South Plains College

Information Services (SPC-IS)

 

Incident Response Policy: I-F

 

Purpose
To ensure that everyday Information Technology (IT) resources and information systems are available during times of disruption of services.

 

Policy
This policy applies to all departments and users of SPC IT resources and assets.

 

1. Contingency Plan

SPC-IS Department shall:

 

1. Develop a contingency plan for the information system, in direct guidance and association with the information system owner, that:

 

1. Identifies essential missions and business functions and associated contingency requirements.

 

1. Provides recovery objectives, restoration priorities, and metrics.

 

• Addresses contingency roles, responsibilities, and assigned individuals with contact information.

 

1. Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure.

 

1. Addresses eventual, complete information system restoration without deterioration of the security safeguards planned initially and implemented.

 

1. It is reviewed and approved by the ISO and the information system’s owner management at least annually.

 

1. Distribute copies of contingency plans to crucial personnel identified by name and business role.

 

1. Coordinate contingency planning activities with incident handling activities.

 

1. Update the contingency plan to address changes to the business owner’s mission, information system, or operating environment and problems encountered during contingency plan implementation, execution, or testing.

 

1. Communicate contingency plan changes to key personnel identified by name and business role.

 

1. Protect the contingency plan from unauthorized disclosure and modification.

 

1. Contingency Training

SPC-IS Department shall:

 

1. Provide contingency training to information system users consistent with assigned roles and responsibilities

 

1. Ensure designated personnel receive contingency training at least bi-annually to assume a contingency role or responsibility when required by information system changes.

 

1. Contingency Plan Testing

IT, along with information systems owners, shall:

 

1. Test the contingency plan for the information system, as determined by the mission-critical nature of the business system(s) no less than annually.

 

1. Use strategic and tactical planning during testing to simulate a production information system and determine the plan's effectiveness and organizational readiness to execute it.

 

1. Review the contingency plan test results.

 

1. Initiate corrective actions as needed.

 

1. Coordinate contingency plan testing with organizational elements responsible for related plans; plans related to contingency plans for information systems include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber Incident Response Plans, and Occupant Emergency Plans.

 

1. Alternate Storage Site

SPC-IS, with direct guidance and association with the information system owner, shall:

 

1. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of information system backup information.

 

1. Ensure that the alternate storage site provides information security safeguards equivalent to those of the primary site.

 

1. Identify an alternate storage site separated from the primary storage site to reduce susceptibility to the same threats.

 

1. Identify and document potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions.

 

1. Alternate Processing Site

SPC-IS, with direct guidance and association with the information system owner, shall:

 

1. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of the information system operations for essential missions/business functions within the period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.

 

1. Ensure that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the agreed-upon period for transfer/resumption.

 

1. Ensure that the alternate processing site provides information security safeguards equivalent to those of the primary site.

 

1. Identify an alternate processing site separated from the primary processing site to reduce susceptibility to the same threats.

 

1. Identify potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster and outline explicit mitigation actions.

 

1. Develop alternate processing site agreements that contain priority-of-service provisions following business objectives and availability requirements.

 

1. Telecommunications Services

SPC-IS Department shall:

1. Establish alternate telecommunications services, including necessary agreements, to permit the resumption of information system operations for essential missions and business functions within agreed-upon recovery timeframes when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

 

1. Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions following agreed-upon recovery objectives and availability requirements.

 

1. Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary or alternate telecommunications services are provided by a common carrier.

 

1. Information System Backup

SPC-IS, with direct guidance and association with the information system owner, shall:

 

1. Conduct backups of user-level information contained in the information system defined by frequency consistent with recovery time and recovery point objectives.

 

1. Conduct backups of system-level information contained in the information system defined by frequency consistent with recovery time and recovery point objectives.

 

1. Conduct backups of information system documentation including security-related documentation defined by frequency consistent with recovery time and recovery point objectives.

 

1. Protect the confidentiality, integrity, and availability of backup information at storage locations.

 

1. Test backup information to verify media reliability and information integrity.

 

1. Information System Recovery and Reconstitution

SPC-IS, with direct guidance and association with the information system owner, shall:

 

1. Provide for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

 

1. Provide that the information system implements transaction recovery for transaction-based systems.

 

Compliance

Employees who violate this policy may be subject to appropriate disciplinary action, including discharge and civil and criminal penalties. Non-employees, including, without limitation, contractors, may be subject to termination of contractual agreements, denial of access to Information Technology (IT) resources, and other actions, as well as both civil and criminal penalties.

 

Policy Exceptions

Requests for exceptions to this policy shall be reviewed by the Chief Information Security Officer (CISO) and the Chief Information Officer (CIO). Departments requesting exceptions shall make such requests to the CIO. The request should specifically state the scope of the exception along with justification for granting the exception, the potential impact or risk attendant upon granting the exception, risk mitigation measures to be undertaken by the IT Department, initiatives, actions, and a time frame for achieving the minimum compliance level with the policies set forth herein. The CIO shall review such requests and confer with the requesting department.

 

Related Documents
1 TAC § 202.74 (a)(2)

Section 512.053, Business and Commerce Code

Section 412.054, Labor Code

 

National Institute of Standards and Technology (NIST) Special Publications (SP):
NIST SP 800-53a – Contingency Planning (CP), NIST SP 800-16, NIST SP 800-34, NIST SP 800-50, NIST SP 800-84; NIST Federal Information Processing Standards (FIPS) 199

 

Texas Security Controls Standards Catalog Control Group: CP-1, CP-2, CP-3, CP-4, IR-4,

 

NIST Function Groups: RC.RP-1, RC.IM-1, RC.IM-2