**Centers for Disease Control and Prevention**

**Business Continuity Plan (BCP)**

**Format Guide**

![](media/image1.png){width="2.4743055555555555in"
height="1.0104166666666667in"}

Submitted to Tom Madden, CISO

DHHS/CDC/CIO/OCISO

4770 Buford Highway K-81

Atlanta, GA 30329

Submitted: August 23, 2004

[]{#__RefHeading___Toc80761977 .anchor}TABLE OF CONTENTS

**TABLE OF CONTENTS [i](#__RefHeading___Toc80761977)**

**PREFACE [iii](#__RefHeading___Toc80761978)**

**DOCUMENT CHANGE HISTORY [iv](#__RefHeading___Toc80761979)**

**1 INTRODUCTION [1-1](#introduction)**

1.1 Purpose [1-1](#purpose)

1.2 Applicability [1-1](#applicability)

1.3 Scope [1-2](#scope)

1.3.1 Planning Principles [1-2](#planning-principles)

1.3.2 Assumptions [1-2](#assumptions)

1.4 References/Requirements [1-3](#referencesrequirements)

**2 CONCEPT OF OPERATIONS 2-1**

2.1 System Description and Architecture 2-1

2.2 Line of Succession 2-1

2.3 Responsibilities 2-1

**3 NOTIFICATION AND ACTIVATION PHASE
[3-1](#notification-and-activation-phase)**

3.1 Notification/Activation Phase [3-1](#notificationactivation-phase)

3.2 Notification Procedures [3-1](#notification-procedures)

3.3 Damage Assessment Procedures [3-1](#damage-assessment-procedures)

3.4 Alternate Assessment Procedures
[3-2](#alternate-assessment-procedures)

3.4.1 DAT Leader [3-2](#dat-leader)

3.4.2 DAT [3-2](#dat)

3.5 Plan Activation [3-2](#plan-activation)

3.6 BCP Coordinator [3-2](#bcp-coordinator)

**4 RECOVERY PHASE [4-1](#recovery-phase)**

4.1 Recovery Goal [4-1](#recovery-goal)

4.1.1 {team name} [4-1](#team-name)

4.1.2 {team name} [4-1](#team-name-1)

4.1.3 {team name} [4-1](#team-name-2)

4.2 Recovery Goal [4-1](#recovery-goal-1)

4.2.1 {team name} [4-1](#team-name-3)

4.2.2 {team name} [4-1](#team-name-4)

4.2.3 {team name} [4-1](#team-name-5)

4.3 Recovery Goal [4-2](#recovery-goal-2)

**5 RECONSTITUTION PHASE (Return to Normal Operations)
[5-1](#reconstitution-phase-return-to-normal-operations)**

5.1 Original or New Site Restoration
[5-1](#original-or-new-site-restoration)

5.1.1 {team name} [5-1](#team-name-6)

5.1.2 {team name} [5-1](#team-name-7)

5.2 Concurrent Processing [5-1](#concurrent-processing)

5.2.1 {team name} [5-1](#team-name-8)

5.2.2 {team name} [5-1](#team-name-9)

5.3 Plan Deactivation [5-1](#plan-deactivation)

5.3.1 {team name} [5-2](#team-name-10)

5.3.2 {team name} [5-2](#team-name-11)

**6 PLAN TRAINING, TESTING, AND EXERCISES
[6-1](#plan-training-testing-and-exercises)**

**7 PLAN MAINTENANCE [7-1](#plan-maintenance)**

**8 PLAN APPENDICES [8-1](#plan-appendices)**

> Appendix XX -- Acronyms
> \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\--
> 8-2
>
> Appendix XX - Management Notification Checklist
> \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\--
> 8-3
>
> Appendix XX -- Recovery Teams Diagram
> \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\--
> 8-4
>
> Appendix XX - Recovery Teams Notification Checklist
> \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-- 8-5
>
> Appendix XX -- Recovery Team Call Tree
> \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\--
> 8-6
>
> Appendix XX -- Key Customers Call Tree
> \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\--
> 8-7
>
> Appendix XX -- Critical Vendors Call Tree
> \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\--
> 8-8
>
> Appendix XX -- Personnel Location Control Form
> \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\--
> 8-9
>
> Appendix XX -- Driving Directions to Staging Area
> \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\--
> 8-10

[]{#__RefHeading___Toc80761978 .anchor}PREFACE

This document establishes a template for preparing an information
technology (IT) Business Continuity Plan (BCP) for Centers for Disease
Control and Prevention (CDC) Organizations. Where practical, the
template provides instructions for completing specific sections. Text is
added in certain sections; however, this information is intended as a
suggestion of the type of information that may be required. The text is
not comprehensive and should be modified to meet specific
Center/Institute/Office system considerations. If the system to which
this plan applies is subject to enterprise-level plans, they should be
attached as appendices to the BCP.

