+-----------------------------------------------------------------------+
| # VBA IRM Handbook No. 5.09.0                                         |
| 1.HB1 Update of Facility Information Technology (IT) Contingency Plan |
+-----------------------------------------------------------------------+

  -----------------------------------------------------------------------
  This handbook contains the procedures that the VBA Information Security
  Officer (20S1) has developed to implement *VBA IRM Policy Directive No.
  5.00.01, Paragraph 2, Section 5.09.01 of VBA Manual M20-4, Part I*. You
  may direct any questions or comments concerning these procedures to the
  Information Security Officer.

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------
  All VBA facilities shall develop, annually test, and update facility IT
  contingency plans. This handbook provides procedures for updating
  facility IT contingency plans.

  -----------------------------------------------------------------------

+----+---------------------+----+-------------------------------------+
|    | # [WHO (            |    | # [ACTION]{.underline}              |
|    | Actor)]{.underline} |    |                                     |
|    |                     |    | #                                   |
|    | #                   |    |                                     |
+----+---------------------+----+-------------------------------------+
| !  | VBA Information     |    | Develop guidance and standards for  |
| [] | Security Officer    |    | facility contingency plans that are |
| (m | (ISO)(20S1)         |    | consistent with Federal and VA      |
| ed |                     |    | policies.                           |
| ia |                     |    |                                     |
| /i |                     |    |                                     |
| ma |                     |    |                                     |
| ge |                     |    |                                     |
| 1. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
| !  | Area Directors      |    | Provide general direction, as       |
| [] |                     |    | appropriate, to VBA regional        |
| (m |                     |    | offices regarding the updating of   |
| ed |                     |    | facility contingency plans.         |
| ia |                     |    |                                     |
| /i |                     |    |                                     |
| ma |                     |    |                                     |
| ge |                     |    |                                     |
| 2. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
| !  | Director, Office of |    | Provide general direction, as       |
| [] | Information Systems |    | appropriate, to the Benefit         |
| (m | (20S3)              |    | Delivery Centers regarding the      |
| ed |                     |    | updating of facility contingency    |
| ia |                     |    | plans.                              |
| /i |                     |    |                                     |
| ma |                     |    |                                     |
| ge |                     |    |                                     |
| 3. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
| !  | Facility Director   |    | a\. Execute the responsibilities of |
| [] |                     |    | the facility\'s Disaster Recovery   |
| (m |                     |    | Manager as defined in the           |
| ed |                     |    | facility\'s contingency plan.       |
| ia |                     |    |                                     |
| /i |                     |    |                                     |
| ma |                     |    |                                     |
| ge |                     |    |                                     |
| 4. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
|    |                     |    | b\. Appoint coordinators, team      |
|    |                     |    | leaders, alternate team leaders,    |
|    |                     |    | and team members as specified in    |
|    |                     |    | Appendix A.                         |
+----+---------------------+----+-------------------------------------+
|    |                     |    | c\. Provide the name and telephone  |
|    |                     |    | number of the facility\'s current   |
|    |                     |    | Contingency Planning Coordinator to |
|    |                     |    | the VBA ISO (20S1).                 |
+----+---------------------+----+-------------------------------------+
| !  | Contingency         |    | a\. Coordinate the update and       |
| [] | Planning            |    | maintenance of the facility\'s      |
| (m | Coordinator         |    | contingency plan. Prepare an annual |
| ed |                     |    | schedule for updating the plan.     |
| ia |                     |    | \[Note: A good practice is to       |
