The IAO will ensure a disaster recovery plan exists in accordance with DoD policy based on the Mission Assurance Category (MAC).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-16846	APP6200	SV-17846r1_rule	CODB-1 CODB-2 CODP-3	Medium

Description
Well thought out recovery plans are essential for system recovery and/or business restoration in the event of catastrophic failure or disaster.

STIG	Date
Application Security and Development Checklist	2014-12-22

Details

Check Text ( C-17858r1_chk )
All applications should document disaster recovery procedures to include business recovery plans, system contingency plans, facility disaster recovery plans, and plan acceptance. Ask the application representative to review these plans. For MAC 1 applications, verify the disaster plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity. For MAC 2 applications, verify the disaster plan exists and provides for the resumption of mission or business essential functions within 24 hours activation. For MAC 3 applications, verify the disaster plan exists and provides for the partial resumption of mission or business essential functions within 5 days of activation. 1) If the disaster plan does not exist or does not meet the MAC level requirements, this is a finding.

Check Text ( C-17858r1_chk )

All applications should document disaster recovery procedures to include business recovery plans, system contingency plans, facility disaster recovery plans, and plan acceptance.

Ask the application representative to review these plans.

For MAC 1 applications, verify the disaster plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity.

For MAC 2 applications, verify the disaster plan exists and provides for the resumption of mission or business essential functions within 24 hours activation.

For MAC 3 applications, verify the disaster plan exists and provides for the partial resumption of mission or business essential functions within 5 days of activation.

1) If the disaster plan does not exist or does not meet the MAC level requirements, this is a finding.

Fix Text (F-17168r1_fix)
Create and maintain the disaster recovery plan.