Information System Contingency Plan (ISCP)

Approval #

Revision History #

Review cycle: Every year, and after a significant change to the system.

Mandate. National Institute of Standards and Technology (NIST) SP 800-53 CP-2 requires a contingency plan for each system. The plan must address roles, contact information, recovery objectives, restoration priorities, and plan maintenance, consistent with NIST SP 800-34 Rev 1. This template follows the sample plans in Appendix A of SP 800-34 Rev 1. The System Owner and the Information System Security Officer (ISSO) complete this template for each system. The Authorizing Official approves the completed ISCP, and the System Owner exercises it under the Contingency Planning Policy.

Sections and appendices marked (Moderate and High) apply to moderate-impact and high-impact systems. Those marked (High) apply to high-impact systems only. The marks follow the NIST SP 800-53B baselines for the CP controls named in each section. A low-impact system may leave a marked section out.

1. System Identification and Concept of Operations #

1.1 System Identification #

1.2 System Description #

The System Owner describes the system’s purpose, its major components, where it runs, and the people and services that depend on it. The System Owner attaches an architecture diagram as Appendix F, showing the boundary, the components, and the connections to other systems.

[Describe the system]

1.3 Backup Method and Location #

The System Owner records how each kind of data is backed up, how often, and where the copies are kept (CP-9).

(Moderate and High) Backups are kept at the alternate storage site and tested for reliability and integrity (CP-6, CP-9(1)). (High) A copy of critical software and security-related information is kept in a separate facility or fire-rated container (CP-9(3)). Backups are also restored as part of contingency plan testing (CP-9(2)).

1.4 Roles and Teams #

2. Recovery Objectives #

Derived from the Business Impact Analysis (BIA), which the System Owner attaches as Appendix K. The System Owner completes the BIA before this plan and reviews it with the plan.

3. Activation and Notification #

The System Owner or a designee activates the plan when an outage or disruption is expected to last longer than the RTO. The System Owner also activates it at once if the primary processing capability is lost. Notification proceeds per the call tree in Appendix A; activation is reported to the CISO and recorded in the information technology service management (ITSM) platform.

4. Recovery Phases (NIST SP 800-34) #

4.1 Activation/Notification Phase #

1. The System Owner or a designee assesses the damage and records the outage cause, the affected components, and the estimated restoration time.
2. The System Owner decides whether to activate the plan, using the criteria under Activation and Notification.
3. When the plan is activated, the System Owner notifies the contingency team through the call tree in Appendix A and reports the activation to the CISO.
4. The ISSO records the activation in the ITSM platform.

4.2 Recovery Phase #

Execution of recovery procedures in Appendix B in restoration-priority order: restore from the most recent verified backup; validate integrity before reconnection; apply transactions or data recreated since the RPO where feasible. (Moderate and High) When the primary site cannot be used, the recovery team follows the alternate processing procedures in Appendix D. Backup and recovery technology:

(No technology inventory entries for this family.)

4.3 Reconstitution Phase #

1. The recovery team validates that the system works in full.
2. The ISSO verifies the security controls, including re-enabled monitoring and access enforcement.
3. The System Owner decides to deactivate the plan and notifies the CISO.
4. The ISSO writes the after-action report, and the System Owner updates this plan.

5. Alternate Site and Storage (Moderate and High) #

(Moderate and High) Alternate telecommunications services share no single point of failure with the primary services (CP-8(2)). (High) The System Owner prepares the alternate processing site to support essential functions (CP-7(4)). The alternate telecommunications provider is separate from the primary provider (CP-8(3)).

6. Plan Testing, Training, and Exercises #

The System Owner tests the completed ISCP at least every year under the Contingency Planning Policy. The ISSO documents the results, deficiencies, and corrective actions and tracks them as plan of action and milestones (POA&M) items. Personnel with contingency roles complete activation training within [CP-03 parameter 1 — to be defined] of assignment, and every year after that.

Each test plan states its objectives and the criteria for success. NIST SP 800-34 Rev 1 names these test areas:

1. Notification procedures.
2. System recovery on an alternate platform from backup media.
3. Internal and external connectivity.
4. System performance using alternate equipment.
5. Restoration of normal operations.

The test report records each objective as met or not met, the measured recovery time against the RTO, and each gap. (Moderate and High) The System Owner coordinates the test with the owners of related plans (CP-4(1)). (High) The System Owner tests the plan at the alternate processing site (CP-4(2)). The schedule of tests, training, and plan reviews is in Appendix I.

Appendix A: Contact Roster and Call Tree #

[Controlled appendix — verify quarterly]

Appendix B: System Recovery Procedures #

[Step-by-step, system-specific, validated during exercises]

Appendix C: Vendor Contacts #

Appendix D: Alternate Processing Procedures (Moderate and High) #

[Steps to move processing to the alternate site, to run there, and to move back]

Appendix E: System Validation Test Procedures #

[Steps the test team uses to confirm the data and the functions work before users return]

Appendix F: Architecture Diagram #

[Diagram of the boundary, the components, and the connections]

Appendix G: Hardware and Software Inventory #

Appendix H: Interconnections #

Appendix I: Test and Maintenance Schedule #

Appendix J: Related Plans and Procedures #

[The Incident Response Plan, the continuity of operations plan, and any other plan this plan depends on]

Appendix K: Business Impact Analysis #

[Attach the completed BIA]

References #

These are the sources this document cites, with a link to each official text.

• NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems, May 2010.