Attachment E- Contingency Plan Test Extensible TEMPLATE v1.0.pdf

FOR OFFICIAL USE ONLY

[VENDOR SYSTEM]

Contingency Plan Test Results

(CPT)

Prepared for

Department of Homeland Security Headquarters (DHS HQ)

4 January 2018

DOCUMENT CHANGE HISTORY

Version Date Author Description i

FOR OFFICIAL USE ONLY

Table of Contents

1.0 Introduction

1.1 Purpose

1.2 Applicability

1.3 Scope

2.0 Concept of Operations

2.1 Scenario

2.2 Method

3.0 After Action Report

3.1 Summary

3.2 General Results

3.3 Specific Results

FOR OFFICIAL USE ONLY

1.0 Introduction

Contingency Plan Testing enables plan deficiencies to be identified and addressed. Tests and exercises serve to validate specific aspects of Contingency Plans, policies, procedures, systems, staffing, and facilities to be used during an emergency which helps evaluate the ability and timeliness of recovery teams to implement the plan quickly and effectively. Plan testing is a critical element of a viable contingency capability. Each information system contingency plan element is tested to confirm the accuracy of individual recovery procedures and the overall effectiveness of the plan.

1.1 Purpose

In an effort to validate the Department of Homeland Security (DHS) [VENDOR SYSTEM] Contingency

Plan (CP) dated [date of CP], tests will be conducted on [VENDOR SYSTEM] to examine processes and procedures associated with the implementation of the CP. The type of tests [FULL

FUNCTIONAL/TABLE TOP/CALL TREE] required is a full functional exercise based on the impact level for the availability objective for the system. Section 3.5.2 of the DHS 4300A Sensitive Systems

Handbook defines the requirements for low, medium, and high impact availability systems. This exercise will be a [NUMBER OF HOURS]-hour event that will begin at [START TIME] and will last until [END

TIME].

The exercise is designed to facilitate communication among select personnel regarding the implementation of recovery operations at [VENDOR SYSTEM] following an event causing the outage of mission critical systems that are housed in the [FACILITY NAME]. This exercise is designed to improve the readiness of the [VENDOR SYSTEM] and help validate existing CP procedures.

1.2 Applicability

{To derive the most value from the test, the Contingency Planning Coordinator should develop a test plan designed to test the selected elements against explicit test objectives and success criteria. The use of test objectives and success criteria enable the effectiveness of each plan element and the overall plan to be assessed. The test plan should include a schedule detailing the time frames for each test and test participants. The test plan should also delineate clear scope, scenario, and logistics. The scenario chosen may be a worst-case incident or an incident most likely to occur. It should mimic reality as closely as possible. The basic format for this exercise will be a functional Exercise: Functional exercises are more extensive than tabletops, requiring the event to be faked. Functional exercises include simulations and war-gaming. Often, scripts are written out for role players pretending to be external organization contacts, or there may be actual interagency and vendor participation. A functional exercise might include actual relocation to the alternate site and/or system cutover.}

This exercise type is designed to facilitate and evaluate communication among participating staff regarding the implementation of recovery operations at [VENDOR SYSTEM] following an event causing the outage of mission critical systems that are housed in the [FACILITY NAME]. This exercise is designed to improve the readiness of the [VENDOR SYSTEM] and help validate existing CP procedures

Training for personnel with contingency plan responsibilities has been tailored to complement testing.

Training is provided at least annually; new hires who will have plan responsibilities receive training shortly after they are hired. Ultimately, CP personnel are trained to the extent that that they are able to execute their respective recovery procedures without aid of the actual document. This is an effort to ensure successful activation of the plan in event that paper or electronic copies of the CP are not available for the first few hours resulting from the extent of the disaster. Recovery personnel are trained on the following plan elements:

FOR OFFICIAL USE ONLY

Purpose of the plan

Cross-team coordination and communication

Reporting procedures

Security requirements

Team-specific processes (Notification/Activation, Recovery, and Reconstitution Phases)

Individual responsibilities (Notification/Activation, Recovery, and Reconstitution Phases)

{Add/modify plan elements as necessary}

1.3 Scope

The applicability of the test plan is predicated on key contingency assumptions:

The DHS facility in [CITY, STATE] is inaccessible; therefore, the [VENDOR SYSTEM] is unable to perform information processing for DHS.

A valid [CONTRACT or PLAN] exists with an alternate site that designates that site in [CITY, STATE] as the alternate operating facility for [VENDOR SYSTEM]. This [CONTRACT or

PLAN] contains provisions such that:

o DHS will use the alternate site facility and alternate information system resources to recover [VENDOR SYSTEM] functionality during an emergency situation that prevents access to the original facility.

o The designated computer system at the alternate site has been configured and secured to begin timely processing of the system information.

o The alternate site will be used to continue the system recovery and processing throughout the period of disruption, until the return to normal operations.

