'minor system failure' is being        |       |           |
| recovered and will be functioning under normal  |       |           |
| conditions within the estimated recovery        |       |           |
| period. An alert will be sent on the status of  |       |           |
| the system and expected recovery time.          |       |           |
+-------------------------------------------------+-------+-----------+
| The minor system failure is recovered and       |       |           |
| situation is closed.                            |       |           |
+-------------------------------------------------+-------+-----------+
| > **MAJOR APPLICATION FAILURE**                 | Comp  |           |
|                                                 | leted |           |
+-------------------------------------------------+-------+-----------+
| > **Notification/Activation Procedures**        | ()   |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator reviews the system outage  |       |           |
| assessment report and contacts the ITCP         |       |           |
| Director to formally activate the contingency   |       |           |
| plan.                                           |       |           |
+-------------------------------------------------+-------+-----------+
| Are secondary processing procedures required?   |       |           |
| If yes, refer to Appendix I*.*                  |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator notifies all system users  |       |           |
| that the 'major system failure' is being        |       |           |
| recovered and will be functioning under normal  |       |           |
| conditions within the estimated recovery        |       |           |
| period. An alert will be sent on the status of  |       |           |
| the system and expected recovery time.          |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator contacts the Recovery Team |       |           |
| to begin monitoring the status of overall       |       |           |
| recovery and resumption activities.             |       |           |
+-------------------------------------------------+-------+-----------+
| > **Recovery Procedures -- Building and         | ()   |           |
| > Facility Services**                           |       |           |
+-------------------------------------------------+-------+-----------+
| The Recovery Team coordinates with the          |       |           |
| ***\[Insert Recovery Team Contact POC\]***      |       |           |
| and/or Building and Facility Services to obtain |       |           |
| an estimated time that the building will been   |       |           |
| cleared for reentry.                            |       |           |
+-------------------------------------------------+-------+-----------+
| The Recovery Team provides updates to the ITCP  |       |           |
| Coordinator on the status of the building's     |       |           |
| reopening.                                      |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator provides the ITCP Director |       |           |
| with periodic updates regarding the reopening   |       |           |
| of the building and the restoration of          |       |           |
| facilities services.                            |       |           |
+-------------------------------------------------+-------+-----------+
| > **Recovery Procedures -- IT Infrastructure**  | ()   |           |
+-------------------------------------------------+-------+-----------+
| The Network Operations Recovery Team contacts   |       |           |
| all necessary vendors to provide additional     |       |           |
| support as needed.                              |       |           |
+-------------------------------------------------+-------+-----------+
| The Network Operations Recovery Team also       |       |           |
| obtains and restores data from backup           |       |           |
| facilities to assist in the restoration of all  |       |           |
| components.                                     |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator contacts the ITCP Director |       |           |
| to provide periodic updates on recovery         |       |           |
| operations as they are received from the        |       |           |
| Network Operations Recovery Team.               |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator contacts the ITCP Director |       |           |
| upon the recovery of the IT infrastructure, and |       |           |
| recovery operations move into the resumption    |       |           |
| phase if the system is operating under normal   |       |           |
| conditions.                                     |       |           |
+-------------------------------------------------+-------+-----------+
| > **Recovery Procedures -- System Software**    | ()   |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator contacts the Systems       |       |           |
| Support Recovery Team to begin monitoring the   |       |           |
| status of overall recovery and resumption       |       |           |
| activities.                                     |       |           |
+-------------------------------------------------+-------+-----------+
| The System Support Recovery Team conducts all   |       |           |
| necessary activities to restore the system      |       |           |
| software and data.                              |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator contacts the ITCP Director |       |           |
| to provide periodic updates on recovery         |       |           |
| operations as they are received from the System |       |           |
| Support Recovery Team.                          |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator contacts the ITCP Director |       |           |
| upon the recovery of the system software, and   |       |           |
| contingency operations move into the resumption |       |           |
| phase if the system is operating under normal   |       |           |
| conditions.                                     |       |           |
+-------------------------------------------------+-------+-----------+
| > **RESUMPTION PROCEDURES**                     | ()   |           |
+-------------------------------------------------+-------+-----------+
| Recovery Team personnel test all recovered      |       |           |
| components and system software.                 |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator notifies the ITCP Director |       |           |
| that the system has been tested and is          |       |           |
| functioning properly.                           |       |           |
+-------------------------------------------------+-------+-----------+
| Recovery Team returns all materials, plans, and |       |           |
| equipment used during recovery and testing back |       |           |
| to storage.                                     |       |           |
+-------------------------------------------------+-------+-----------+
| All sensitive material is destroyed or properly |       |           |
| returned to safe storage.                       |       |           |
+-------------------------------------------------+-------+-----------+
| Recovery Team personnel assisting other         |       |           |
| offices, conclude their activities and report   |       |           |
| back to their primary sites.                    |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator notifies the user groups   |       |           |
| regarding the resumption of normal business     |       |           |
| operations.                                     |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Coordinator develops an AAR and files  |       |           |
| it with the ITCP Director.                      |       |           |
+-------------------------------------------------+-------+-----------+
| The ITCP Director officially deactivates the    |       |           |
| plan.                                           |       |           |
+-------------------------------------------------+-------+-----------+

# APPENDIX F. SYSTEM DIAGRAM {#appendix-f.-system-diagram .unnumbered}

***\[INSERT SYSTEM ARCHITECTURE DIAGRAM\]***

# APPENDIX G. APPLICATION INVENTORY {#appendix-g.-application-inventory .unnumbered}

## G.1 System Inventory {#g.1-system-inventory .unnumbered}

+--------+------------+-----------+---------+------+----------+------+
| Ha     |            |           |         |      |          |      |
| rdware |            |           |         |      |          |      |
| Fields |            |           |         |      |          |      |
+--------+------------+-----------+---------+------+----------+------+
| **Pr   | **Make and | **Host    | **P     | **IP | **Descr  | *    |
| operty | Model**    | Name**    | hysical | Add  | iption** | *GSS |
| No.**  |            |           | Loc     | ress |          | Infr |
|        |            |           | ation** | \*** |          | astr |
|        |            |           |         |      |          | uctu |
|        |            |           |         |      |          | re** |
+--------+------------+-----------+---------+------+----------+------+
| >      |            |           |         |      |          |      |
+--------+------------+-----------+---------+------+----------+------+
| >      |            |           |         |      |          |      |
+--------+------------+-----------+---------+------+----------+------+
|        |            |           |         |      |          |      |
+--------+------------+-----------+---------+------+----------+------+

\*This information was omitted due to security concerns.

  ------------ ------------------- ------------- ------------- ----------- ----------- ---------- ------------
  Misc                                                         Operating                          
  Questions                                                    System                             

  **Property   **Who has           **Who owns    **Who         **Product   **Version   **Vendor   **Domain**
  No.**        Management          the           Administers   Name**      Number**    Name**     
               Responsibility?**   Hardware?**   Hardware?**                                      

                                                                                                   

                                                                                                   

                                                                                                   
  ------------ ------------------- ------------- ------------- ----------- ----------- ---------- ------------

## G.2 Software Inventory {#g.2-software-inventory .unnumbered}

+-------+------+------+---------+------+---------+---------+---------+
| Sof   |      |      |         |      |         |         |         |
| tware |      |      |         |      |         |         |         |
| F     |      |      |         |      |         |         |         |
| ields |      |      |         |      |         |         |         |
+-------+------+------+---------+------+---------+---------+---------+
| **V   | *    | **V  | **      | **   | *       | **V     | **V     |
| endor | *Pro | ersi | Product | Cont | *Vendor | endor** | endor** |
| N     | duct | on** | Support | ract | Phone   |         |         |
| ame** | Na   |      | (y/n)** | Numb | N       | **Ad    | **City, |
|       | me** |      |         | er** | umber** | dress** | State   |
|       |      |      |         |      |         |         | Zip**   |
+-------+------+------+---------+------+---------+---------+---------+
|       |      |      |         | See  |         |         |         |
|       |      |      |         | Appe |         |         |         |
|       |      |      |         | ndix |         |         |         |
|       |      |      |         | C.2  |         |         |         |
+-------+------+------+---------+------+---------+---------+---------+
|       |      |      |         | See  |         |         |         |
|       |      |      |         | Appe |         |         |         |
|       |      |      |         | ndix |         |         |         |
|       |      |      |         | C.2  |         |         |         |
+-------+------+------+---------+------+---------+---------+---------+
|       |      |      |         | See  |         |         |         |
|       |      |      |         | Appe |         |         |         |
|       |      |      |         | ndix |         |         |         |
|       |      |      |         | C.2  |         |         |         |
+-------+------+------+---------+------+---------+---------+---------+

# APPENDIX H. APPLICATION RECOVERY PROCEDURES {#appendix-h.-application-recovery-procedures .unnumbered}

  -------------------- --------------------------------------------------
  **System Resource**  **Location of Recovery Procedures**

  [Authentication      []{.mark}
  Server]{.mark}       

  [Database            []{.mark}
  Server]{.mark}       

  [System              []{.mark}
  files]{.mark}        
  -------------------- --------------------------------------------------

***\[\*These resources should match those found in N.2.4\]***

***The information here will provide detailed instructions for
recovering from an system failure. Also included would be full
re-install instructions.***

# APPENDIX I. SECONDARY PROCESSING PROCEDURES {#appendix-i.-secondary-processing-procedures .unnumbered}

***Secondary processing procedures are any procedures that can be
implemented (either manually or electronically) in lieu of the system to
maintain business operations during the outage. Not all systems have
secondary procedures available.***

***If secondary procedures do exist, describe them here in a
step-by-step bulleted format. At a minimum, describe: 1) what the
procedures entail, 2) who does what, 3) contact information or
references to where any hard-copy documents may be obtained and where
they should go (who they are filed with and how, if applicable)***.

