30202r2.pdf

UNCLASSIFIED

NI 3020.2R2 Approved 22 February 2008 Subgroup: Plans and Operations

UNCLASSIFIED 1

NGA Instruction for

Information Technology Disaster Recovery Planning

1. References.

a. Primary. NGA PD 3000R5, Policy Directive for Plans and Operations, 5 January 2004.

b. Secondary.

(1) Federal Information Security Management Act (FISMA) of 2002.

(2) DoDD 3020.26, Defense Continuity Program, 8 September 2004

(3) DoDI 3020.39, Integrated Continuity Planning for Defense Intelligence, 3 August 2001.

(4) DoDI 8500.2, Information Assurance (IA) Implementation, 6 February 2003.

(5) DCID 6/3, Protecting Sensitive Compartmented Information within Information Systems, 11 December 2003.

(6) NGA Policy Notice 3020.1, Integrated Continuity Planning, 7 June 2005.

(7) NGA Instruction 3020.1R9, NGA Instruction for Disaster Preparedness, 12 August 2005.

(8) NGA Instruction 8010.3R5, NGA Instruction for Certification and Accreditation of Information Systems, 8 December 2003.

(9) National System for Geospatial-Intelligence (NSG) Statement of Strategic Intent, March 2007

(10) NIST SP800-53, Recommended Security Controls for Federal Information Systems, December 2006.

2. Purpose. Establish policy and assign responsibilities for Information Technology Disaster Recovery (ITDR) planning functions in support of National, Department of Defense (DoD), Intelligence Community (IC), NGA Emergency Preparedness (EPP), Continuity of Operations (COOP), and Business Continuity (BCP) planning goals and objectives. This instruction supersedes NI 3020.2R1, same title, 20 October 2005.

UNCLASSIFIED 2

3. Policy. To fulfill its mission, NGA must ensure the effective continuation of its mission-essential functions. Information systems are vital enablers of virtually all NGA mission-essential functions. To meet externally directed continuity requirements and the NSG Strategic Goal of guaranteeing operational continuity, NGA will ensure an enterprise-wide approach for survival, continuity, recovery, and restoration of all mission-critical as well as mission-essential information technology (IT) functions in the event of a natural or man-made disruption to its mission. ITDR planning supports this requirement through the establishment of thorough plans, procedures, and technical measures that will enable the quick and effective recovery of NGA information systems, applications, and data following a service disruption or disaster.

4. Applicability and Scope. This instruction applies to all NGA organizations. It governs all Agency activities concerning planning and preparation for the survival, continuity, recovery, and restoration of NGA information systems (including contractor and vendor operated systems and systems in the acquisition cycle and development phase) and infrastructure following natural or man-made disruptions.

5. Definitions. See Appendix.

6. Responsibilities.

a. NGA Executive Committee (EXCOM) will:

(1) Oversee ITDR planning as a command responsibility and ensure integration into the NGA mission.

(2) Make sound risk-management and funding decisions to resource, plan, and prepare for the survival, continuity, recovery, and restoration of NGA’s mission-critical and mission-essential information systems, applications, and data when faced with man-made or natural threats or incidents.

b. NGA Chief Information Officer (CIO) will:

(1) In support of Agency mission-essential functions, ensure the survival, continuity, recovery, and restoration of NGA’s mission-critical and mission-essential information systems, applications, and data when faced with man-made or natural threats or incidents.

(2) Lead development of an enterprise-wide data backup, storage and recovery strategy to ensure the integrity and survival of critical information resources and ensure information systems that create, process, store, and transmit classified or sensitive but unclassified information are protected and backed up in accordance with DoD and IC policy.

UNCLASSIFIED 3

c. NGA Designated Accrediting Authority (DAA) will:

(1) Ensure ITDR plans have been developed for all systems requesting certification and accreditation (C&A) prior to granting Authority to Operate (ATO).

(2) Provide guidance and support to ensure the expeditious accreditation of all reconstituted information systems following recovery operations in the event of a disaster.

d. NGA CIO Information Security Office (CS), Mission Assurance Division (CSM) will:

(1) Provide strategic planning, policy, guidance, support, and programmatic review and validation for NGA enterprise ITDR planning as part of an overall Agency Business Continuity Strategy.

(2) In conjunction with the NGA Chief Information Officer (CIO) and other Directorates/Offices, support development of an enterprise-wide data backup, storage, and recovery strategy to ensure the integrity and survival of critical information resources, as well as the protection and backup of information systems that create, process, store, and transmit classified or sensitive but unclassified information.

(3) Routinely conduct formal information systems contingency planning audits to ensure NGA information system owners and managers are in compliance with all applicable ITDR directives and regulations.

e. NGA CIO Information Security Office (CS), Information Assurance Division (CSI), Certifications (CSIC) will:

(1) In the event of a disaster or contingency requiring restoration of NGA IT systems at primary or alternate sites, ensure the confidentiality, integrity and availability of NGA’s IT infrastructure by independently assessing the risks and vulnerabilities to reconstitute information systems and make recommendations to the DAA, system owners, and data process owners through the certification and accreditation process.

(2) Provide security certification for reconstituted systems and networks.

(3) Provide security engineering guidance to the Acquisition (A) Directorate as required.

f. Acquisition (A), Procurements and Contracts Office (AC) will ensure that disaster recovery planning is included as an inherent part of all information systems acquisition, engineering, development, integration, and operations and sustainment contracts.

UNCLASSIFIED 4

g. Acquisition (A), Systems Office (AS) will:

(1) Ensure disaster recovery plans for all new NGA information systems are included in the final deliverable(s).