As the CDC Information Security Program develops, this document will be
subject to review and revision, which will occur annually or when
changes dictate the need to revise the *CDC Business Continuity Plan
Format Guide*. These changes may include the following:

-   changes in roles and responsibilities

-   release of new executive, legislative, technical, or Departmental
    guidance

-   identification of changes governing policies

-   Inspector General findings that stem from a security audit.

The CDC Chief Information Security Officer (CISO) must approve all
revisions to the *CDC Business Continuity Plan Format Guide*. Revisions
are to be highlighted in the Document Change History table. When it is
approved, a new version of the *CDC Business Continuity Plan Format
Guide* will be issued, and all affected parties will be informed of the
changes made.

Use of this document in the construction of the BCP is voluntary but
highly recommended as it contains best practices for developing IT
Business Continuity Plans.

Ensure the BCP is marked with the appropriate security label (e.g.,
Sensitive -- For Official Use Only).

[]{#__RefHeading___Toc80761979 .anchor}DOCUMENT CHANGE HISTORY

Modifications made to this plan since the last printing are as follows:

*(example only)*

  ------------ ----------- ----------------------------- -------------- -----------
  **DOCUMENT                                                            
  CHANGE                                                                
  HISTORY**                                                             

  **Plan       **Release   **Summary of Changes**        **Section No./ **Changes
  Version      Date**                                    Paragraph      Made By**
  No.**                                                  No.**          

  1.0          8.23.04     Final Document Release with   Entire         CDC OCISO
                           Content Changes               Document       

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        

                                                                        
  ------------ ----------- ----------------------------- -------------- -----------

**Note: Place this table in the beginning of the document, after the
Preface**

# Introduction

## Purpose

The {*[system name]{.underline}*} Business Continuity Plan (BCP)
establishes procedures to recover the {*[system name]{.underline}*}
following a disruption. The following objectives have been established
for this plan:

-   Maximize the effectiveness of contingency operations through an
    established plan that consists of the following phases:

    -   ***Notification/Activation phase*** to detect and assess damage
        and activate the plan.

    -   ***Recovery phase*** to restore temporary IT operations and
        recover damage done to the original system.

    -   ***Reconstitution phase*** to restore IT system processing
        capabilities to normal operations.

```{=html}
<!-- -->
```
-   Identify the activities, resources, and procedures needed to carry
    out {*[system name]{.underline}*} processing requirements during
    prolonged interruptions to normal operations.

-   Assign responsibilities to designated CDC personnel and provide
    guidance for recovering {*[system name]{.underline}}* during
    prolonged periods of interruption to normal operations.

-   Ensure coordination with other CDC staff who will participate in the
    contingency planning strategies. Ensure coordination with external
    points of contact and vendors who will participate in the
    contingency planning strategies.

## Applicability

The {*[system name]{.underline}}* BCP applies to the functions,
operations, and resources necessary to restore and resume CDC*'s*
{*[system name]{.underline}}* operations as it is installed at {*primary
location name, City, State}*. The {*[system name]{.underline}}* BCP
applies to CDC and all other persons associated with *{[system
name]{.underline}}* as identified in Section 2.3, Responsibilities.