***If procedures are not available, include the statement that
"Secondary processing is not available for this system" and delete
references to secondary processing procedures throughout the ITCP (do a
global search).***

# APPENDIX J. DATA BACKUP INFORMATION[^2] {#appendix-j.-data-backup-information .unnumbered}

\*See Appendix C for the ***\[Insert Organization\]*** Tape Storage
POC(s) and their contact information.

The following information supports the system's data backup procedures,
schedule, and details:

  ---------------------------- ------------------------------------------
  **Data Backup Details**      

  Responsible                  ***\[Insert Group/Entity/Individual Name,
  group/entity/individual      as appropriate\]***

  Backup type and frequency    ***Daily Incremental/Weekly Full***

  Time of backup               ***After hours/During business
                               hours/0700***

  Stored off-site?             ***Yes/No***

  Rotation period for off-site ***2 Weeks/4 Weeks***
  storage                      

  Stored onsite?               ***\[Insert Location\]***

  Use of used backup tapes     ***Reused/Destroyed/Archived***

  Additional details           
  ---------------------------- ------------------------------------------

***\[Insert any additional procedures or details regarding data
backups.\]***

# APPENDIX K. APPLICATION TEST PROCEDURES {#appendix-k.-application-test-procedures .unnumbered}

System test procedures address activities that take place once the
system has been recovered and is tested prior to being restored to
normal operations.

***Note to the author: If a test plan is not available, you are
responsible for developing one. Consider the following guidelines when
developing testing procedures:***

-   ***Create a step-by-step list of testing and coordination activities
    in accordance with each system component***

-   ***Think about what should occur first, second, third, etc. in a
    logical sequence for any given server***

-   ***Think about what should occur first, second, third, etc. in a
    logical sequence for any given database and its data (as
    appropriate)***

-   ***Organize the sequence of component testing (and supporting
    activities) in accordance with the sequence of recovery outlined in
    Section 4.1***

-   ***What coordination should occur and when? (i.e., Recovery Team
    coordinates with the users, Developers, ITCP Coordinator; ITCP
    Coordinator coordinates with the ITCP Director, etc.)***

-   ***Ensure that the procedures you include are specific to system
    TESTING and NOT recovery (that should be covered in Appendix H)***

-   ***Ensure that the procedures you include are specific to system
    TESTING and NOT tabletop exercises (that should be covered in
    Appendix P)***

# APPENDIX L. AFTER ACTION REPORT {#appendix-l.-after-action-report .unnumbered}

  --------------------------- -------------------------------------------
  Type of Event               ***Tabletop Exercise/Functional
                              Exercise/Live Recovery***

  Name of System              ***\[Insert System Name and Acronym\]***

  Date of Test/Live Recovery  ***\[Date of Exercise/Recovery\]***

  Testing/Live Recovery Point ***\[Insert the Name and Title of ITCP
  of Contact                  Director\]***

  Purpose, Type of Test, and  
  Scope or Disruption         
  Description (describe the   
  events that led to          
  contingency plan            
  implementation):            

                              

  Activities and Results      
  (action, expected results,  
  actual results):            

                              

  Actual Duration of System   
  Outage:                     

                              

  Lessons Learned/Action Item 
  Assessment:                 

                              
  --------------------------- -------------------------------------------

  -----------------------------------------------------------------------
  Prepared By:

  -----------------------------------------------------------------------

# APPENDIX M. SERVICE LEVEL AGREEMENTS (SLA) {#appendix-m.-service-level-agreements-sla .unnumbered}

***If applicable, attach related SLAs here. If no SLAs are in place,
include a statement in this appendix that states this and delete
references to SLAs throughout the ITCP***.

# APPENDIX N. BUSINESS IMPACT ANALYSIS {#appendix-n.-business-impact-analysis .unnumbered}

## N.1 Administration {#n.1-administration .unnumbered}

### N.1.1 Background {#n.1.1-background .unnumbered}

The business impact analysis (BIA) is used to identify and prioritize
the components of an system by correlating them to the business
processes the system supports, and by using this information to
characterize the impact on the processes if the system were unavailable.

The BIA is comprised of the following activities:

-   Identify system components

-   Identify system outage impacts

-   Identify recovery priorities.

When developing the BIA for an ITCP, there are two goals to consider: 1)
recovery time objective (RTO) and 2) recovery point objective (RPO). The
RTO defines the maximum amount of time that the system can remain
unavailable before there is an unacceptable impact on associated
business processes. The RPO defines the point in time to which business
process data must be recovered after an system outage.

This document is used to build the ***\[Insert System Acronym\]*** ITCP,
and is included as a key component of the ITCP. It also may be used to
support the development of other contingency plans associated with the
system, including, but not limited to, the BRP.

### N.1.2 Authorities/Requirements {#n.1.2-authoritiesrequirements .unnumbered}

This BIA adheres to the policies and structures defined in Federal
Government and ***\[Insert Organization\]*** policy and guidance
documents, including organizational policy and NIST SP 800-34,
*Contingency Planning Guide for Information Technology Systems*.

### N.1.3 Assumptions {#n.1.3-assumptions .unnumbered}

The BIA is based on the following assumptions:

-   The BIA will be reviewed, approved, and endorsed by management

-   Off-site storage facilities and materials will survive an IT system
    disruption

-   The inventory of hardware and software comprising the system is
    current

-   The system supports one or more Business Unit sub-processes and may
    support one or more ***\[Insert Organization\]*** critical business
    processes (CBP) and/or administrative/infrastructure (A/I)
    processes.

## N.2 Business Impact Analysis {#n.2-business-impact-analysis .unnumbered}

This BIA is developed as part of the contingency and disaster recovery
planning process for the ***\[Insert System Acronym\]***. It was
prepared on ***\[Insert BIA Date\]***.

### N.2.1 System Purpose {#n.2.1-system-purpose .unnumbered}

***\[Insert information from Section 2 to address system purpose.\]***

***\[Insert System Acronym\]*** ***operates at two sites located in AAA
and BBB***.

### N.2.2 System Stakeholders {#n.2.2-system-stakeholders .unnumbered}

The following table identifies the individuals, positions, and/or
offices, both internal and external to the ***\[Insert
Organization\]***, that use or support ***\[Insert System Acronym\]***.

  ----------------------------------------------------------------------------------
  Stakeholder                                     Role
  -------------- -------------------------------- ----------------------------------
  Internal                                        
  Stakeholders                                    

  *1*            *Name , Title, and Business      System Owner
                 Unit*                            

  *2*            *Name , Title, and Business      Core Team Lead
                 Unit*                            

  *3*            *Name , Title, and Business      Specialized users
                 Unit*                            

  *4*            *Name , Title, and Business      General users
                 Unit*                            

  External                                        
  Stakeholders                                    

  *1*            *System Integrators, Inc.*       Technical Integration

  *2*            *AAA Internet*                   Internet connectivity

  *3*            *Training Experts, Inc.*         Training material development
  ----------------------------------------------------------------------------------

***Update this table as appropriate. If there are no external
stakeholders, insert the statement "There are no external stakeholders"
to the appropriate section of the table***.

### N.2.3 Critical Business Processes and Business Unit Sub-Processes {#n.2.3-critical-business-processes-and-business-unit-sub-processes .unnumbered}

The following table identifies the ***\[Insert Organization\]*** CBP and
A/I that ***\[Insert System Acronym\]*** supports, as applicable, as
well as the associated Business Unit sub-processes. A list of
***\[Insert Organization\]*** CBPs and A/I processes is provided in
Section N.3, ***\[Insert Organization\]*** Critical Processes.

Critical Business Processes and Sub-Processes

  ---------------------------------------------------------------------------------
  **Business   **CBP or A/I **Sub-Process**
  Unit**       ID**         
  ------------ ------------ -------------------------------------------------------
  ***BU A***   ***CBP1***   ***Sub-Process 1***

  ***BU B***   ***CBP2***   ***Sub-Process 2***
  ---------------------------------------------------------------------------------

### N.2.4 System Resources and Business Unit Sub-Processes {#n.2.4-system-resources-and-business-unit-sub-processes .unnumbered}

The following table identifies the system resources that comprise
\[Insert System Name\], including hardware, software, and other
resources. [^3]

**System** Resources and Sub-Processes

  -------------------- --------------------------------------------------
  **System Resource**  **Responsible Individual/Entity**

  ***Authentication    ***Bob Jones, System Administrator***
  Server***            

  ***Database          ***John Doe, Windows Administrator***
  Server***            

  ***System files***   ***Jane Doe, Developer***
  -------------------- --------------------------------------------------

### N.2.5 Outage Impact on Business Unit Sub-Processes {#n.2.5-outage-impact-on-business-unit-sub-processes .unnumbered}

The table below depicts the impact on each Business Unit sub-process if
***\[Insert System Acronym\]*** were unavailable, based on the following
criteria:

-   Operational Impact: Number of users that would be impacted

    -   3 = \>1,000 users

    -   2 = 100-999 users

    -   1 = 1-99 users

    -   0 = None

-   Customer Service Impact: Number of customer sites that would be
    impacted

    -   3 = \>1,000 customers

    -   2 = 100-999 customers

    -   1 = 1-99 customers

    -   0 = None

-   Reputation Impact: Degree of scrutiny the Business Unit would come
    under

    -   3 = External (Congress, media, other)

