September is National Preparedness Month and October is National Cybersecurity Awareness Month, which makes it a great time to review your organization’s disaster preparedness strategy. Implementing a contingency plan for a natural disaster could be the difference between minimal business interruption and weeks or even months of lost revenue. Even if you are not a federal contractor, NIST 800-53 is a great resource for creating solid security policies and implementing effective security controls, and the Contingency Planning control family in NIST 800-53 is no exception. The control family contains everything you need to set up a robust plan to ensure your organization is ready for any natural disaster.
The Contingency Preparation section contains all the planning, training, and testing that is needed to create and maintain a successful disaster preparedness plan.
CP-1 Contingency Planning Policy and Procedures
Establishing planning policy and procedures will help to implement the rest of the security controls in the Contingency Planning control family. Develop, document, and disseminate contingency policy and procedures to relevant personal in the organization. The planning policy and procedures should reflect applicable laws, organizational directives, local regulations, and other relevant factors. Revisit the plan regularly to ensure policy is up to date.
CP-2 Contingency Plan
The contingency plan will be the game plan for your organization when a disaster happens, and it is a critical aspect to a quick and effective response.
The plan should include the following:
- Essential missions and business functions, and their associated contingency requirements
- Recovery objectives, restoration priorities, and metrics to gauge progress
- Defined contingency roles and responsibilities, and assigned personal with contact info
- Plan to maintain essential mission and business functions in the event of disruption, compromise, or failure
- Define process for full information system restoration without deterioration of security safeguards
The contingency plan should be distributed to contingency personal and relevant organizational elements, reviewed regularly, and modified if shortcomings are identified. Ensure that the contingency plan is not disclosed to unauthorized parties to maintain operational security.
CP-3 Contingency Training
After the contingency plan is formed, personal need to be trained on their assigned contingency roles and responsibility. Training can utilize simulated events and automated training environments to make the training more dynamic and effective. Training should be conducted when roles are initially assigned and when significant changes to the contingency plan are made. Additionally, refresher training should be done at regular intervals.
CP-4 Contingency Plan Testing
To ensure that the contingency plan is effective, it should be tested regularly. This can be done through tabletop exercises, simulations, walkthroughs, and testing of alternate site and recovery technology. If weaknesses are identified the contingency plan should be edited to address them. As with all security topics, contingency planning should be iterative and reflect emerging threats as they appear and not a “one and done” process.
Contingency Services allow an organization to operate when main services have been damaged or taken offline by a natural disaster. Organizations that employ these services are fault-tolerant and can continue to operate with minimal interruption during a disaster even when an entire site or datacenter is taken offline.
CP-6 Alternate Storage Site
Establish an alternative storage site that is geographically separated from the main site to store duplicate copies of information to ensure no data is lost during a disaster. If your “off-site backups” are across town, a wide area disaster such as a hurricane or flooding can easily destroy both your primary data as well as your backups, so ensure that the alternate storage site is sufficiently geographically separated. Managing off site backups can be expensive, but they are orders of magnitude cheaper than losing all your organization’s data in a flood. Additionally, organizations should have the capability to rapidly restore from an alternate storage site to quickly resume normal operations after a data loss event.
CP-7 Alternate Processing Site
An alternate processing site should be established to operate essential business services if the primary site is unavailable or disabled to a disaster. Like the alternative storage site, the alternative processing site should be geographically separated from the primary processing site to prevent a wide area disaster from disabling both sites simultaneously. Alternative processing sites should have the ability to transfer and resume operation from the primary to alternative site, as well as transfer back to the primary site once the disaster is over to ensure smooth operation during and after a disaster.
CP-8 Telecommunications Services
If an earthquake (or gardener) severs your building’s fiber line, do you have an alternative uplink ready to go? Telecommunication services like internet connections, phone lines, and cell towers are often unreliable or destroyed during a disaster. Having backup telecommunications systems in place is critical to quickly resuming operation following a disaster. Alternate telecommunication systems should not share a point of failure with main communication lines to prevent both the primary and alternate systems going down at the same time.
CP-9 Information System Backup
Both user-level and system-level information should be backed up regularly, with a defined recovery time and recovery point objectives. This will ensure that backups stored at the alternate storage site are up to date and easily recoverable in the case of a data loss event due to a disaster. Documentation, including disaster recovery plans, should also be backed up to help with the recovery process. Ensure that backups are properly secured is critical, and check out our article on securing backups for more information.
CP-10 Information System Recovery and Reconstitution
Organizations need to have the capability to recover and restore systems after a disaster if they are damaged or destroyed. A system to recover and reconstitute critical information systems can be the difference between getting up and running quickly and having to rebuild your environment from scratch. The confidentiality, integrity, and availably of backed up data should be preserved through the backup and restoration process to ensure that operational security is not compromised. Regularly test reliability of backups as well as the restoration process to ensure a quick and complete recovery after a data loss event.
When a natural disaster hits, your organization needs to be ready to react fast and efficiently to minimize downtime and data loss. Using NIST 800-53 as a starting point to develop your organization’s disaster preparedness plan and infrastructure is a great way to get the ball rolling. Do you want to bring your security program (including disaster preparedness) to the next level? As your end to end security provider, NuHarbor Security is ready to help your organization with risk assessments, security program reviews, incident response planning, and much more.
by: Hayley Froio
Information Assurance Team Member at NuHarbor Security
Follow us on Social Media for more information: