Attachment-G4-ACF_Contingency Plan.docx_V1.0.docx

Enter System Name ACF

Contingency Plan Enter System Name

Version 1.0 Dated: 6/26/25

Table of Contents

1. Introduction and Purpose This Contingency Plan follows NIST SP 800-34 guidelines and outlines the necessary materials for meeting federal security standards. The plan is designed to help quickly resume critical system operations after emergencies like fires, power outages, tornadoes, hurricanes, floods, earthquakes, or civil disturbances. This document’s information is proprietary and classified as Controlled Unclassified Information (CUI).

1.2 Assumptions and Exclusions

Identify the assumptions and exclusions that apply to this Plan. Add additional assumptions and exclusions as applicable.

Table 1. Assumptions and Exclusions

Assumptions and Exclusions

Enter additional assumptions or exclusions

The Contingency Plan does not apply to the following situations:

· Short-term disruptions lasting less than Enter RTO number hours.

· Overall recovery and continuity of business operations.

· Emergency evacuation of personnel.

1.3 System Overview

Leverage the information from the System Security Plan (SSP) to provide a general description of the system architecture and functionality. Indicate the operating environment, physical location, general location of users, and partnerships with external organizations/systems. Include information regarding other critical technical recovery considerations, such as backup procedures.

Enter system description

Provide a system architecture diagram.

2. Roles & Responsibilities Identify all people responsible for activating, executing, and supporting the contingency plan. Add additional rows as needed Table 2. Contingency Plan Contact List

3. Contingency Plan Execution Describe the phases of contingency plan execution in the sections below.

3.1 Activation

Define the initial actions to detect and assess damage caused by a disruption to the system.

3.1.1 Activation Criteria

Confirm the following criteria that will trigger the activation of the Contingency Plan:

· The system outage indicates the system will be down for more than RTO number hours.

· The facility housing is damaged and may not be available within RTO number hours.

Add additional criteria as applicable

3.1.2 Activation & Notification Procedure

Identify the persons with the power to activate the Contingency Plan if one or more activation criteria are met.

Describe the established notification procedures. Include the person who makes the initial notification, the sequence in which personnel are notified, and the notification method.

Table 3. Notification Sequence

3.2 Recovery

The system should be functional and capable of performing the functions identified in Section 1.3 of this Plan after recovery is complete.

3.2.1 Recovery Procedures

Outline the steps to recover the system from backup media. Identify which teams or people are responsible for each step. If detailed instructions with specific keystrokes are needed, they should be included in an appendix; please include a link to that appendix section.

Enter recovery steps

3.2.2 Recovery Document Location

Provide a link to the location where recovery documents are stored.

Enter recovery documents location

3.2.2 Escalation Procedures

Describe the procedures for sending escalation notices during recovery efforts. Include how leadership, system owners, and users will be informed and updated. Identify who is responsible for escalation notifications.

Enter escalation procedures

3.3 Reconstitution

Bring the system back to normal operations after recovery is complete.

3.3.1 Validation Testing

Outline the steps to verify and validate that recovered data is accurate and current. Identify teams or individuals responsible for each step.

Table 4. Data Verification Testing

Table 6. Data Validation Test Plan

3.3.2 Validation Functionality Testing

Outline the steps to verify that the recovered system is operating correctly. Identify teams or individuals responsible for each step.

Table 6. System Validation Test Plan

3.3.3 Recovery Declaration

Once testing and validation are done, the Enter name of designated authority officially announces that recovery efforts are finished and the system operates normally. The Contingency Plan Coordinator informs the business and technical points of contact.

3.3.4 Notification (users)

On return to normal system operations, system users are notified by Enter role using Enter notification procedures.

3.3.5 Cleanup

Describe cleanup procedures for the system, including locations for manuals and documents, and how backup or installation media will be returned to their original location.

Enter cleanup procedures

3.3.6 Offsite Data Storage

Describe how retrieved backup or installation media will be returned to its off-site data storage location. Include details on proper logging and packaging, transportation preparation, validation of secure storage, etc.

Enter offsite data storage details

3.3.7 Data Backup

Describe procedures for ensuring a full system backup within a reasonable time frame, ideally at the next scheduled backup period.

Enter data backup procedures

3.3.8 Deactivation

After all activities are finished and documentation is updated, the Enter name of designated authority officially ends the Contingency Plan recovery process, and all business and technical points of contact are notified.

4. Approval and Authorization Contingency Plan Completion Date: Select date The information contained in this System’s Contingency Plan has been reviewed and approved by the following authority.

Enter System Owner name Digital Signature – Date

Appendix A. Vendor Contact List List contact information for all maintenance and support vendors.

Table 7. Vendor Contact List

Appendix B. Alternate Processing Procedures Please describe alternate manual or technical processing procedures that would allow the affected business unit to continue processing information typically done by the affected system.

Enter procedures

Appendix C. Test and Maintenance Schedule Provide the yearly schedule for testing the system.

Table 8. Yearly Test and Maintenance Schedule

Appendix D. Associated Plans and Procedures Please identify contingency plans for other related systems. Include the most current version, location, and primary point of contact for each Contingency Plan.

Enter plans and procedures

Document Revision History

Version 1.0 Contingency Plan 1 image2.png image1.png image3.png