| /i |                     |    | schedule the update following the   |
| ma |                     |    | annual test of the contingency      |
| ge |                     |    | plan.\]                             |
| 5. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
|    |                     |    | b\. Establish a Maintenance Index   |
|    |                     |    | as specified in Appendix B.         |
+----+---------------------+----+-------------------------------------+
|    |                     |    | c\. Distribute Contingency Plan     |
|    |                     |    | sections for review and revision to |
|    |                     |    | the appropriate coordinators and    |
|    |                     |    | team leaders according to the       |
|    |                     |    | Maintenance Index.                  |
+----+---------------------+----+-------------------------------------+
| !  | Coordinators and    |    | Annotate necessary changes on       |
| [] | Team Leaders (See   |    | Contingency Plan sections and       |
| (m | Appendices A and B) |    | return to the Contingency Planning  |
| ed |                     |    | Coordinator. Contingency Plans must |
| ia |                     |    | comply with the standards specified |
| /i |                     |    | in Appendix C.                      |
| ma |                     |    |                                     |
| ge |                     |    |                                     |
| 6. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
| !  | Contingency         |    | a\. Update the Contingency Plan by  |
| [] | Planning            |    | using the annotated Contingency     |
| (m | Coordinator         |    | Plan sections. Use Microsoft Word   |
| ed |                     |    | for Windows for editing the Plan\'s |
| ia |                     |    | Word document file.                 |
| /i |                     |    |                                     |
| ma |                     |    |                                     |
| ge |                     |    |                                     |
| 7. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
|    |                     |    | b\. Ensure that the recommended     |
|    |                     |    | changes documented in the last Test |
|    |                     |    | Evaluation Report are included in   |
|    |                     |    | the update.                         |
+----+---------------------+----+-------------------------------------+
|    |                     |    | c\. Submit the updated Contingency  |
|    |                     |    | Plan to the facility director for   |
|    |                     |    | his/her approval.                   |
+----+---------------------+----+-------------------------------------+
| !  | Facility Director   |    | Approve the updated Contingency     |
| [] |                     |    | Plan on the Plan\'s second page.    |
| (m |                     |    |                                     |
| ed |                     |    |                                     |
| ia |                     |    |                                     |
| /i |                     |    |                                     |
| ma |                     |    |                                     |
| ge |                     |    |                                     |
| 8. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
| !  | Contingency         |    | a\. Distribute copies of the        |
| [] | Planning            |    | approved Contingency Plan to team   |
| (m | Coordinator         |    | leaders and other key personnel.    |
| ed |                     |    | Keep a password protected copy on   |
| ia |                     |    | line on the facility local area     |
| /i |                     |    | network (LAN) for access by team    |
| ma |                     |    | members.                            |
| ge |                     |    |                                     |
| 9. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
|    |                     |    | b\. Provide a briefing or written   |
|    |                     |    | notification to team leaders on     |
|    |                     |    | changes to the Contingency Plan.    |
+----+---------------------+----+-------------------------------------+
| ![ | Contingency         |    | c\. Provide a written statement to  |
| ]( | Planning            |    | the VBA ISO that the facility\'s    |
| me | Coordinator         |    | Contingency Plan has been updated.  |
| di | (continued)         |    |                                     |
| a/ |                     |    | d\. Store a copy of the updated     |
| im |                     |    | plan off site at the facility\'s    |
| ag |                     |    | Control Center.                     |
| e1 |                     |    |                                     |
| 0. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+