The *{**[system name]{.underline}}* BCP is supported by {*[system name
Continuity of Operations Plan (COOP)]{.underline}},* which provides the
{*[purpose of plan -- "procedures and capabilities to sustain the
organization's essential, strategic functions at an alternate site for
up to 30 days]{.underline}."}.*

Procedures outlined in this plan are coordinated with and support the
{*[system name Disaster Recovery Plan (DRP)]{.underline}}*, which
provides {*[purpose of plan -- "detailed procedures to facilitate
recovery of capabilities at an alternate site."]{.underline}}.*

## Scope 

### Planning Principles 

Various scenarios were considered to form a basis for the plan, and
multiple assumptions were made. The applicability of the plan is
predicated on two key principles:

-   The CDC*'s* facility in {*City, State},* is inaccessible; therefore,
    CDC is unable to perform {*[system name]{.underline}*} processing
    for the {*Organization}*.

```{=html}
<!-- -->
```
-   A valid contract exists with the {*[alternate site]{.underline}}*
    that designates that site in {*[City, State]{.underline}}*, as the
    CDC'*s* alternate operating facility.

    -   CDC will use the {*[alternate site]{.underline}}* building and
        IT resources to recover {*[system name]{.underline}}*
        functionality during an emergency situation that prevents access
        to the {*[original facility]{.underline}}*.

    -   The designated computer system at the {*[alternate
        site]{.underline}}* has been configured to begin processing
        {*[system name]{.underline}}* information.

    -   The {*[alternate site]{.underline}}* will be used to continue
        {*[system name]{.underline}}* recovery and processing throughout
        the period of disruption, until the return to normal operations.

### Assumptions 

Based on these principles, the following assumptions were used when
developing the {*[system name]{.underline}*} BCP:

-   The {*[system name]{.underline}}* is inoperable at the CDC computer
    center and cannot be recovered within {*[time period]{.underline},
    e.g., 48 hours}.*

-   Key {*[system name]{.underline}}* personnel have been identified and
    trained in their emergency response and recovery roles; they are
    available to activate the {*[system name]{.underline}}* BCP.

-   Preventive controls (e.g., generators, environmental controls,
    waterproof tarps, sprinkler systems, fire extinguishers, and fire
    department assistance) are fully operational at the time of the
    disaster.

-   Computer center equipment, including components supporting {*[system
    name}]{.underline}*, are connected to an uninterruptible power
    supply (UPS) that provides {*[time period, e.g., 45 minutes to 1
    hour]{.underline}}* of electricity during a power failure.

-   {*[system name]{.underline}}* hardware and software at the CDC
    *{[original site]{.underline}}* are unavailable for at least *{[time
    period]{.underline}, e.g., 48 hours}.*

-   Current backups of the application software and data are intact and
    available at the {*[offsite storage facility]{.underline}}.*

-   The equipment, connections, and capabilities required to operate
    {*[system name]{.underline}}* are available at the {*[alternate
    site]{.underline}}* in {*[City, State]{.underline}}.*

-   Service agreements are maintained with {*[system name}]{.underline}*
    hardware, software, and communications providers to support the
    emergency {*[system name]{.underline}}* recovery.

The {*[system name]{.underline}}* BCP does not apply to the following
situations:

-   **Overall recovery and continuity of business operations.** The CDC
    Facility Continuity of Operations Plan (COOP) may be included as an
    Attachment to the plan.

-   **Emergency evacuation of personnel.** The Occupant Emergency Plan
    (OEP) may be included as an Attachment to the plan.

-   **Disaster recovery.** The Disaster Recovery Plan (DRP) may be
    included as an Attachment to the plan.

-   **Business resumption.** The Business Resumption Plan (BRP) may be
    included as an Attachment to the Plan.

-   **Single point failure.** Adequate redundancy exists within the
    {*[system name]{.underline}*} so that a minor disruption (i.e., disk
    drive failure, short-term power outage) that does not require
    relocation will not activate the plan.

-   *{[Any additional constraints should be added to this
    list]{.underline}}.*

## References/Requirements 

The {*[system name]{.underline}}* BCP complies with the CDC's IT
contingency planning policy as follows:

*{[The organization shall develop a contingency planning capability to
meet the needs of critical supporting operations in the event of a
disruption extending beyond 72 hours. The procedures for execution of
such a capability shall be documented in a formal BCP and shall be
reviewed at least annually and updated as necessary. Personnel
responsible for target systems shall be trained to execute contingency
procedures. The plan, recovery capabilities, and personnel shall be
tested to identify weaknesses of the capability at least
annually]{.underline}.}*

The {*[system name]{.underline}}* BCP also complies with the following
federal and departmental policies:

-   The Computer Security Act of 1987

-   Office of Management and Budget (OMB) Circular A-130, *Management of
    Federal Information Resources*, Appendix III, November 2000

