Attachment M_ITOPS Test Results Template.docx

2020 Test Results

Directives

Relevant Controls Information:

CP-1 CONTINGENCY PLANNING POLICY AND PROCEDURES - Establishes policy and procedures for the effective implementation of selected security controls and control enhancements.

CP-2 CONTINGENCY PLAN - Addresses contingency roles, responsibilities, and assigned individuals with contact information.

CP-3 CONTINGENCY TRAINING - Training provided by organizations is linked to the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail.

CP-4 CONTINGENCY PLAN TESTING - Methods for testing contingency plans to determine the effectiveness of the plans and to identify potential weaknesses.

CP-6 ALTERNATE STORAGE SITE - An alternate storage site maintains duplicate copies of information and data in the event that the primary storage site is not available.

CP-7 ALTERNATE PROCESSING SITE - Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of essential missions/business functions within recovery time and recovery point objectives when the primary processing capabilities are unavailable.

CP-8 TELECOMMUNICATIONS SERVICES – Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential missions/business functions despite the loss of primary telecommunications services.

CP-9 INFORMATION SYSTEM BACKUP - Information system backups reflect the requirements in contingency plans as well as other organizational requirements for backing up information.

CP-10 INFORMATION SYSTEM RECOVERY AND RECONSTITION - The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

Test Results (TR) Purpose

The purpose is form is the document the results of the OIT test of plans. These results along with all supporting artifacts will be forwarded to emergency preparedness for review as well as the ISSO will upload approved TRs into GRC.

1. Organization:

2. Plan tested CP or DR:

3. Date of Test:

4. Time started:

5. Time ended:

6. Participants:

7. Where test objectives met? If no explain?

8. Did key OI&T staff know where the plan was maintained?

Tabletop Exercise

1. Did your staff attend the tabletop exercise?

2. Which staff members were?

3. What were the lessons learned?

Functional Test

4. Were your plan assumptions correct?

5. Were the roles and responsibilities clear in the plan?

6. Was training conducted on the plan participants roles and responsibilities?

Activation

7. Did the activation process work?

· Was the ECC notified during the notification process; was the ECC listed in the plan?

· Did the call back rosters work? Do they need updating?

· How were the customers notified?

8. Was the outage assessment completed? Were the details of the outage assessment team well documented in the plan?

9. Was an ANR created and who initiated the ANR?

· ANR#

· ServiceNow#

10. If VANS was used to start this exercise, were you notified via VANS?

Recovery

11. Did the ECC establish a VANTS line?

12. Is there a priority for restoration in your plan?

13. Who are the customers of the system affected?

14. Explain the internal communication process during the outage with the VA customers?

15. Explain what how the customer was affected during the outage.

16. Explain how the customer will continued business operations during an actual outage of this kind?

17. Were work around procedures used, if so what were they?

Reconstitution

18. Was data restored from backup media?

19. How was the data integrity checked and by whom?

20. Were the cleanup procedures used? What were they?

21. Were the deactivation procedures correct? Are the plan’s procedures accurate?

22. Describe the restoration process?

23. Was the IS Service restored within the RTO?

24. Was RTO appropriate for the affected system?

Lessons Learned

25. What were your lessons learned from this exercise?

26. Will the lessons-learned cause changes in the plan?

If yes, which paragraphs:

27. Other comments:

Attachments (if applicable)

A. Planning policy letters

B. Role-based training list

C. Tabletop

a. Slides

b. Attendance/Notes

D. Event

a. Slides

b. Attendance

c. ANR

d. CASD

E. Functional Test

a. Notes from Health, Benefits, Memorial, Corporate Support

b. Screen captures of pre/post dataset (before and after restoration) Signature Page:

[Name] [Title] Test Observer image1.jpeg image2.emf