    -   2 = Internal

    -   1 = Internal to Business Unit

    -   0 = None

-   Loss of Irreplaceable Data: Nature of data that would be lost or
    unavailable

    -   3 = Data needed for purposes external to ***\[Insert
        Organization\]***

    -   2 = Data needed for purposes internal to ***\[Insert
        Organization\]***

    -   1 = Data needed for purposes internal to Business Unit

    -   0 = None or not applicable

Outage Impact on Business Unit Sub-Processes

  ---------------------------------------------------------------------------------------------------------
  **Business   **CBP or    **Sub-Process**        **Impact**                                     
  Unit**       A/I ID**                                                                          
  ------------ ----------- ---------------------- ---------------- ------------ ---------------- ----------
                                                  **Operations**   **Customer   **Reputation**   **Data**
                                                                   Service**                     

  []{.mark}    []{.mark}   []{.mark}                                                             

  []{.mark}    []{.mark}   []{.mark}                                                             
  ---------------------------------------------------------------------------------------------------------

***\[Insert clarifying information here regarding the impacts identified
in the above table, as appropriate.\]***

***\[Insert description here of previous system disruptions, including
impacts. If the system has not suffered a previous disruption, state
so.\]***

### N.2.6 Sub-Process Recovery Time Objectives and Recovery Point Objectives {#n.2.6-sub-process-recovery-time-objectives-and-recovery-point-objectives .unnumbered}

The table below identifies the RTO and RPO (as applicable) for the
Business Unit sub-processes that rely on ***\[Insert System
Acronym\]***.[^4] RTOs and RPOs are expected to be specific timeframes
(i.e. 8hrs, 36hrs, 5 days, etc.), but are organized as follows:

-   "At time of disaster" (ATOD)

-   Less than 12 hours

-   12 hours to 36 hours

-   36 hours to 5 days

-   Greater than 5 days.

Business Unit Sub-Process RTO and RPO

  ----------------------------------------------------------------------------------
  **Business   **CBP or    **Sub-Process**             **RTO**        **RPO**
  Unit**       A/I ID**                                               
  ------------ ----------- --------------------------- -------------- --------------
  []{.mark}    []{.mark}   []{.mark}                   []{.mark}      []{.mark}

  []{.mark}    []{.mark}   []{.mark}                   []{.mark}      []{.mark}
  ----------------------------------------------------------------------------------

***\[Insert description here of the drivers for the RTOs and RPOs listed
in the table above (e.g., mandate, workload, performance measure,
etc.).***

***Insert description here of the alternate means for recovering the
Business Unit sub-process(es) that rely on the system. If none exist, so
state.***

***Insert description here of any scheduled changes to the system,
including the projected impact on the Business Unit sub-process(es). If
no changes are scheduled, so state.\]***

### N.2.7 Recovery Priorities for System Resources {#n.2.7-recovery-priorities-for-system-resources .unnumbered}

The table below lists the system resources in the order they would be
recovered in the event that ***\[Insert System Acronym\]*** was
unavailable. The table also identifies the expected time for recovering
the system following a "worst case" disruption.

  -------------------------------------------------------------------------
  **Priority**   **System Resource**                   **Expected Recovery
                                                       Time**
  -------------- ------------------------------------- --------------------
  ***1***        ***Authentication Server***           ***24 hours***

  ***2***        ***Database Server***                 ***24 hours***

  ***3***        ***System files***                    ***24 hours***
  -------------------------------------------------------------------------

## N.3 *\[Insert Organization*\] Critical Business Processes {#n.3-insert-organization-critical-business-processes .unnumbered}

The organization-wide business continuity planning effort identifies the
organization's most critical business processes and
administrative/infrastructure processes, based on data provided by each
Business and Functional Operating Division (BOD/FOD). The tables below
list the CBPs and A/I processes.

Critical Business Processes

  ------ ----------------------------------------------------------------
         

  ------ ----------------------------------------------------------------

# APPENDIX O. RELATED CONTINGENCY PLANS  {#appendix-o.-related-contingency-plans .unnumbered}

The ***\[Insert System Acronym\]*** system resides on the ***\[Insert
Appropriate GSS\]*** GSS infrastructure and relies on the \[***Insert
Appropriate GSS\]*** GSS ITCP, dated ***\[Insert Date of Document\]***
for infrastructure recovery activities. The system physically resides at
the ***\[Insert Facility or Campus Name\]*** and therefore relies on the
***\[Site Name\]*** DRP, dated ***\[Insert Document Date\]*** for
disaster recovery activities. The following plans also support
***\[Insert System Acronym\]*** recovery activities:

-   ***\[List any additional document titles that support this system --
    titles should be italicized.\]***, dated ***\[Insert Date of
    Document\]***

***\[Complete a list of any other related plans and/or related
information for other systems that will be needed to carry out this plan
(i.e., plans that this system is dependent upon)\]. This should
correspond with plans listed in Section 1.2 and will likely include, at
a minimum, the GSS ITCP that the system resides on and the site DRP.
When referencing the documents, be sure to use complete references with
titles, version number, and date, when available.\]***

# APPENDIX P. TEST, TRAINING, AND EXERCISE (TT&E) {#appendix-p.-test-training-and-exercise-tte .unnumbered}

To ensure an effective and viable contingency plan, annual training,
testing, and exercising of the ***\[Insert System Acronym\]*** ITCP
should be conducted. This process will range from familiarizing staff
with the plan to exercising parts of the plan (e.g.,
notification/activation phase) to full-scale tests of the entire
***\[Insert System Acronym\]*** notification/activation, recovery, and
reconstitution process. This section defines procedures and standards
for developing a test, training, and exercise (TT&E) program. The
section also discusses methods for maintaining, updating, and
distributing the ITCP to all responsible personnel to ensure an active
state of readiness.

## P.1 TT&E Program Overview {#p.1-tte-program-overview .unnumbered}

A successful contingency plan depends on the ability of ***\[Insert
Organization\]*** personnel to perform their responsibilities
efficiently and correctly. Training provides a means to enhance
personnel familiarity with the ITCP and to increase their ability to
implement the plan properly. Testing and exercising the plan helps
ensure that the procedures in the plan are viable and likely to work
during an actual contingency event.

Specific objectives of an effective TT&E program will include:

-   Ensure that ***\[Insert Organization\]*** personnel are familiar
    with the ITCP and the alert/notification, recovery and
    reconstitution procedures

-   Validate ITCP policies and procedures

-   Exercise procedures through the use of tabletop and functional
    exercises, as appropriate

-   Ensure that software, backup data, and records required to support
    recovery are available.

The ITCP Director has overall responsibility for coordinating the
development of a comprehensive ITCP TT&E program for the ***\[Insert
System Acronym\]***. The ITCP Director may, however, delegate all or
parts of this responsibility to others, such as the ITCP Coordinator.
Sample training materials are provided in Section P.3. Summary results
from training exercises are included in Section P.4.

## P.2 TT&E Program Components {#p.2-tte-program-components .unnumbered}

An effective TT&E program should include at a minimum the following four
components: 1) developing and preparing for the exercise, 2) training
and executing the exercise, 3) documenting exercise results and lessons
learned, and 4) plan maintenance.

### P.2.1 Exercise Development and Preparation {#p.2.1-exercise-development-and-preparation .unnumbered}

Planning is key to the success of the exercise. Participants involved in
the exercise include internal and external sources such as Agency
leadership, IT specialists, ITCP specialists, system owners, and key
individuals who support the system. Planning activities include, but is
not limited to, the following:

-   Review guidance

-   Delineate scope based on system impact, logistics, and scenario

-   Identify participants, roles, and teams

-   Develop schedules

-   Develop an appropriate scenario that touches on each part of the
    ITCP.

All members of the ITCP team, including alternate (i.e., backup or
successor) personnel should participate in the ITCP exercise. It is
essential for all participants to have a comprehensive knowledge of the
ITCP prior to the exercise. The leadership team should ensure that all
managers and staff have a thorough understanding of their ITCP roles and
responsibilities. Basic ITCP training and annual refresher training
should be conducted for all ITCP personnel to ensure their readiness for
an emergency and to prepare for the ITCP exercise. This training should
also include on-site staff orientations at each designated alternate
location, as well as ongoing training for new employees who would have
involvement in contingency plan activation.

### P.2.2 Exercise Training and Execution {#p.2.2-exercise-training-and-execution .unnumbered}

Training familiarizes personnel with the contingency planning process by
walking them through the actual ITCP and then simulating the ITCP phases
(notification/activation, recovery, and resumption). This method allows
areas to be identified that may require additional development---either
with personnel training or with revising and updating the ITCP. ITCP
training should be coordinated by the ITCP Director and the Office of
Disaster Recovery to ensure that all major elements and components of
the ***\[Insert System Acronym\]*** are tested.

***\[Insert Organization\]*** personnel should receive training on the
ITCP and participate in an exercise at least once annually. Training
should include, but not be limited to, the following areas of the
***\[Insert System Acronym\]*** ITCP:

-   Purpose of the plan

-   Cross team coordination and communication

-   Reporting procedures

-   Team specific processes (notification/activation, recovery,
    reconstitution phases)

-   Individual responsibilities (notification/activation, recovery,
    reconstitution phases).

Executing the ITCP and system recovery activities enables key ITCP
personnel to practice what was learned through participating in the ITCP
training. This furthers each key ITCP personnel's general understanding
of the processes and their involvement during each phase of the ITCP.
Conducting exercises assists in validating the ITCP and allows
management the opportunity to improve the process and overall efficiency
when recovering the system during actual contingency events.