-   Federal Preparedness Circular (FPC) 65, *Federal Executive Branch
    Continuity of Operations*, July 26, 1999

-   FPC 66, Test, Training, and Exercise (TT&E) Program and COOP, April
    30, 2001

-   FPC 67, Acquisition for Alternate Facilities for COOP, April 30,
    2001

-   FPC 60, Continuity of the Executive Branch of the Federal Government
    at the Headquarters Level During National Security Emergencies,
    November 20, 1990

-   Executive Order (EO) 12656, *Assignment of Emergency Preparedness
    Responsibilities*, November 18, 1988, as amended

-   EO 12148, *Federal Emergency Management*, July 20, 1979, as amended

-   Presidential Decision Directive (PDD) 63, *Critical Infrastructure
    Protection*, May 1998

-   Presidential Decision Directive (PDD) 67, Enduring Constitutional
    Government and Continuity of Government Operations, October 21, 1998

-   National Institute of Standards and Technology Special Publication
    (NIST SP) 800-34, *Contingency Planning Guide for Information
    Technology Systems,* June 2002

-   Department of Health and Human Services (HHS), *Contingency Planning
    for Information Security Guide - 2004-06*, July 23, 2004

-   Federal Emergency Management Agency (FEMA), *The Federal Response
    Plan (FRP),* April 1999

-   41 Code of Federal Regulations (CFR) 101-2, *Occupant Emergency
    Program*, July 1, 1998

-   36 CFR, 1236, *Management of Vital Records*, July 1, 1998

-   {Include any other applicable federal policies}

-   {Include any other applicable departmental policies}

# CONCEPT OF OPERATIONS

## System Description and Architecture 

*{[Provide a general description of system architecture and
functionality. Indicate the operating environment, physical location,
general location of users, and partnerships with external
organizations/systems. Include information regarding any other technical
considerations that are important for recovery purposes, such as backup
procedures. Provide a diagram of the architecture, including security
controls and telecommunications connections]{.underline}.}*

## Line of Succession 

The CDC sets forth an order of succession, in coordination with the
order set forth by the {*Organization}* to ensure that decision-making
authority for the {*[system name]{.underline}*} BCP is uninterrupted.
The Chief Information Officer (CIO) of CDC is responsible for ensuring
the execution of procedures documented within the {*[system
name]{.underline}*} BCP. If the CIO is unable to function as the overall
authority, he may choose to delegate this responsibility to a successor,
who shall function as that authority. {*[Continue description of
succession as applicable]{.underline}}.*

## Responsibilities 

The following teams have been developed and trained to respond to a
contingency event affecting the IT system.

The BCP establishes several teams assigned to participate in recovering
*[{system name]{.underline}}* operations. The *[{team
name]{.underline}}* is responsible for recovery of the *{[system
name]{.underline}}* computer environment and all applications. Members
of the {*[team name]{.underline}}* include personnel who are also
responsible for the daily operations and maintenance of *{[system
name]{.underline}}*. The {*[team leader title]{.underline}}* directs the
*{[team name]{.underline}}.*

*{[Continue to describe each team, their responsibilities, leadership,
and coordination with other applicable teams during a recovery
operation]{.underline}.}*

The relationships of the team leaders involved in {*[system
name]{.underline}}* recovery and their member teams are illustrated in
Appendix {[XX]{.underline}}.

*{[Insert hierarchical diagram of recovery teams. Show team names and
leaders; do not include actual names of personnel]{.underline}}*

*{[Describe each team separately, highlighting overall recovery goals
and specific responsibilities. Do not detail the procedures that will be
used to execute these responsibilities. These procedures will be
itemized in the appropriate phase sections]{.underline}.}*

# NOTIFICATION AND ACTIVATION PHASE 

**In an emergency, the CDC*'s* top priority is to preserve the health
and safety of its staff before proceeding to the Notification and
Activation procedures.**

## Notification/Activation Phase

The Notification/Activation Phase defines the initial actions taken once
a system disruption or emergency has been detected or appears imminent.
This phase includes processes to notify recovery personnel, assess
damage, and implement the {s*[ystem name]{.underline}*} BCP.
Pre-designated CDC staff has been assigned Call Tree notification. The
CDC BCP Call Tree is located in Appendix {[XX]{.underline}}.

