Since disasters happen so rarely, management often ignores the disaster recovery planning process. It is essential to realize that having a contingency plan in the event of a disaster gives eCuras a competitive advantage. This policy requires management to financially support and diligently attend to disaster contingency planning efforts. Disasters are not limited to adverse weather conditions. Any event that could likely cause an extended delay of service should be considered. The Disaster Recovery Plan is often part of the Business Continuity Plan.
This policy defines the requirement for a baseline disaster recovery plan to be developed and implemented by eCuras that will describe the process to recover IT Systems, Applications, and Data from any type of disaster that causes a significant outage.
This policy is directed to the IT Management Staff who is accountable to ensure the plan is developed, tested, and kept up-to-date. This policy is solely to state the requirement to have a disaster recovery plan. It does not provide requirements around what goes into the plan or sub-plans.
4.1 Contingency Plans
The following contingency plans must be created:
- Computer Emergency Response Plan: Who is to be contacted, when, and how? What immediate actions must be taken in the event of certain occurrences?
- Succession Plan: Describe the flow of responsibility when normal staff is unavailable to perform their duties.
- Data Study: Detail the data stored on the systems, its criticality, and its confidentiality.
- Criticality of Service List: List all the services provided and their order of importance.
- It also explains the order of recovery in both short-term and long-term timeframes.
- Data Backup and Restoration Plan: Detail which data is backed up, the media to which it is saved, where that media is stored, and how often the backup is done. It should also describe how that data could be recovered.
- Equipment Replacement Plan: Describe what equipment is required to begin to provide services, list the order in which it is necessary, and note where to purchase the equipment.
- Mass Media Management: Who is in charge of giving information to the mass media?
- Also provide some guidelines on what data is appropriate to be provided.
- After creating the plans, it is essential to practice them to the extent possible. Management should set aside time to test the implementation of the disaster recovery plan. Tabletop exercises should be conducted annually. During these tests, issues that may cause the plan to fail can be discovered and corrected in an environment with few consequences.
The plan, at a minimum, should be reviewed and updated on an annual basis.
5. Policy Compliance
5.1 Compliance Measurement
The Infosec team will verify compliance with this policy through various methods, including but not limited to periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner.
The Infosec Team must approve any exception to the policy in advance.
An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
Revised: March 14th, 2018
Table of Content
- Acceptable Encryption Policy
- Acceptable Use Policy
- Clean Desc Policy
- Data Breach Response Policy
- Disaster Recovery Plan Policy
- Digital Signature Acceptance Policy
- Email Policy
- Ethics Policy
- Pandemic Response Planning Policy
- Password Construction Guidelines
- Password Protection Policy
- Security Response Plan Policy
- End User Encryption Key Protection Policy
- Acquisition Assessment Policy
- Bluetooth Baseline Requirements Policy
- Remote Access Policy
- Remote Access Tools Policy
- Router and Switch Security Policy
- Wireless Communication Policy
- Wireless Communication Standard
- Database Credentials Policy
- Technology Equipment Disposal Policy
- Information Logging Standard
- Lab Security Policy
- Server Security Policy
- Software Installation Policy
- Workstation Security (For HIPAA) Policy
- Web Application Security Policy
- Analog/ISDN Line Security Policy
- Anti-Virus Guidelines
- Server Audit Policy
- Automatically Forwarded Email Policy
- Communications Equipment Policy
- Dial In Access Policy
- Extranet Policy
- Internet DMZ Equipment Policy
- Internet Usage Policy
- Mobile Device Encryption Policy
- Personal Communication Devices and Voicemail Policy
- Removable Media Policy
- Risk Assessment Policy
- Server Malware Protection Policy
- Social Engineering Awareness Policy
- DMZ Lab Security Policy
- Email Retention Policy
- Employee Internet Use Monitoring and Filtering Policy
- Lab Anti Virus Policy
- Mobile Employee Endpoint Responsibility Policy
- Remote Access Mobile Computing Storage
- Virtual Private Network Policy