The IAO will ensure recovery procedures and technical system features exist so recovery is performed in a secure and verifiable manner. The IAO will document circumstances inhibiting a trusted recovery.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6171	APP6160	SV-6171r1_rule	CODP-1 CODP-2 CODP-3	Medium

Description
Without a disaster recovery plan, the application is susceptible to interruption in service due to damage within the processing site.

STIG	Date
Application Security and Development Checklist	2014-01-07

Details

Check Text ( C-3057r1_chk )
Ensure that a disaster recovery plan is in place for the application. If the application is part of the site’s disaster recovery plan, ensure that the plan contains detailed instructions pertaining to the application. Ensure that recovery procedures indicate the steps needed for secure recovery. 1) If a disaster recovery plan does not exist or the application is not part of the site’s disaster recovery plan, it is a finding. Verify that the recovery procedures include any special considerations for trusted recovery. 2) If any special considerations for trusted recovery are not documented, it is a finding.

Check Text ( C-3057r1_chk )

Ensure that a disaster recovery plan is in place for the application. If the application is part of the site’s disaster recovery plan, ensure that the plan contains detailed instructions pertaining to the application. Ensure that recovery procedures indicate the steps needed for secure recovery.

1) If a disaster recovery plan does not exist or the application is not part of the site’s disaster recovery plan, it is a finding.

Verify that the recovery procedures include any special considerations for trusted recovery.

2) If any special considerations for trusted recovery are not documented, it is a finding.

Fix Text (F-4483r1_fix)
Create and maintain a disaster recovery plan.