## Notification Procedures

An emergency event may occur with or without prior warning. The
notification process will be the same in either case. The manner in
which personnel are notified depends on the type of emergency and
whether the emergency occurs during or after normal business hours.
Notification during normal business hours will be accomplished by phone,
e-mail, word of mouth, cell phone, or pager. Notification after normal
business hours will be conducted by activating the CDC Call Tree.

-   The first responder is to notify the BCP Coordinator. All known
    information must be relayed to the BCP Coordinator.

-   The BCP Coordinator is to contact the Damage Assessment Team (DAT)
    Leader and inform them of the event. The BCP Coordinator is to
    instruct the DAT Leader to begin assessment procedures.

-   The DAT Leader is to notify team members and direct them to complete
    the assessment procedures outlined in Section 3.3 to determine the
    extent of damage and estimated recovery time. If a damage assessment
    cannot be performed locally because of unsafe conditions, the DAT is
    to follow the outline in Section 3.4.

## Damage Assessment Procedures

*{[Detailed procedures should be outlined to include activities to
determine the cause of the disruption; potential for additional
disruption or damage; affected physical area and status of physical
infrastructure; status of IT equipment functionality and inventory,
including items that will need to be replaced; and estimated time to
repair services to normal operations]{.underline}.}*

The CDC BCP will be implemented following an emergency event based on
the damage assessment performed by the DAT. It is imperative that the
nature of the emergency and the extent of the damage be assessed as
quickly as conditions allow. The CDC DAT will work closely with the
Information Technology Services Office (ITSO) DAT Leader during the
damage assessment. The CDC DAT will address the following concerns:

-   Determine the cause of the emergency;

-   Determine the area(s) affected;

-   Determine stability of the area;

-   Determine the status of the physical infrastructure;

-   Determine inventory and functional status of equipment;

-   Determine type of damage to equipment (e.g., water, fire and heat);

-   Determine items to be replaced;

-   Estimate recovery time; and

-   Report findings to the BCP Coordinator.

## Alternate Assessment Procedures

### DAT Leader

Upon notification from the BCP Coordinator, the DAT Leader is to:

-   *{[Include steps]{.underline}*}

### DAT

Upon notification from the DAT Leader, the DAT is to:

-   *{[Include steps]{.underline}*}

## Plan Activation

The BCP will only be instituted when one or more of the following
activation criteria have been met:

-   Safety of personnel is at stake;

```{=html}
<!-- -->
```
-   Severe damage to the facility precludes further operation;

-   {*[System name]{.underline}*} will be unavailable for more than
    *{[time period]{.underline}, e.g., 48 hours}*; or

-   Extent of damage to systems (physical, operational or cost)
    precludes continued operations.

## BCP Coordinator

Once the damage has been assessed, the BCP Coordinator will select the
appropriate strategy and begin the recovery process:

-   If the plan is activated, the BCP Coordinator will notify all Team
    Leaders, and provide details of the event, and state whether
    relocation is required.

-   Upon notification from the BCP Coordinator, Team Leaders will notify
    their respective teams. Team members are to be informed of all
    applicable information and prepared to respond and relocate if
    necessary.

-   The BCP Coordinator will notify the off-site storage facility that a
    contingency event has been declared and to ship the necessary
    materials (as determined by damage assessment) to the Alternate
    Site.

-   The BCP Coordinator will notify the Alternate Site that a
    contingency event has been declared and to prepare the facility for
    the Organization's arrival.

-   The BCP Coordinator will notify remaining personnel (via
    notification procedures) on the general status of the incident.

-   The BCP Coordinator will receive the completed Personnel Location
    Control Form, located in Appendix {[XX]{.underline}}, from Team
    Leaders on a daily basis.

# RECOVERY Phase 

This section provides procedures for recovering the application at the
Alternate Site, whereas reconstitution efforts are directed to repair
damage to the original system and capabilities.

The following procedures are for recovering the {*[system
name]{.underline}}* at the {*[alternate site]{.underline}}.* Procedures
are outlined per team required. Each procedure should be executed in the
sequence it is presented in order to maintain efficient operations.

## Recovery Goal

State the first recovery objective as determined by the Business Impact
Assessment (BIA). For each team responsible for executing a function to
meet this objective, state the team names and list their respective
procedures.

