Back | Next
The LifeWIRE Contingency Plan establishes procedures to recover LifeWIRE following a disruption resulting from a disaster. This Disaster Recovery Policy is maintained by the LifeWIRE Security Officer and Privacy Officer.
The following objectives have been established for this plan:
1. Maximize the effectiveness of contingency operations through an established plan that consists of the following phases:
- Notification/Activation phase to detect and assess damage and to activate the plan;
- Recovery phase to restore temporary IT operations and recover damage done to the original system;
- Reconstitution phase to restore IT system processing capabilities to normal operations.
2. Identify the activities, resources, and procedures needed to carry out LifeWIRE processing requirements during prolonged interruptions to normal operations.
3. Identify and define the impact of interruptions to LifeWIRE systems.
4. Assign responsibilities to designated personnel and provide guidance for recovering LifeWIRE during prolonged periods of interruption to normal operations.
5. Ensure coordination with other LifeWIRE staff who will participate in the contingency planning strategies.
6. Ensure coordination with external points of contact and vendors who will participate in the contingency planning strategies.
This LifeWIRE Contingency Plan has been developed as required under the Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, November 2000, and the Health Insurance Portability and Accountability Act (HIPAA) Final Security Rule, Section §164.308(a)(7), which requires the establishment and implementation of procedures for responding to events that damage systems containing electronic protected health information.
This LifeWIRE Contingency Plan is created under the legislative requirements set forth in the Federal Information Security Management Act (FISMA) of 2002 and the guidelines established by the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-34, titled “Contingency Planning Guide for Information Technology Systems” dated June 2002.
The LifeWIRE Contingency Plan also complies with the following federal and departmental policies:
- The Computer Security Act of 1987;
- OMB Circular A-130, Management of Federal Information Resources, Appendix III, November 2000;
- Federal Preparedness Circular (FPC) 65, Federal Executive Branch Continuity of Operations, July 1999;
- Presidential Decision Directive (PDD) 67, Enduring Constitutional Government and Continuity of Government Operations, October 1998;
- PDD 63, Critical Infrastructure Protection, May 1998;
- Federal Emergency Management Agency (FEMA), The Federal Response Plan (FRP), April 1999;
- Defense Authorization Act (Public Law 106-398), Title X, Subtitle G, “Government Information Security Reform,” October 30, 2000
Example of the types of disasters that would initiate this plan are natural disaster, political disturbances, man made disaster, external human threats, internal malicious activities.
LifeWIRE defined two categories of systems from a disaster recovery perspective.
- Critical Systems. These systems host application servers and database servers or are required for functioning of systems that host application servers and database servers. These systems, if unavailable, affect the integrity of data and must be restored, or have a process begun to restore them, immediately upon becoming unavailable.
- Non-critical Systems. These are all systems not considered critical by definition above. These systems, while they may affect the performance and overall security of critical systems, do not prevent Critical systems from functioning and being accessed appropriately. These systems are restored at a lower priority than critical systems.