A disaster recovery/continuity plan must exist in accordance with DoD policy based on the applications availability requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70351	APSC-DV-003050	SV-84973r1_rule		Medium

Description
All applications must document disaster recovery/continuity procedures to include business recovery plans, system contingency plans, facility disaster recovery plans, and plan acceptance.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2018-04-03

Details

Check Text ( C-70805r1_chk )
Review disaster recovery/continuity plans. For high risk applications, verify the disaster plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity. For moderate risk applications, verify the disaster recovery/continuity plan exists and provides for the resumption of mission or business essential functions within 24 hours activation. For low risk applications, verify the disaster recovery/continuity plan exists and provides for the partial resumption of mission or business essential functions within 5 days of activation. If the disaster recovery/continuity plan does not exist or does not meet the severity level requirements, this is a finding.

Check Text ( C-70805r1_chk )

Review disaster recovery/continuity plans.

For high risk applications, verify the disaster plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity.

For moderate risk applications, verify the disaster recovery/continuity plan exists and provides for the resumption of mission or business essential functions within 24 hours activation.

For low risk applications, verify the disaster recovery/continuity plan exists and provides for the partial resumption of mission or business essential functions within 5 days of activation.

If the disaster recovery/continuity plan does not exist or does not meet the severity level requirements, this is a finding.

Fix Text (F-76587r1_fix)
Create and maintain the disaster recovery/continuity plan.