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

## Recovery Goal

State the second recovery objective as determined by the BIA. For each
team responsible for executing a function to meet this objective, state
the team names and list their respective procedures.

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

## Recovery Goal

State the remaining recovery objectives (as determined by the BIA). For
each team responsible for executing a function to meet this objective,
state the team names and list their respective procedures.

# Reconstitution Phase (Return to Normal Operations) 

This section discusses activities necessary for restoring {*[system
name]{.underline}}* operations at the CDC's original or new site. When
the computer center at the original or new site has been restored,
{*[system name]{.underline}}* operations at the {*[alternate
site]{.underline}}* must be transitioned back. The goal is to provide a
seamless transition of operations from the {*[alternate
site]{.underline}}* to the computer center.

## Original or New Site Restoration 

*{[Procedures should be outlined, per necessary team, to restore or
replace the original site so that normal operations may be transferred.
IT equipment and telecommunications connections should be
tested]{.underline}.}*

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

## Concurrent Processing 

*{[Procedures should be outlined, per necessary team, to operate the
contingency system in coordination with the system at the original or
new site. These procedures should include testing the original or new
system until it is functioning properly and the contingency system is
shut down gracefully]{.underline}.}*

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

## Plan Deactivation 

*{[Procedures should be outlined, per necessary team, to clean the
alternate site of any equipment or other materials belonging to the
organization, with a focus on handling sensitive information. Materials,
equipment, and backup media should be properly packaged, labeled, and
shipped to the appropriate location(s).Team members should be instructed
to return to the original or new site]{.underline}.}*

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

### {team name} 

*{[Team Recovery Procedures]{.underline}}*

# PLAN TRAINING, TESTING, AND EXERCISES

Training CDC recovery team personnel is an integral component of the BCP
process. Training should be conducted at least annually; new hires who
will have plan responsibilities should receive training shortly after
they are hired. The goal of training is to ensure that recovery team
personnel are able to execute their respective recovery process in the
event paper or electronic copies of the BCP are not available.

Testing the BCP is another critical element of the contingency process.
Testing will identify any deficiencies in the BCP in addition to
evaluating the ability of recovery team personnel to implement it.

Conducting an exercise[^1] is a culmination of training and testing of
the BCP and must occur, at a minimum, on an annual basis. The BCP
Coordinator is responsible for training recovery personnel and testing
and exercising the plan.

# Plan Maintenance

The BCP Coordinator is responsible for ensuring that the plan is
reviewed and updated at least annually. The BCP cannot be an effective
recovery tool if it is not maintained in a ready state. Based on the
results of training, testing, and exercising the plan, the BCP will most
likely need to be revised to reflect lessons learned. The plan should be
scheduled for review/revision during the same time frame as the
training, testing, and exercising of the BCP.

A Document Change History is located in the front of this document and
will be used to document reviews and revisions. The BCP Coordinator must
ensure that recovery team members receive changes to the document and
that off-site copies are updated as well. The BCP Coordinator should
develop a Distribution List (include as an Attachment to the BCP),
listing number of copies of plans and locations, to ensure all copies of
the BCP (and attached plans) can be accounted for and updated as
required.

# PLAN APPENDICES 

*{[The appendices included should be based on system and plan
requirements]{.underline}.}*

-   Acronym List (sample included)

-   Management Notification Checklist (sample included)

-   Recovery Teams Diagram (sample included)

-   Recovery Teams Notification Checklist (sample included)

-   Recovery Team Call Tree (sample included)

-   Key Customers Call Tree (sample included)

-   Critical Vendors Call Tree (sample included)

-   Personnel Location Control Form (sample included)

-   Driving Directions to Staging Area

-   Equipment and Specifications

-   Service Level Agreements and Memorandums of Understanding

-   IT Standard Operating Procedures

-   Business Impact Analysis (Still in Draft form)

-   Related BCPs

-   Emergency Management Plan

-   Occupant Emergency Plan

-   CDC Continuity of Operations Plan.