The table below describes ITCP training and exercise options for low,
moderate, and high availability systems.

ITCP Training and Exercise Options Based on System Availability Type

  -----------------------------------------------------------------------------
  **Exercise    **Description**                                 **System
  Type**                                                        Availability
                                                                Type**
  ------------- ----------------------------------------------- ---------------
  Orientation   A seminar and/or briefing used to familiarize   Low
                participants with the overall ITCP purpose,     
                phases, activities, and key ITCP roles and      
                responsibilities                                

  Tabletop      Simulates emergency situation in an informal,   Low /Moderate
  Exercise      stress-free environment; designed to elicit     
                constructive scenario-based discussions for an  
                examination of the existing ITCP and individual 
                state of preparedness                           

  Functional    Used to validate the capability of an           Moderate/High
  Exercise      organization to respond to a simulated          
                emergency, in order to test one or more         
                functions of the plan                           

  Full Scale    Simulates an actual emergency; intended to      High
  Exercise      evaluate operational ITCP procedures and        
                capabilities under simulated stressful          
                conditions                                      
  -----------------------------------------------------------------------------

#### P.2.2.1 Tabletop Exercises {#p.2.2.1-tabletop-exercises .unnumbered}

A tabletop exercise (also called a classroom exercise) is acceptable for
most moderate impact systems. The most important elements are that the
actual individuals involved in the recovery process participate in the
exercise and that the exercise formally addresses all of the elements of
the ITCP.

In a tabletop exercise, the triggering disruption, detection,
notification/activation, recovery and reconstitution are simulated. The
prepared scenario is used to talk through the ITCP in order to
demonstrate how system recovery would be achieved. Tabletop exercises
should include, but not be limited to, the following objectives:

-   Walk through the procedures described in the ITCP

-   Simulate each step within the ITCP as rigorously as possible

-   Include only references to personnel and other resources that are
    located away from the site where the disruption occurs, if
    applicable

-   Talk through each individual's respective role and responsibilities

-   Illustrate a timeline with reasonable times for events for the
    system to be brought to operational status

-   Discuss Recovery Teams and team members along with their respective
    roles and responsibilities

-   Discuss re-establishing authorized system access

-   Train individuals and teams involved during a contingency event

-   Validate ITCP processes and procedures

-   Identify key ITCP personnel and their respective roles and
    responsibilities

-   Identify any ITCP shortfalls and update and improve the ITCP, as
    needed.

Tabletop exercises are more basic and least costly of the two types of
exercises and should be conducted before performing a functional
exercise.

#### P.2.2.2 Functional Exercises {#p.2.2.2-functional-exercises .unnumbered}

Functional exercises are more in-depth than tabletop exercises and
include simulations or war gaming. Often, scripts are provided for role
players who pose as external contacts required during the recovery
scenario. A functional exercise may also include an actual relocation to
an alternate site or switchover of system operations, as appropriate.
Functional exercises may also be more limited in their scope than the
tabletop exercises. For example, a functional exercise may only exercise
the notification procedures (i.e., call-tree and/or email notification)
of a contingency plan.

Exercise activities are usually under a time constraint and an
evaluation or critique is usually held at the end of the exercise. A
functional exercise is recommended for moderate to high availability
systems when a full-scale exercise cannot be conducted. Functional
exercises should include, but not limited to, the following objectives:

-   Demonstrate that the system can be brought to an operational status
    by following the procedures and instructions described in the plan

-   Verify that the organizational units responsible for the contingency
    plan fully understand their responsibilities and are able to
    implement them in a timely manner

-   Verify that the system is brought to an operational condition within
    the recovery time objective

-   Verify that system information is restored to the expected state, so
    that operations can resume in a synchronized manner

-   Verify that access to the system's information by authorized users
    has been re-established.

#### P.2.2.3 Sample Scheduling {#p.2.2.3-sample-scheduling .unnumbered}

An exercise schedule should include the time frames and purpose for the
activities: developing the exercise scenario, executing the exercise,
and documenting the exercise results. Exercises should be performed at
least annually to ensure that the ITCP is up-to-date in the event of a
system failure. The table below describes a sample schedule for
conducting test, training, and exercises.

Sample Schedule for Conducting Test, Training, and Exercises

+----------------------------------------------------------+-----------+
| **Activity**                                             | **Fr      |
|                                                          | equency** |
+==========================================================+===========+
| **Test**                                                 |           |
+----------------------------------------------------------+-----------+
| > Test ITCP notification/activation procedures           | Quarterly |
+----------------------------------------------------------+-----------+
| > Test recovery of vital classified and unclassified     | Semi      |
| > records, critical information systems, services, and   | -Annually |
| > data                                                   |           |
+----------------------------------------------------------+-----------+
| > Test ITCP communications                               | Quarterly |
+----------------------------------------------------------+-----------+
| > Test primary and backup infrastructure systems and     | Annually  |
| > services at alternate operating facilities (e.g.,      |           |
| > power, water, fuel)                                    |           |
+----------------------------------------------------------+-----------+
| **Training**                                             |           |
+----------------------------------------------------------+-----------+
| > Train ITCP awareness for entire workforce              | Annually  |
+----------------------------------------------------------+-----------+
| > Train ITCP essential personnel                         | Annually  |
+----------------------------------------------------------+-----------+
| > Train teams for agency personnel (host or contractor   | Annually  |
| > personnel) to activate, support, and sustain ITCP      |           |
| > operations at alternate operating facilities           |           |
+----------------------------------------------------------+-----------+
| > Complete tabletop exercise that incorporates ITCP      | Annually  |
| > essential personnel                                    |           |
+----------------------------------------------------------+-----------+
| > Conduct a comprehensive debriefing after each exercise | Annually  |
| > for the participants to identify systemic weaknesses   |           |
| > in plans and procedures and recommend ITCP revisions   |           |
+----------------------------------------------------------+-----------+
| > Provide orientation for new employees including        | On-going  |
| > officials and senior level personnel                   |           |
+----------------------------------------------------------+-----------+
| **Exercise**                                             |           |
+----------------------------------------------------------+-----------+
| > Demonstrate familiarity with ITCP, by essential ITCP   | Annually  |
| > personnel, and show capability to continue essential   |           |
| > functions before, during, and after a crisis situation |           |
+----------------------------------------------------------+-----------+
| > Carry-out the deliberate and pre-planned movement of   | Annually  |
| > ITCP personnel to an alternate operating facility      |           |
+----------------------------------------------------------+-----------+
| > Demonstrate communications capabilities and            | Annually  |
| > inter/intra agency and business unit dependencies      |           |
+----------------------------------------------------------+-----------+

### P.2.3 Documenting Exercise Results {#p.2.3-documenting-exercise-results .unnumbered}

During the exercise, lessons learned will be captured and recorded in
the Summary Results section (refer to Section P.4). Exercise results are
derived from the actions taken by participants during the exercise. Any
lessons learned during the exercise should be used to make changes to
the ITCP and thus improving the effectiveness of the plan.

### P.2.4 Plan Maintenance {#p.2.4-plan-maintenance .unnumbered}

The ITCP is a living document that must be maintained and updated
annually, or as major changes are made to the system -- whichever is
more frequent. The ITCP Director is responsible for maintaining,
testing, and updating the plan in keeping with the activities shown in
the table below. However, the ITCP Director may delegate all or parts of
this responsibility as appropriate. The ITCP Director should coordinate
with key individuals in planning exercise schedules and objectives,
analyzing exercise documentation and results, and monitoring major
changes to ***\[Insert System Acronym\]***. To ensure that the plan
maintains a current state of readiness, it is important to keep the
following maintenance schedule:

-   Review and update the plan annually or more frequently based on
    significant changes to ***\[Insert System Acronym\]***

-   Review and update the contact sheets and vendor information
    semi-annually or more often, as necessary

-   Update the plan when test results indicate procedural changes.

Plan maintenance should focus on the following elements:

-   Operation requirements

-   Security requirements

-   Technical requirements

-   Hardware, software, and other types of equipment (types,
    specifications, amount)

-   Names and contact information of team members

-   Names and contact information of vendors including alternate and
    off-site POCs

-   Alternate and offsite facility information

-   Vital records (electronic and hardcopy).

Plan Maintenance

  -----------------------------------------------------------------------
  **Activity**                                **Frequency**
  ------------------------------------------- ---------------------------
  Review plans for accuracy of operational    Annually (at least),
  procedures, technical components, controls, On-going
  and organizational structure                

  Update call lists and organizational charts Semi-annually, On-going
  for essential personnel                     

  Incorporate lessons learned and change in   Upon significant changes to
  policy and philosophy                       components, configurations,
                                              organizational structure,
                                              or controls

  Manage distribution of plan updates         Following tests and
                                              exercises
  -----------------------------------------------------------------------

### P.2.5 After Action and Summary Reports {#p.2.5-after-action-and-summary-reports .unnumbered}

Following the conduct of an exercise, two reports should be generated.
The first report is an after action report. The after action report is
intended to capture detailed lessons learned and observations from the
exercise and should highlight areas to improve the ITCP (refer to
Section P.4.1.1 for an after action report). The lessons learned and
observations identified during the exercise should be used to guide ITCP
revisions and to pinpoint ITCP concepts and processes that require
further development and training, as appropriate.

The second report, the summary report, provides a high level summary of
the more detailed after action report and is meant for executives to get
a quick overview of the outcome of the exercise (refer to Section
P.4.1.2 for a summary report).

### P.3 TT&E Materials {#p.3-tte-materials .unnumbered}

### P.3.1 Agenda {#p.3.1-agenda .unnumbered}

The exercise agenda should be developed to support the tabletop or
functional exercise concepts, training format, and established
objectives. The specific day and time of the exercise should be
coordinated with key ITCP participants to ensure maximum participation.

### P.3.2 Scenario {#p.3.2-scenario .unnumbered}

The general scenario is a brief narrative that sets the stage for the
exercise. The development of a general scenario should approximate the
event that would trigger activation of the ITCP. This general scenario
should be developed in a manner that will lead to discussion of the ITCP
phases of notification/activation, recovery, and reconstitution. In
addition, the scenario should clearly indicate whether the decision to
activate the ITCP will be conducted 'with warning' or 'without warning,'
and whether it occurs during normal business hours or non-business
hours. Prior to the exercise, all participants should be provided with
the scenario and exercise script that will be used.

A sample scenario and tabletop exercise script is provided below:

**Scenario:**

A routine outage is planned for the server that supports the ***\[Insert
System Acronym\]*** for the purposes of routine maintenance. When the
server is rebooted, the server returns to normal operations, but the
***\[Insert System Acronym\]*** does not.

Based on the expected outage, it is determined to be a major failure.
The ***\[Insert System Acronym\]*** ITCP will need to be activated and
the system recovered and returned to full operational status.

Sample Scenario and Exercise Script

+-----------------------------+---+---+----+-----------------------------+
| **[Pre-Outage               |   |   |    |                             |
| Preparations]{.smallcaps}** |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| A routine outage is planned |   |   |    |                             |
| for the server that         |   |   |    |                             |
| supports the ***\[Insert    |   |   |    |                             |
| System Acronym\]*** for the |   |   |    |                             |
| purposes of routine         |   |   |    |                             |
| maintenance. Are there any  |   |   |    |                             |
| preparations that would be  |   |   |    |                             |
| made in preparation for the |   |   |    |                             |
| disruption to system's      |   |   |    |                             |
| availability? If so, what   |   |   |    |                             |
| are they and who would make |   |   |    |                             |
| them?                       |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Activity                    | A |   |    | Observations                |
|                             | c |   |    |                             |
|                             | t |   |    |                             |
|                             | i |   |    |                             |
|                             | o |   |    |                             |
|                             | n |   |    |                             |
|                             | T |   |    |                             |
|                             | a |   |    |                             |
|                             | k |   |    |                             |
|                             | e |   |    |                             |
|                             | n |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
|                             | Y | N | N  |                             |
|                             |   |   | /A |                             |
+-----------------------------+---+---+----+-----------------------------+
| What key activities must be |   |   |    |                             |
| completed?                  |   |   |    |                             |
|                             |   |   |    |                             |
| Who will complete the       |   |   |    |                             |
| activities? (specific names |   |   |    |                             |
| and/or job titles)          |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What information is needed  |   |   |    |                             |
| to make effective           |   |   |    |                             |
| decisions?                  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What tools and resources    |   |   |    |                             |
| (e.g., hardware, software,  |   |   |    |                             |
| tape backups) do you need?  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What internal coordination  |   |   |    |                             |
| needs to take place?        |   |   |    |                             |
|                             |   |   |    |                             |
| What key individuals would  |   |   |    |                             |
| need to be alerted? What is |   |   |    |                             |
| their relationship to the   |   |   |    |                             |
| system?                     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What external coordination  |   |   |    |                             |
| needs to take place?        |   |   |    |                             |
|                             |   |   |    |                             |
| Who are the individuals and |   |   |    |                             |
| what is their relationship  |   |   |    |                             |
| to the system?              |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| **[Notificatio              |   |   |    |                             |
| n/Activation]{.smallcaps}** |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| When the server is          |   |   |    |                             |
| rebooted, it returns to     |   |   |    |                             |
| normal operations, but the  |   |   |    |                             |
| ***\[Insert System          |   |   |    |                             |
| Acronym\]*** does not. What |   |   |    |                             |
| activities should occur?    |   |   |    |                             |
|                             |   |   |    |                             |
| The outage is categorized   |   |   |    |                             |
| as a major system failure.  |   |   |    |                             |
| Who will be notified? What  |   |   |    |                             |
| steps will be taken to      |   |   |    |                             |
| activate the plan?          |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Activity                    | A |   |    | Observations                |
|                             | c |   |    |                             |
|                             | t |   |    |                             |
|                             | i |   |    |                             |
|                             | o |   |    |                             |
|                             | n |   |    |                             |
|                             | T |   |    |                             |
|                             | a |   |    |                             |
|                             | k |   |    |                             |
|                             | e |   |    |                             |
|                             | n |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
|                             | Y | N | N  |                             |
|                             |   |   | /A |                             |
+-----------------------------+---+---+----+-----------------------------+
| What key activities must be |   |   |    |                             |
| completed during the        |   |   |    |                             |
| notification/activation     |   |   |    |                             |
| phase?                      |   |   |    |                             |
|                             |   |   |    |                             |
| Who will complete the       |   |   |    |                             |
| notification/activation     |   |   |    |                             |
| activities? (specific names |   |   |    |                             |
| and/or job titles)          |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What information is needed  |   |   |    |                             |
| to make effective           |   |   |    |                             |
| decisions?                  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What tools and resources    |   |   |    |                             |
| (e.g., hardware, software,  |   |   |    |                             |
| tape backups) are needed?   |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What internal support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| What key individuals would  |   |   |    |                             |
| need to be involved? What   |   |   |    |                             |
| is their relationship to    |   |   |    |                             |
| the system?                 |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What external support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| Who are the individuals and |   |   |    |                             |
| what is their relationship  |   |   |    |                             |
| to the system?              |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| **[Recovery]{.smallcaps}**  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| The ***\[Insert System      |   |   |    |                             |
| Acronym\]*** is not         |   |   |    |                             |
| operating. What steps need  |   |   |    |                             |
| to be taken to recover the  |   |   |    |                             |
| system?                     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Activity                    | A |   |    | Observations                |
|                             | c |   |    |                             |
|                             | t |   |    |                             |
|                             | i |   |    |                             |
|                             | o |   |    |                             |
|                             | n |   |    |                             |
|                             | T |   |    |                             |
|                             | a |   |    |                             |
|                             | k |   |    |                             |
|                             | e |   |    |                             |
|                             | n |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
|                             | Y | N | N  |                             |
|                             |   |   | /A |                             |
+-----------------------------+---+---+----+-----------------------------+
| What key activities must be |   |   |    |                             |
| completed during the        |   |   |    |                             |
| recovery phase?             |   |   |    |                             |
|                             |   |   |    |                             |
| Who will complete the       |   |   |    |                             |
| recovery activities?        |   |   |    |                             |
| (specific names and/or job  |   |   |    |                             |
| titles)                     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| In what sequence should the |   |   |    |                             |
| system components be        |   |   |    |                             |
| recovered? Approximately    |   |   |    |                             |
| how long will it take to    |   |   |    |                             |
| recover each component?     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What information is needed  |   |   |    |                             |
| to make effective           |   |   |    |                             |
| decisions?                  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What tools and resources    |   |   |    |                             |
| (e.g. hardware, software,   |   |   |    |                             |
| tape backups) are needed?   |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What internal support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| What key individuals would  |   |   |    |                             |
| need to be involved? What   |   |   |    |                             |
| is their relationship to    |   |   |    |                             |
| the system?                 |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What external support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| Who are the individuals and |   |   |    |                             |
| what is their relationship  |   |   |    |                             |
| to the system?              |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| **[Re                       |   |   |    |                             |
| constitution]{.smallcaps}** |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| The ***\[Insert System      |   |   |    |                             |
| Acronym\]*** has been       |   |   |    |                             |
| recovered. As recovery      |   |   |    |                             |
| activities are terminated,  |   |   |    |                             |
| what steps need to be taken |   |   |    |                             |
| to return to normal         |   |   |    |                             |
| operations?                 |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Activity                    | A |   |    | Observations                |
|                             | c |   |    |                             |
|                             | t |   |    |                             |
|                             | i |   |    |                             |
|                             | o |   |    |                             |
|                             | n |   |    |                             |
|                             | T |   |    |                             |
|                             | a |   |    |                             |
|                             | k |   |    |                             |
|                             | e |   |    |                             |
|                             | n |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
|                             | Y | N | N  |                             |
|                             |   |   | /A |                             |
+-----------------------------+---+---+----+-----------------------------+
| What key activities must be |   |   |    |                             |
| completed during the        |   |   |    |                             |
| reconstitution phase?       |   |   |    |                             |
|                             |   |   |    |                             |
| Who will complete the       |   |   |    |                             |
| reconstitution activities?  |   |   |    |                             |
| (specific names and/or job  |   |   |    |                             |
| titles)                     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What information is needed  |   |   |    |                             |
| to make effective           |   |   |    |                             |
| decisions?                  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What tools and resources    |   |   |    |                             |
| (e.g., hardware, software,  |   |   |    |                             |
| tape backups) are needed?   |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What internal support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| What key individuals would  |   |   |    |                             |
| need to be involved? What   |   |   |    |                             |
| is their relationship to    |   |   |    |                             |
| the system?                 |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What external support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| Who are the individuals and |   |   |    |                             |
| what is their relationship  |   |   |    |                             |
| to the system?              |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| **[Plan                     |   |   |    |                             |
| Deactivation]{.smallcaps}** |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Normal operations have been |   |   |    |                             |
| restored. What activities   |   |   |    |                             |
| will be taken to deactivate |   |   |    |                             |
| the plan?                   |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Activity                    | A |   |    | Observations                |
|                             | c |   |    |                             |
|                             | t |   |    |                             |
|                             | i |   |    |                             |
|                             | o |   |    |                             |
|                             | n |   |    |                             |
|                             | T |   |    |                             |
|                             | a |   |    |                             |
|                             | k |   |    |                             |
|                             | e |   |    |                             |
|                             | n |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
|                             | Y | N | N  |                             |
|                             |   |   | /A |                             |
+-----------------------------+---+---+----+-----------------------------+
| What key activities must be |   |   |    |                             |
| completed to deactivate the |   |   |    |                             |
| plan?                       |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Who's role is it to         |   |   |    |                             |
| officially deactivate the   |   |   |    |                             |
| plan?                       |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Who has responsibility for  |   |   |    |                             |
| completing the after action |   |   |    |                             |
| report?                     |   |   |    |                             |
|                             |   |   |    |                             |
| What is done with the after |   |   |    |                             |
| action report once it is    |   |   |    |                             |
| completed?                  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| **[Lessons Learned and      |   |   |    |                             |
| Comments]{.smallcaps}**     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Lessons Learned:            |   |   |    |                             |
|                             |   |   |    |                             |
| During the ***\[Insert      |   |   |    |                             |
| System Acronym\]*** TT&E,   |   |   |    |                             |
| participants discussed      |   |   |    |                             |
| their individual and        |   |   |    |                             |
| collaborative roles and     |   |   |    |                             |
| responsibilities in the     |   |   |    |                             |
| case that the system        |   |   |    |                             |
| experienced a minor or      |   |   |    |                             |
| major failure. The          |   |   |    |                             |
| participants discussed how  |   |   |    |                             |
| they would respond to the   |   |   |    |                             |
| three phases of the ITCP:   |   |   |    |                             |
| notification/activation,    |   |   |    |                             |
| recovery, and               |   |   |    |                             |
| reconstitution. The         |   |   |    |                             |
| following information was   |   |   |    |                             |
| determined:                 |   |   |    |                             |
|                             |   |   |    |                             |
| -                           |   |   |    |                             |
| -                           |   |   |    |                             |
| -                           |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+