![](media/image11.emf)

This handbook is approved. It will be used to implement *VBA IRM Policy
Directive No. 5.00.01, Paragraph 2, Section 5.09.01 of VBA Manual M20-4,
Part I*. Place it in *Part II of M20-4* behind *Tab 5.0, Information
Security Management*.

> By Direction of the Under Secretary for Benefits
>
> **original signed**
>
> Newell E. Quinton
>
> Chief Information Officer

# \[THIS PAGE LEFT BLANK\]

+-----------------------------------------------------------------------+
| # Appendix A Contingency Planning Team Leaders                        |
+-----------------------------------------------------------------------+

  -----------------------------------------------------------------------
  The maintenance, testing, and execution of the facility contingency
  plan is dependent upon specialized teams and coordinators. The facility
  director must appoint the coordinators, team leaders and alternate team
  leaders that are listed below. Reference your facility\'s Contingency
  Plan (dispatched via USB Letter 20-95-16) for the responsibilities of
  these positions. The same person may serve as the team leader for one
  or more teams depending on the size of the station and other
  circumstances.

  -----------------------------------------------------------------------

  ----- -----------------------------------------------------------------
        Contingency Planning Coordinator (Facility ISO recommended)

        Information Systems Operations Coordinator (SSC Manager or ARM
        recommended)

        Logistics Coordinator

        Transportation Coordinator

        Communications Coordinator

        Administrative Coordinator

        Security Coordinator (Facility ISO recommended)

        Failure Assessment Team Leader and Alternate

        Backup Activation Team Leader and Alternate

        Backup Operations Team Leader and Alternate

        Restoration Team Leader and Alternate

        Primary Site Activation Team Leader and Alternate

        Primary Site Operations Team Leader and Alternate
  ----- -----------------------------------------------------------------

+-----------------------------------------------------------------------+
| # Appendix B                                                          |
|                                                                       |
| # Contingency Plan Maintenance Index                                  |
+-----------------------------------------------------------------------+

  -----------------------------------------------------------------------
  The facility\'s director ensures that the Contingency Plan is
  maintained. The facility\'s Contingency Planning Coordinator is
  personally responsible for maintaining Section 7, Maintenance of
  Disaster Recovery Capabilities. The Maintenance Index (Appendix 7A)
  located in Section 7 identifies the Contingency Plan Sections that must
  be maintained. The Index must contain the names of the individuals who
  are responsible for the update and maintenance of the Contingency Plan
  Sections shown below.

  -----------------------------------------------------------------------

  ----------- --------------------------- --------------------------------
  **Section   **Section Title**           **Responsible Individual**
  \#**                                    

  1           Overview                    *Insert Name*

  2           Emergency Response          *Insert Name*

  3           Failure Assessment          *Insert Name*

  4           Control Center              *Insert Name*

  5           Backup Operations           *Insert Name*

  6           Restoration and Operations  *Insert Name*

  7           Maintenance and Disaster    *Insert Name of Contingency
              Recovery Capabilities       Planning Coordinator*
  ----------- --------------------------- --------------------------------

+-----------------------------------------------------------------------+
| # Appendix C Facility Contingency Plan Standards                      |
+-----------------------------------------------------------------------+

  -----------------------------------------------------------------------
  Facility Contingency Plans shall comply with the standards listed
  below.

  -----------------------------------------------------------------------

Standards applicable to all VBA facilities

> A facility\'s Contingency Plan must contain the following sections:
>
> 1\. Overview
>
> 2\. Emergency Response
>
> 3\. Failure Assessment
>
> 4\. Control Center
>
> 5\. Backup Operations
>
> 6\. Restoration Operations
>
> 7\. Maintenance of Disaster Recovery Capabilities
>
> Reference your facility\'s Contingency Plan (dispatched via USB Letter
> 20-95-16*)* for the required content of these sections.

Standards for Mainframes

> Backup Operations
>
> ® The Philadelphia BDC shall be the Backup Operations Site for the
> Hines BDC.
>
> ® The Hines BDC shall be the Backup Operations Site for the
> Philadelphia BDC.

Standards for Sequent Processors

> Backup Operations
>
> ® The Hines BDC Test/Contingency Processor is the backup operations
> processor for all Sequent processors in the VBA distributed computing
> environment. The use of the Hines BDC Test/Contingency Processor as
> the backup processor is documented in the *VBA Sequent Processor
> Backup Operations Plan*. Thus, regional offices do not need to develop
> Sequent Processor backup operations plans. The Hines BDC is
> responsible for maintaining the *VBA Sequent Processor Backup
> Operations Plan*.
>
> Storage Location for Sequent Backup Media
>
> ® Local procedures must provide for the regular backup of the Sequent
> processor\'s files. A full image backup is to be performed each
> business day and the backup media is to be stored expeditiously off
> site. The storage location must be at least one mile from the
> facility. The distance of the storage location from the facility is
> dependent on local hazards such as earthquakes and in some cases
> should be more than one mile. A facility shall ship the backup media
> for its weekly Sequent processor(s) full image backup to the Hines
> BDC. The Hines BDC is responsible for appropriately storing and
> returning backup media to the sending facility.

Standards for the Local Area Networks (workstations, LAN, routers,
servers)

> Backup Operations
>
> ® VBA policy does not require a backup site for the facility LAN
> configuration. VBA\'s disaster recovery strategy is the rapid
> deployment and installation of critical components that would be
> required to restore a facility\'s operation.
>
> Storage Location for LAN Configuration Backup Media
>
> ® Local procedures must provide for the regular backup of the LAN
> server files. The LAN configuration backup media should be
> expeditiously stowed off site to prevent the loss of any data should
> the site be totally destroyed. The storage location must be at least
> one mile from the facility. The distance of the storage location from
> the facility is dependent on local hazards such as earthquakes.