-   {[System Name]{.underline}} Disaster Recovery Plan

**APPENDIX XX**

**ACRONYMS**

  -----------------------------------------------------------------------
  **Acronym**   **Definition**
  ------------- ---------------------------------------------------------
                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                

                
  -----------------------------------------------------------------------

+-----------------------------------------------------------------------+
| **APPENDIX XX**                                                       |
|                                                                       |
| **MANAGEMENT NOTIFICATION CHECKLIST**                                 |
+-----------------------------------------------------------------------+
| This checklist will be used by the BCP Coordinator when notifying the |
| Management Team and by the Management Team when notifying Recovery    |
| Team Leaders.                                                         |
+-----------------------------------------------------------------------+
|                                                                       |
+-----------------------------------------------------------------------+
| 1.  **Obtain initial damage assessment from Damage Assessment Team    |
|     Leader and relay information to appropriate recovery team         |
|     personnel.**                                                      |
+-----------------------------------------------------------------------+
| 2.  **Provide information on the staging area (e.g., time and place   |
|     to report):**                                                     |
+-----------------------------------------------------------------------+
| 3.  **Primary phone number for the Management Team:**                 |
+-----------------------------------------------------------------------+
| 4.  **Provide information on the condition of the CDC Headquarters    |
|     building/Computer Center (e.g., habitable, inhabitable):**        |
+-----------------------------------------------------------------------+
|                                                                       |
+-----------------------------------------------------------------------+

**APPENDIX XX**

**RECOVERY TEAMS DIAGRAM**

When notified by the Management Team that the BCP has been activated,
the Management Team will ensure the appropriate Recovery Teams are
notified and Recovery Team Leaders apprised of the situation (*not all
teams may be required for all events)*.

![](media/image2.wmf)

+-----------------------------------------------------------------------+
| **APPENDIX XX**                                                       |
|                                                                       |
| **RECOVERY TEAMS NOTIFICATION CHECKLIST**                             |
+-----------------------------------------------------------------------+
| When notified by the Management Team that the BCP has been activated, |
| the Recovery Team Leader will ensure they receive the following       |
| information and relay this information to the Recovery Team Members:  |
+-----------------------------------------------------------------------+
|                                                                       |
+-----------------------------------------------------------------------+
| 1.  **Obtain a brief description of the emergency:**                  |
+-----------------------------------------------------------------------+
| 2.  **Location of the staging area:**                                 |
+-----------------------------------------------------------------------+
| 3.  **Primary phone number for the Management Team:**                 |
+-----------------------------------------------------------------------+
| 4.  **Is the CDC Headquarters building/Computer Center                |
|     inhabitable/uninhabitable?**                                      |
+-----------------------------------------------------------------------+

**APPENDIX XX**

*{[SYSTEM NAME]{.underline}} {[Recovery Team NAME]{.underline}}* **CALL
TREE**

  -------------------------------------------------------------------------
  **PRIMARY**                                                 
  --------------- ---------- ---------- ---------- ---------- -------------
  **NAME**        **WORK     **HOME     **CELL /   **TIME     **CONTACTED
                  PHONE**    PHONE**    PAGER**    CALLED**   yES/NO**

                                                              

                                                              

                                                              

                                                              

                                                              

                                                              

                                                              

                                                              

                                                              

  **aLTERNATE**                                               

  **NAME**        **WORK     **HOME     **CELL /   **TIME     **CONTACTED
                  PHONE**    PHONE**    PAGER**    CALLED**   yES/NO**

                                                              

                                                              

                                                              

                                                              

                                                              

                                                              

                                                              

                                                              

                                                              
  -------------------------------------------------------------------------

+-----------------------------------------+----------------------------+
| **APPENDIX XX**                         |                            |
|                                         |                            |
| **KEY CUSTOMERS CALL TREE**             |                            |
+-----------------------------------------+----------------------------+
|                                         |                            |
+-----------------------------------------+----------------------------+
|                                         |                            |
+-----------------------------------------+----------------------------+
| Product/Service:                        |                            |
+-----------------------------------------+----------------------------+
| Customer Name:                          |                            |
+-----------------------------------------+----------------------------+
| Customer Address:                       |                            |
+-----------------------------------------+----------------------------+
| Contact Person:                         | Phone No.:\                |
|                                         | 24 Hour No.:\              |
|                                         | FAX No.:\                  |
|                                         | Other No.:                 |
+-----------------------------------------+----------------------------+
| Alternate Contact:                      |                            |
+-----------------------------------------+----------------------------+
| Comments:                               |                            |
+-----------------------------------------+----------------------------+
|                                         |                            |
+-----------------------------------------+----------------------------+
| Product/Service:                        |                            |
+-----------------------------------------+----------------------------+
| Customer Name:                          |                            |
+-----------------------------------------+----------------------------+
| Customer Address:                       |                            |
+-----------------------------------------+----------------------------+
| Contact Person:                         | Phone No.:\                |
|                                         | 24 Hour No.:\              |
|                                         | FAX No.:\                  |
|                                         | Other No.:                 |
+-----------------------------------------+----------------------------+
| Alternate Contact:                      |                            |
+-----------------------------------------+----------------------------+
| Comments:                               |                            |
+-----------------------------------------+----------------------------+
|                                         |                            |
+-----------------------------------------+----------------------------+