### P.3.3 Presentation Materials {#p.3.3-presentation-materials .unnumbered}

### *\[Insert material presented during TT&E\]* {#insert-material-presented-during-tte .unnumbered}

### P.3.4 After Action and Summary Reports {#p.3.4-after-action-and-summary-reports .unnumbered}

Following the conduct of an exercise, two reports should be generated.
The first report is an after action report. The after action report is
intended to capture detailed lessons learned and observations from the
exercise and should highlight areas to improve the ITCP (refer to
Section P.4.1.1 for an after action report). The lessons learned and
observations identified during the exercise should be used to guide ITCP
revisions and to pinpoint ITCP concepts and processes that require
further development and training, as appropriate. The second report, the
summary report, provides a high level summary of the more detailed after
action report and is meant for executives to get a quick overview of the
outcome of the exercise (refer to Section P.4.1.2 for a summary report).

## P.4 Exercise Results {#p.4-exercise-results .unnumbered}

### P.4.1 Summary Report {#p.4.1-summary-report .unnumbered}

In accordance with the ***\[Insert Organization\]***contingency plan
testing guidance, the exercise summary results from the exercise
conducted on ***\[Insert Exercise Date\]*** are as follows:

+---------------------+------------------------------------------------+
| Type of Event       | ***Tabletop Exercise/Functional Exercise/Live  |
|                     | Recovery***                                    |
+---------------------+------------------------------------------------+
| Name of System      | ***\[Insert System Name and Acronym\]***       |
+---------------------+------------------------------------------------+
| Date of Test        | ***\[Insert Date of Exercise\]***              |
+---------------------+------------------------------------------------+
| Testing Point of    | ***\[Insert the Name and Title of ITCP         |
| Contact             | Director\]***                                  |
+---------------------+------------------------------------------------+
| Purpose, Type of    |                                                |
| Test, and Scope:    |                                                |
+---------------------+------------------------------------------------+
| The purpose of this |                                                |
| tabletop exercise   |                                                |
| is to train the     |                                                |
| appropriate key     |                                                |
| individuals, test   |                                                |
| and exercise the    |                                                |
| ITCP procedures,    |                                                |
| and to ensure the   |                                                |
| viability of the    |                                                |
| ITCP. The scope of  |                                                |
| this tabletop       |                                                |
| exercise applies to |                                                |
| the ***\[Insert     |                                                |
| System Acronym\]*** |                                                |
| system as it is     |                                                |
| installed at the    |                                                |
| ***\[Insert street  |                                                |
| address where       |                                                |
| production system   |                                                |
| resides\]***        |                                                |
| facility in         |                                                |
| ***\[City,          |                                                |
| State\]***. This    |                                                |
| exercise only       |                                                |
| applies to the      |                                                |
| ***\[Insert System  |                                                |
| Acronym\]*** system |                                                |
| and not the GSS     |                                                |
| that it relies on   |                                                |
| for infrastructure  |                                                |
| support.            |                                                |
+---------------------+------------------------------------------------+
| Objectives:         |                                                |
+---------------------+------------------------------------------------+
| The objectives of   |                                                |
| this tabletop       |                                                |
| exercise are to:    |                                                |
|                     |                                                |
| -   Train           |                                                |
|     individuals and |                                                |
|     teams involved  |                                                |
|     during a        |                                                |
|     contingency     |                                                |
|     event           |                                                |
|                     |                                                |
| -   Identify key    |                                                |
|     ITCP personnel  |                                                |
|     and their       |                                                |
|     respective      |                                                |
|     roles and       |                                                |
|                     |                                                |
|    responsibilities |                                                |
|                     |                                                |
| -   Talk through    |                                                |
|     the procedures  |                                                |
|     described in    |                                                |
|     the ***\[Insert |                                                |
|     System          |                                                |
|     Acronym\]***    |                                                |
|     ITCP            |                                                |
|                     |                                                |
| -   Validate ITCP   |                                                |
|     processes and   |                                                |
|     procedures      |                                                |
|                     |                                                |
| -   Validate that   |                                                |
|     the specified   |                                                |
|     times that the  |                                                |
|     system can be   |                                                |
|     recovered in    |                                                |
|     are realistic   |                                                |
|                     |                                                |
| -   Identify any    |                                                |
|     ITCP shortfalls |                                                |
|     and update and  |                                                |
|     improve the     |                                                |
|     ITCP, if        |                                                |
|     applicable.     |                                                |
+---------------------+------------------------------------------------+
| Methodology:        |                                                |
+---------------------+------------------------------------------------+
| Key individuals     |                                                |
| will first be       |                                                |
| trained on the      |                                                |
| ***\[Insert System  |                                                |
| Acronym\]*** ITCP   |                                                |
| and then talked     |                                                |
| through a mock      |                                                |
| scenario to         |                                                |
| simulate a          |                                                |
| ***\[Insert System  |                                                |
| Acronym\]*** system |                                                |
| failure. This       |                                                |
| simulation will     |                                                |
| touch on all areas  |                                                |
| of the ***\[Insert  |                                                |
| System Acronym\]*** |                                                |
| ITCP.               |                                                |
+---------------------+------------------------------------------------+
| Activities and      |                                                |
| Results (action,    |                                                |
| expected results,   |                                                |
| actual results):    |                                                |
+---------------------+------------------------------------------------+
| [Activ              |                                                |
| ities:]{.underline} |                                                |
| During the training |                                                |
| portion,            |                                                |
| participants were   |                                                |
| walked through the  |                                                |
| ***\[Insert System  |                                                |
| Acronym\]*** ITCP.  |                                                |
| The procedures and  |                                                |
| processes outlined  |                                                |
| in the ITCP were    |                                                |
| explained and each  |                                                |
| key ITCP            |                                                |
| personnel's role    |                                                |
| and                 |                                                |
| responsibilities    |                                                |
| were discussed,     |                                                |
| defined, and        |                                                |
| described. Key      |                                                |
| appendices were     |                                                |
| also discussed and  |                                                |
| crucial recovery    |                                                |
| information was     |                                                |
| highlighted.        |                                                |
|                     |                                                |
| During the          |                                                |
| test/exercise,      |                                                |
| participants were   |                                                |
| presented with a    |                                                |
| mock scenario that  |                                                |
| required ITCP       |                                                |
| activation and      |                                                |
| recovery of the     |                                                |
| ***\[Insert System  |                                                |
| Acronym\]***        |                                                |
| ***\[List specific  |                                                |
| system components   |                                                |
| that were included  |                                                |
| in the              |                                                |
| exercise\]***. The  |                                                |
| scenario touched on |                                                |
| each phase of the   |                                                |
| ITCP. Participants  |                                                |
| were prompted with  |                                                |
| questions aimed at  |                                                |
| promoting           |                                                |
| discussion and      |                                                |
| collaboration. The  |                                                |
| ***\[Insert System  |                                                |
| Acronym\]***        |                                                |
| components were     |                                                |
| successfully        |                                                |
| recovered during    |                                                |
| the mock scenario.  |                                                |
+---------------------+------------------------------------------------+
| [Expected           |                                                |
| Re                  |                                                |
| sults:]{.underline} |                                                |
| For the training    |                                                |
| portion,            |                                                |
| participants were   |                                                |
| expected to become  |                                                |
| familiar with their |                                                |
| roles and           |                                                |
| responsibilities as |                                                |
| well as the         |                                                |
| processes and       |                                                |
| procedures outlined |                                                |
| in the ITCP. For    |                                                |
| the test/exercise,  |                                                |
| participants were   |                                                |
| encouraged to       |                                                |
| actively contribute |                                                |
| and to talk through |                                                |
| the scenario. It    |                                                |
| was also expected   |                                                |
| that the current    |                                                |
| ITCP would be       |                                                |
| further validated   |                                                |
| by the open         |                                                |
| discussion that the |                                                |
| exercise format can |                                                |
| generate.           |                                                |
|                     |                                                |
| [Actual             |                                                |
| Re                  |                                                |
| sults:]{.underline} |                                                |
| For the training    |                                                |
| portion,            |                                                |
| participants were   |                                                |
| trained on the      |                                                |
| ***\[Insert System  |                                                |
| Acronym\]*** ITCP.  |                                                |
| They were walked    |                                                |
| through key areas   |                                                |
| of the ITCP. Every  |                                                |
| ITCP role and       |                                                |
| responsibility was  |                                                |
| discussed and       |                                                |
| appropriate         |                                                |
| individual          |                                                |
| identified for      |                                                |
| each. Adequate      |                                                |
| training was        |                                                |
| achieved.           |                                                |
|                     |                                                |
| For the             |                                                |
| test/exercise,      |                                                |
| ***\[Insert         |                                                |
| Relevant Info***\]. |                                                |
+---------------------+------------------------------------------------+
| Action Item         |                                                |
| Assessment:         |                                                |
+---------------------+------------------------------------------------+
| ***\[Insert         |                                                |
| information         |                                                |
| describing any      |                                                |
| action items that   |                                                |
| resulted from       |                                                |
| conducting the      |                                                |
| exercise; also      |                                                |
| include how those   |                                                |
| items were          |                                                |
| addressed.\]***     |                                                |
+---------------------+------------------------------------------------+