The following objectives are exercised and evaluated in this contingency plan test:

System recovery on an alternate platform from prepositioned backup media

Coordination among recovery teams

Internal and external connectivity

System performance using alternate equipment by staff tasked in the CP at the designated alternate site

Restoration of normal operations

Notification procedures

{Add/modify test areas as applicable}

{The CP Test Plan should be classified or marked for Controlled Unclassified Information (CUI) control commensurate with the classification or CUI control of the CP being tested. The After Action Report of a

CP Test should be classified or marked for CUI control based on the content of the results documented;

consult appropriate classification guides or Security Representatives for assistance.}

2.0 Concept of Operations

2.1 Scenario

{A scenario must be developed that illustrates a fictitious event (world/local) that directly affects the assets of the system. The scenario is developed by the exercise team during the Development Phase. This information will be provided to participants in briefings before the exercise or at the beginning of the exercise event. In the test plan, explain in detail the type of scenario your site will be responding to and how the incident will affect your system.}

2.2 Method

{Document in the plan and brief participating teams how the exercise is modeled. Describe in the plan each of the following bullet points in its own paragraph:

What should be done to recover each class of system (e.g., Messaging, Web) at the site?

How should system recovery be accomplished and what is the priority/optimal chronology of restoration?

What is the time required for restoration and how this can be optimized?

What are the expected results and action items that will assist system teams?}

Note that participants will be presented with an exercise scenario affecting the [VENDOR SYSTEM].

The objectives of the exercise are as follows:

Validate the team's ability to recover information system operations at an alternate facility.

Validate the completeness and accuracy of recovery procedures documented in the CP.

Identify areas of the CP that need to be improved, revised, or augmented.

{Develop a list of predetermined events that will enable evaluation of the performance of the applicable teams. In the Test Plan, list the events that must be successfully executed in order to complete a comprehensive test of the system CP. The Event List should be exhaustive in its incorporation of the teams and functions that have been defined in the CP. Use the following tabular format to develop the

Event List.}

Event List

Event # Description Expected Action Scheduled Time Objectives

3.0 After Action Report

The discussion results from the exercise along with any necessary recommended actions are as follows:

In the CP Test Plan, provide for an After Action Report that documents and informs the appropriate managers and stakeholders of the exercise results. Develop the After Action Report with the following format and content:

On [DATE], the DHS [VENDOR SYSTEM] participated in [TIME PERIOD]-hour exercise designed to validate their understanding of the system CP.

Location: [FACILITY LOCATION]

Sequence of events o [TIME] Welcoming Remarks and Introductions o [TIME] Exercise Briefing (Objectives, Rules of Engagement, etc.)

o [TIME] Scenario Discussion o [TIME] Execution o [TIME] Debrief

3.1 Summary

The [EXERCISE NAME] provided information on [EXERCISE SUBJECT]. An important benefit of the exercise was the opportunity for participants to raise important questions, concerns, and issues. {At the conclusion of the exercise, participants should be asked to complete an evaluation form regarding the information provided, additional information needed, and their thoughts on the event and topics, to be included in the after action report.}

3.2 General Results

{Describe below the general outcome of the test as it applies to the following objectives:

The test demonstrates that the system can be brought to an operational condition at the designated alternate site using only the staff resources tasked in the CP and by following CP procedures and instructions.

The test verifies that the plan can be successfully implemented using only resources that are normally located away from the site where the incident occurs.

The test verifies that the organizational units responsible for the Contingency Plan fully understand their responsibilities and are able to carry them out correctly, completely, and in a timely manner.

The test verifies that the system can be brought to a secure, operational condition within the planned recovery time.

The test verifies that system information can be restored to the required state, so that mission operations can resume in a synchronized manner.

The test verifies that access to the system information by authorized business area personnel can be reestablished.}

3.3 Specific Results

FOR OFFICIAL USE ONLY

{Specific observations made during the exercise, and recommendations for enhancement of the plan, are as follows: {Add and modify list as necessary} Observation 1 [OBSERVATION NAME]

Recommendations [RECOMMENDATION DESCRIPTION]

Observation 2 [OBSERVATION NAME]

Recommendations [RECOMMENDATION DESCRIPTION]

{Classify the After Action Report of a CP Test or marked it for CUI control based on the content of the results documented. Any CP shortfalls or identification/discussion of risks may require confidentiality protection; consult appropriate classification guides or Security Representatives for assistance.}