Contingency planning document from NIST

The Information Technology Laboratory of the National Institute of Standards and Technology has published the free, Web-based " Contingency Planning Guide For Information Technology Systems, " edited by Elizabeth Lennon. The following is a slightly edited quotation from the release note circulated to subscribers of the " ITL Bulletin for June 2002 " (used with permission of the editor).

The guide discusses essential contingency plan elements and processes, highlights specific considerations and concerns associated with contingency planning for various types of IT systems, and provides examples to assist readers in developing their own IT contingency plans. The document, among others, is available in a printable Acrobat PDF file at:

csrc.nist.gov/publications/nistpubs/index.html

While you are there, note the extensive links on the left column of that page, including "Alerts," which brings you to a useful list of current vulnerability alerts called the "Vulnerability and Threat Portal."

The IT contingency planning guide identifies fundamental planning principles and practices to help personnel develop and maintain effective IT contingency plans. The principles meet most organizational needs; however, each organization may have additional requirements specific to its own processes. The document provides guidance to help personnel evaluate information systems and operations to determine contingency requirements and priorities. The guidance also provides a structured approach to aid planners in developing cost-effective solutions that accurately reflect their IT requirements and integrate contingency planning principles into all aspects of IT operations.

The guidance presented should be considered during every stage of contingency planning, starting with the conceptualization of contingency planning efforts through plan maintenance and disposal of the contingency plan. If used as a planning management tool throughout the contingency planning process, the document and its appendices should provide users with time- and cost-saving practices.

The guide presents contingency planning principles for the following common IT processing systems:

* Desktop computers and portable systems (laptop and handheld computers).

* Servers.

* Web sites.

* LANs.

* WANs.

* Distributed systems.

* Mainframe systems.

The document discusses common technologies that may be used to support contingency capabilities. Given the broad range of IT designs and configurations, however, as well as the rapid development and obsolescence of products and capabilities, the scope of the discussion is not intended to be comprehensive. Rather, the document describes practices for applying technology to enhance an organization's IT contingency planning capabilities.

The document outlines planning principles that may be applied to a wide variety of incidents that could affect IT system operations. The scope includes minor incidents causing short-term disruptions to disasters that affect normal operations for an extended period. Because IT systems vary in design and application, specific incident types and associated contingency measures are not provided in the document. Instead, the planning guide defines a process that may be followed for any IT system to identify planning requirements and develop an effective contingency plan.

* * *

Readers may subscribe to the ITL Newsletter in ASCII e-mail format by sending an e-mail message from your business e-mail account to mailto:listproc@nist.gov with the message "subscribe itl-bulletin" (not including the quotation marks). To have the Bulletin delivered to an e-mail address other than the FROM address, contact the ITL editor at 301-975-2832 or send a request to mailto:elizabeth.lennon@nist.gov

NEW! 18-month online Master of Science in Information Assurance offered by Norwich University.

Look for the “Computer Security Handbook, 4th Edition” edited by Seymour Bosworth and Michel E. Kabay; Wiley (New York), ISBN 0-4714-1258-9. Available now at your technical bookstore or from Amazon.

M. E. Kabay, Ph.D., CISSP, is Associate Professor in the Department of Computer Information Systems at Norwich University in Northfield, Vt. Mich can be reached by e-mail and his Web site.