***\[A separate section should be created for each actual exercise -
classroom or functional - that has been performed. Each exercise should
start on a separate page to facilitate ease in extraction for delivery
to the ITCP Director with the most recent exercises listed first.\]***

### P.4.2 Exercise After Action Report {#p.4.2-exercise-after-action-report .unnumbered}

**Agenda**

Date: ***\[Insert Exercise Date\]***

Location: ***\[Insert Location\]***

***\[Insert Exercise Time\]*** EST

**Participants**

The following list of individuals participated in the for ***\[Insert
System Acronym\]*** ***\[Insert Exercise Date\]*** exercise.

***Exercise Participants***

  ------------------- ----------------- ----------------------------------
  **Name**            **Business Unit** **ITCP Role**

                                        

                                        

                                        
  ------------------- ----------------- ----------------------------------

C&A Team Participants

  ------------------- ---------------------------------------------------
  **Name**            **Role**

  ***\[Insert         ITCP Author and Tabletop Exercise Facilitator
  Name\]***           

  ***\[Insert         ***\[Include roles of other C&A team
  Name\]***           participants)\]***

  ***\[Insert         ***\[Include roles of other C&A team
  Name\]***           participants\]***
  ------------------- ---------------------------------------------------

**Scenario**:

A routine outage is planned for the server that supports the ***\[Insert
System Acronym\]*** for the purposes of routine maintenance. When the
server is rebooted, the server returns to normal operations, but the
***\[Insert System Acronym\]*** does not.

Based on the expected outage, it is determined to be a major failure.
The ***\[Insert System Acronym\]*** ITCP will need to be activated and
the system recovered and returned to full operational status.

**Exercise Script**

+-----------------------------+---+---+----+-----------------------------+
| **[Pre-Outage               |   |   |    |                             |
| Preparations]{.smallcaps}** |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| A routine outage is planned |   |   |    |                             |
| for the server that         |   |   |    |                             |
| supports the ***\[Insert    |   |   |    |                             |
| System Acronym\]*** for the |   |   |    |                             |
| purposes of routine         |   |   |    |                             |
| maintenance. Are there any  |   |   |    |                             |
| preparations that would be  |   |   |    |                             |
| made in preparation for the |   |   |    |                             |
| disruption to system's      |   |   |    |                             |
| availability? If so, what   |   |   |    |                             |
| are they and who would make |   |   |    |                             |
| them?                       |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Activity                    | A |   |    | Observations                |
|                             | c |   |    |                             |
|                             | t |   |    |                             |
|                             | i |   |    |                             |
|                             | o |   |    |                             |
|                             | n |   |    |                             |
|                             | T |   |    |                             |
|                             | a |   |    |                             |
|                             | k |   |    |                             |
|                             | e |   |    |                             |
|                             | n |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
|                             | Y | N | N  |                             |
|                             |   |   | /A |                             |
+-----------------------------+---+---+----+-----------------------------+
| What key activities must be |   |   |    |                             |
| completed?                  |   |   |    |                             |
|                             |   |   |    |                             |
| Who will complete the       |   |   |    |                             |
| activities? (specific names |   |   |    |                             |
| and/or job titles)          |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What information is needed  |   |   |    |                             |
| to make effective           |   |   |    |                             |
| decisions?                  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What tools and resources    |   |   |    |                             |
| (e.g., hardware, software,  |   |   |    |                             |
| tape backups) do you need?  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What internal coordination  |   |   |    |                             |
| needs to take place?        |   |   |    |                             |
|                             |   |   |    |                             |
| What key individuals would  |   |   |    |                             |
| need to be alerted? What is |   |   |    |                             |
| their relationship to the   |   |   |    |                             |
| system?                     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What external coordination  |   |   |    |                             |
| needs to take place?        |   |   |    |                             |
|                             |   |   |    |                             |
| Who are the individuals and |   |   |    |                             |
| what is their relationship  |   |   |    |                             |
| to the system?              |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| **[Notificatio              |   |   |    |                             |
| n/Activation]{.smallcaps}** |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| When the server is          |   |   |    |                             |
| rebooted, it returns to     |   |   |    |                             |
| normal operations, but the  |   |   |    |                             |
| ***\[Insert System          |   |   |    |                             |
| Acronym\]*** does not. What |   |   |    |                             |
| activities should occur?    |   |   |    |                             |
|                             |   |   |    |                             |
| The outage is categorized   |   |   |    |                             |
| as a major system failure.  |   |   |    |                             |
| Who will be notified? What  |   |   |    |                             |
| steps will be taken to      |   |   |    |                             |
| activate the plan?          |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Activity                    | A |   |    | Observations                |
|                             | c |   |    |                             |
|                             | t |   |    |                             |
|                             | i |   |    |                             |
|                             | o |   |    |                             |
|                             | n |   |    |                             |
|                             | T |   |    |                             |
|                             | a |   |    |                             |
|                             | k |   |    |                             |
|                             | e |   |    |                             |
|                             | n |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
|                             | Y | N | N  |                             |
|                             |   |   | /A |                             |
+-----------------------------+---+---+----+-----------------------------+
| What key activities must be |   |   |    |                             |
| completed during the        |   |   |    |                             |
| notification/activation     |   |   |    |                             |
| phase?                      |   |   |    |                             |
|                             |   |   |    |                             |
| Who will complete the       |   |   |    |                             |
| notification/activation     |   |   |    |                             |
| activities? (specific names |   |   |    |                             |
| and/or job titles)          |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What information is needed  |   |   |    |                             |
| to make effective           |   |   |    |                             |
| decisions?                  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What tools and resources    |   |   |    |                             |
| (e.g., hardware, software,  |   |   |    |                             |
| tape backups) are needed?   |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What internal support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| What key individuals would  |   |   |    |                             |
| need to be involved? What   |   |   |    |                             |
| is their relationship to    |   |   |    |                             |
| the system?                 |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What external support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| Who are the individuals and |   |   |    |                             |
| what is their relationship  |   |   |    |                             |
| to the system?              |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| **[Recovery]{.smallcaps}**  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| The ***\[Insert System      |   |   |    |                             |
| Acronym\]*** is not         |   |   |    |                             |
| operating. What steps need  |   |   |    |                             |
| to be taken to recover the  |   |   |    |                             |
| system?                     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Activity                    | A |   |    | Observations                |
|                             | c |   |    |                             |
|                             | t |   |    |                             |
|                             | i |   |    |                             |
|                             | o |   |    |                             |
|                             | n |   |    |                             |
|                             | T |   |    |                             |
|                             | a |   |    |                             |
|                             | k |   |    |                             |
|                             | e |   |    |                             |
|                             | n |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
|                             | Y | N | N  |                             |
|                             |   |   | /A |                             |
+-----------------------------+---+---+----+-----------------------------+
| What key activities must be |   |   |    |                             |
| completed during the        |   |   |    |                             |
| recovery phase?             |   |   |    |                             |
|                             |   |   |    |                             |
| Who will complete the       |   |   |    |                             |
| recovery activities?        |   |   |    |                             |
| (specific names and/or job  |   |   |    |                             |
| titles)                     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| In what sequence should the |   |   |    |                             |
| system components be        |   |   |    |                             |
| recovered? Approximately    |   |   |    |                             |
| how long will it take to    |   |   |    |                             |
| recover each component?     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What information is needed  |   |   |    |                             |
| to make effective           |   |   |    |                             |
| decisions?                  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What tools and resources    |   |   |    |                             |
| (e.g. hardware, software,   |   |   |    |                             |
| tape backups) are needed?   |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What internal support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| What key individuals would  |   |   |    |                             |
| need to be involved? What   |   |   |    |                             |
| is their relationship to    |   |   |    |                             |
| the system?                 |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What external support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| Who are the individuals and |   |   |    |                             |
| what is their relationship  |   |   |    |                             |
| to the system?              |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| **[Re                       |   |   |    |                             |
| constitution]{.smallcaps}** |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| The ***\[Insert System      |   |   |    |                             |
| Acronym\]*** has been       |   |   |    |                             |
| recovered. As recovery      |   |   |    |                             |
| activities are terminated,  |   |   |    |                             |
| what steps need to be taken |   |   |    |                             |
| to return to normal         |   |   |    |                             |
| operations?                 |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Activity                    | A |   |    | Observations                |
|                             | c |   |    |                             |
|                             | t |   |    |                             |
|                             | i |   |    |                             |
|                             | o |   |    |                             |
|                             | n |   |    |                             |
|                             | T |   |    |                             |
|                             | a |   |    |                             |
|                             | k |   |    |                             |
|                             | e |   |    |                             |
|                             | n |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
|                             | Y | N | N  |                             |
|                             |   |   | /A |                             |
+-----------------------------+---+---+----+-----------------------------+
| What key activities must be |   |   |    |                             |
| completed during the        |   |   |    |                             |
| reconstitution phase?       |   |   |    |                             |
|                             |   |   |    |                             |
| Who will complete the       |   |   |    |                             |
| reconstitution activities?  |   |   |    |                             |
| (specific names and/or job  |   |   |    |                             |
| titles)                     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What information is needed  |   |   |    |                             |
| to make effective           |   |   |    |                             |
| decisions?                  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What tools and resources    |   |   |    |                             |
| (e.g., hardware, software,  |   |   |    |                             |
| tape backups) are needed?   |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What internal support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| What key individuals would  |   |   |    |                             |
| need to be involved? What   |   |   |    |                             |
| is their relationship to    |   |   |    |                             |
| the system?                 |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| What external support and   |   |   |    |                             |
| coordination is needed?     |   |   |    |                             |
|                             |   |   |    |                             |
| Who are the individuals and |   |   |    |                             |
| what is their relationship  |   |   |    |                             |
| to the system?              |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| **[Plan                     |   |   |    |                             |
| Deactivation]{.smallcaps}** |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Normal operations have been |   |   |    |                             |
| restored. What activities   |   |   |    |                             |
| will be taken to deactivate |   |   |    |                             |
| the plan?                   |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Activity                    | A |   |    | Observations                |
|                             | c |   |    |                             |
|                             | t |   |    |                             |
|                             | i |   |    |                             |
|                             | o |   |    |                             |
|                             | n |   |    |                             |
|                             | T |   |    |                             |
|                             | a |   |    |                             |
|                             | k |   |    |                             |
|                             | e |   |    |                             |
|                             | n |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
|                             | Y | N | N  |                             |
|                             |   |   | /A |                             |
+-----------------------------+---+---+----+-----------------------------+
| What key activities must be |   |   |    |                             |
| completed to deactivate the |   |   |    |                             |
| plan?                       |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Who's role is it to         |   |   |    |                             |
| officially deactivate the   |   |   |    |                             |
| plan?                       |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Who has responsibility for  |   |   |    |                             |
| completing the after action |   |   |    |                             |
| report?                     |   |   |    |                             |
|                             |   |   |    |                             |
| What is done with the after |   |   |    |                             |
| action report once it is    |   |   |    |                             |
| completed?                  |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| **[Lessons Learned and      |   |   |    |                             |
| Comments]{.smallcaps}**     |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+
| Lessons Learned:            |   |   |    |                             |
|                             |   |   |    |                             |
| During the ***\[Insert      |   |   |    |                             |
| System Acronym\]***         |   |   |    |                             |
| exercise, participants      |   |   |    |                             |
| discussed their individual  |   |   |    |                             |
| and collaborative roles and |   |   |    |                             |
| responsibilities in the     |   |   |    |                             |
| case that the system        |   |   |    |                             |
| experienced a minor or      |   |   |    |                             |
| major failure. The          |   |   |    |                             |
| participants discussed how  |   |   |    |                             |
| they would respond to the   |   |   |    |                             |
| three phases of the ITCP:   |   |   |    |                             |
| notification/activation,    |   |   |    |                             |
| recovery, and               |   |   |    |                             |
| reconstitution. The         |   |   |    |                             |
| following information was   |   |   |    |                             |
| determined:                 |   |   |    |                             |
|                             |   |   |    |                             |
| -                           |   |   |    |                             |
| -                           |   |   |    |                             |
| -                           |   |   |    |                             |
+-----------------------------+---+---+----+-----------------------------+