+-----------------------------------------+----------------------------+
| **APPENDIX XX\                          |                            |
| **                                      |                            |
|                                         |                            |
| **CRITICAL VENDORS CALL TREE**          |                            |
+-----------------------------------------+----------------------------+
|                                         |                            |
+-----------------------------------------+----------------------------+
|                                         |                            |
+-----------------------------------------+----------------------------+
| Product/Service:                        |                            |
+-----------------------------------------+----------------------------+
| Vendor Name:                            |                            |
+-----------------------------------------+----------------------------+
| Vendor Address:                         |                            |
+-----------------------------------------+----------------------------+
| Contact Person:                         | Phone No.:\                |
|                                         | 24 Hour No.:\              |
|                                         | FAX No.:\                  |
|                                         | Other No.:                 |
+-----------------------------------------+----------------------------+
| Alternate Contact:                      |                            |
+-----------------------------------------+----------------------------+
| Comments:                               |                            |
+-----------------------------------------+----------------------------+
|                                         |                            |
+-----------------------------------------+----------------------------+
| Product/Service:                        |                            |
+-----------------------------------------+----------------------------+
| Vendor Name:                            |                            |
+-----------------------------------------+----------------------------+
| Vendor Address:                         |                            |
+-----------------------------------------+----------------------------+
| Contact Person:                         | Phone No.:\                |
|                                         | 24 Hour No.:\              |
|                                         | FAX No.:\                  |
|                                         | Other No.:                 |
+-----------------------------------------+----------------------------+
| Alternate Contact:                      |                            |
+-----------------------------------------+----------------------------+
| Comments:                               |                            |
+-----------------------------------------+----------------------------+
|                                         |                            |
+-----------------------------------------+----------------------------+

**APPENDIX XX**

**PERSONNEL LOCATION CONTROL FORM**

Date: Completed by:

**[DAMAGE ASSESSMENT Team]{.underline}**

+--------------------+-------------+----------+-----------+-----------+
| **NAME**           | **RECOVERY  | **PHONE  | **WORK    | **WORK    |
|                    | LOCATION**  | NUMBER** | S         | S         |
|                    |             |          | CHEDULE** | CHEDULE** |
|                    |             |          |           |           |
|                    |             |          | **FROM**  | **TO**    |
+--------------------+-------------+----------+-----------+-----------+
|                    |             |          |           |           |
+--------------------+-------------+----------+-----------+-----------+
|                    |             |          |           |           |
+--------------------+-------------+----------+-----------+-----------+
|                    |             |          |           |           |
+--------------------+-------------+----------+-----------+-----------+
|                    |             |          |           |           |
+--------------------+-------------+----------+-----------+-----------+
|                    |             |          |           |           |
+--------------------+-------------+----------+-----------+-----------+
|                    |             |          |           |           |
+--------------------+-------------+----------+-----------+-----------+
|                    |             |          |           |           |
+--------------------+-------------+----------+-----------+-----------+
|                    |             |          |           |           |
+--------------------+-------------+----------+-----------+-----------+
|                    |             |          |           |           |
+--------------------+-------------+----------+-----------+-----------+

**NOTE: Form must be completed and submitted daily to the BCP
Coordinator**

**APPENDIX XX**

**DRIVING DIRECTIONS TO STAGING AREA**

*(Insert driving directions along with map)*

[^1]: Exercises can be designed for a classroom setting, referred to as
    a *tabletop exercise*, or as a disaster simulation, referred to as a
    *functional exercise*.