# APPENDIX Q. GLOSSARY {#appendix-q.-glossary .unnumbered}

**Accreditation** -- The approval granted by management for an
information system, system, network or network component to process
sensitive information in its operational environment. Accreditation is
based on the certification implementation of the security plan, reliable
and independent technical information sources, and other management
considerations.

**Alternate Site** -- A location, other than the primary location, used
to continue operational capabilities during a significant system
disruption.

**Business Continuity Plan (BCP)** -- A comprehensive plan written for
maintaining essential business operations while recovering from a
significant disruption.

**Certification** -- An independent technical evaluation for the purpose
of accreditation which uses security requirements as the criteria for
the evaluation.

**Critical Business Process(es) (CBP)**: The ***\[Insert
Organization\]*** has identified and prioritized its top Critical
Business Processes and Administrative/ Infrastructure Processes. These
processes are distributed over all divisions, and are used as the
qualifying criteria to determine the priority for recovering, restoring,
resuming CBPs and sub-processes at each organization site.

**Data** -- A representation of facts, concepts, or instructions in a
formalized manner suitable for communication, interpretation, or
processing by humans or by automatic means.

**Disaster Recovery Plan** -- a plan designed to restore operability of
the target system, system, or computer facility at an alternate site
following a significant disruption. The DRP scope may overlap that of an
IT contingency plan; however, the DRP is narrower in scope and does not
address minor disruptions that do not require relocation.

**Hardware** -- The mechanical, magnetic, electrical, and electronic
devices or components of an information system.

**Information System** -- An assembly of computer hardware, software, or
firmware configured to collect, create, communicate, compute,
disseminate, process, store, and control data or information. An
information system will consist of automated data processing system
hardware, operating system and system software, peripheral devices, and
associated data communications equipment.

**Information Technology Contingency Plan** -- Support plans designed to
ensure continuity of general support systems and major systems following
a disruption.

**Secondary Processing Procedures** -- Procedures that can be initiated
in lieu of the system to maintain business operations during an outage.

**Occupant Evacuation Plan (OEP)** -- Response procedures for occupants
of a facility to evacuate or find safety in the event of a situation
posing a potential threat to the health and safety of personnel, the
environment, or property.

**Operating System (OS)** -- An organized collection of techniques,
procedures, programs or routines for operating an information system,
usually supplied by the system hardware vendor.

**Recovery Point Objective (RPO)**: The point in time to which systems
and data must be recovered after an outage. (e.g. end of previous day\'s
processing). RPOs are often used as the basis for the development of
backup strategies, and as a determinant of the amount of data that may
need to be recreated after the systems or functions have been recovered.

**Recovery Time Objective (RTO)**: The period of time within which
systems, systems, or functions must be recovered after an outage (e.g.
one business day). RTOs are often used as the basis for the development
of recovery strategies, and as a determinant as to whether or not to
implement the recovery strategies during a disaster situation.

**Relocation** -- The transferring of resources from the primary
facility to an alternate location following a disaster that has
prevented continued use of the original location.

**User** -- An Individual(s) who accesses information systems to use
programs or systems in order to perform an organizational task.

# APPENDIX R. ACRONYM LIST {#appendix-r.-acronym-list .unnumbered}

Make sure that all acronyms used in the document are accounted for here.
Additionally, ensure that all acronyms identified in this list are
accounted for in the document text.

  ----------------------- ----------------------------------------------------
  **Term/Abbreviation**   **Description**

  A/I                     Administrative/Infrastructure

  AAR                     After Action Report

  ATOD                    At Time of Disaster

  BCP                     Business Continuity Plan

  BIA                     Business Impact Analysis

  BOD                     Business Operation Division

  BRP                     Business Resumption Plan

  CBP                     Critical Business Process(es)

  DAA                     Designated Approving Authority

  DRP                     Disaster Recovery Plan

  GSS                     General Support System

  HR                      Human Resource

  HVAC                    Heating, Ventilation, and Air-Conditioning

  IP                      Internet Protocol

  IT                      Information Technology

  ITCP                    Information Technology Contingency Plan

  LAN                     Local Area Network

  NIST                    National Institute of Standards and Technology

  OEP                     Occupant Evacuation Plan

  PII                     Personally Identifiable Information

  POC                     Point of Contact

  RPO                     Recovery Point Objective

  RTO                     Recovery Time Objective

  SP                      Special Publication

  SLA                     Service Level Agreement

  SSP                     System Security Plan

  TT&E                    Test, Training, and Exercise

  UPS                     Uninterruptible Power Supply

  WAN                     Wide Area Network
  ----------------------- ----------------------------------------------------

[^1]: More information on the RTO may be found in Appendix N of this
    document.

[^2]: Off-site tape storage is not required for applications categorized
    as "Low" per NIST 800-53. Therefore this application may only have
    backup tapes stored locally and not also at an off-site facility.

[^3]: System resources are inventoried in Appendix G of this ITCP.

[^4]: The RTO measures the maximum acceptable length of time that may
    elapse before unavailability of the application causes an
    unacceptable impact on the Business Unit sub-process(es). The RPO
    identifies the point in time to which sub-process data must be
    recovered.