(2) Ensure disaster recovery plans for all new NGA information systems are tested prior to delivery and transition to operational status.

h. NGA Directorates and Offices will:

(1) In conjunction with the EXCOM, make sound risk-management and funding decisions to resource, plan, and prepare for the survival, continuity, recovery, and restoration of their respective mission-critical and mission-essential IT assets and data when faced with man-made or natural threats or incidents.

(2) In conjunction with CS, identify ITDR Plan Coordinators for each NGA-owned system; ensure understanding through training of the ITDR policy and planning process and its place within the NGA COOP and BCP processes.

(3) Ensure all Directorate owned information systems have documented disaster recovery plans, and plans have been tested for viability.

(4) Ensure facility ITDR Incident Management Teams (IIMT) have been identified and disaster recovery procedures have been exercised.

i. NGA information system owners and managers will:

(1) Serve as the ITDR Plan Coordinator for all information systems for which they have responsibility, or designate this responsibility to a surrogate.

(2) In conjunction with Directorate Business Continuity Planners and system users, coordinate completion of Technology Impact Analyses (TIA) and Technology Risk Assessments (TRA) for all information systems for which they have responsibility.

(3) Per DCID 6/3 and in conjunction with system users, customers, and stakeholders, determine and assign the appropriate Level of Concern (LOC): Availability, Confidentiality, and Integrity for all information systems for which they have responsibility. Definitions are located in the Appendix.

UNCLASSIFIED 5

(4) Per DoDI 8500.2 and in conjunction with system users, customers, and stakeholders, determine and assign the appropriate Mission Assurance Category (MAC) for all information systems for which they have responsibility. Definitions are located in the Appendix.

(5) Coordinate development of an ITDR strategy to ensure the survival of all information systems for which they have responsibility.

(6) Commensurate with the level of protection required per the assigned LOC for Availability and MAC, develop and document ITDR plans for all information systems for which they have responsibility and ensure that they are accessible for future reference in the event of a disaster.

(7) In accordance with DCID 6/3 and DoDI 8500.2, ensure ITDR plans are appropriately exercised, updated, and maintained (annually at minimum, semi-annually for MAC I systems) for all information systems for which they have responsibility.

(8) Ensure any ITDR plan risks/deficiencies highlighted during plan exercise and testing are adequately documented, tracked, and remediated.

j. NGA information system operators, administrators, and maintainers, in conjunction with the appropriate system ITDR Plan Coordinator(s) will:

(1) Support completion of TIAs and TRAs for all systems for which they have responsibility.

(2) Support development of ITDR strategies to ensure the survival of all information systems for which they have responsibility, including consideration for equipment, software applications, data, and networking components.

(3) Support development and documentation of an ITDR plan that can be implemented in the event of a disruptive incident or disaster for all information systems for which they have responsibility.

(a) Document plans using the standard NGA ITDR plan format.

(b) In addition to hard copy, consider remote/on-line access to ITDR plans to facilitate instances where primary facilities may not be accessible.

(4) Exercise, update, and maintain ITDR plans (annually at minimum, semi-annually for MAC I systems) and as key personnel, equipment, UNCLASSIFIED 6 procedural changes, or upgrades require for all information systems for which they have responsibility.

(5) Develop/designate teams to execute recovery ITDR plans/procedures.

k. NGA Business Continuity Planners will:

(1) Work closely with A and E Directorate IT system program managers and support staff to ensure information systems supporting NGA mission-essential functions have adequate ITDR plans in place.

(2) Support Key Component IT system program managers and support staff in appropriately establishing system recovery time objective (RTO), recovery point objective (RPO), and system categorization (for example, MAC and LOC assignment).

(3) Actively participate in NGA ITDR plan test and evaluation.

l. NGA Support Teams (NST) will:

(1) Ensure any required Service Level Agreements (SLA) with the supporting/host organization to provide IT support services (for example, hardware, software, network/communications connectivity, electrical power, HVAC, office supplies, etc.) are in place.

(2) Ensure all IT infrastructure supporting NST operations is included in the supporting organization’s enterprise ITDR plan.

(3) Participate in supporting organization ITDR program tests, training, and exercises.

7. Procedures. All ITDR planning is based on risk management principles and builds upon the best practices of both government and private sector Agencies and businesses to ensure the survivability of NGA IT assets. ITDR planning represents a broad scope of activities designed to sustain and recover critical IT services following a service disruption. IT systems are vulnerable to a variety of disruptions, ranging from mild (short-term power outage) to severe (equipment or facility fire) and from a variety of sources, such as natural disasters to terrorist actions. While most vulnerabilities can be minimized or eliminated through technical, management, or operational solutions as part of risk management efforts, it is virtually impossible to completely eliminate all risks.

Measures to recover IT services following an emergency or system disruption must be planned, documented, exercised, and maintained at the ready level for implementation, should a disaster occur. The following minimum measures should be taken to ensure the survivability of all NGA mission-critical and mission-essential IT systems and serve as an overview of the ITDR planning process. Detailed guidance for preparing TIAs, TRAs, and ITDR plans, including formats and templates, can be found on the NGANet Mission

UNCLASSIFIED 7

Assurance Office (CS), Continuity Planning Division (CSM) Web Site and within the NGA ITDR Standard Operating Procedures (SOP). NGA information system owners, managers, operators, administrators, and maintainers will:

a. Conduct a TIA. The TIA is conducted to correlate specific IT resources (information systems, components, personnel) with the critical services that they provide, disruption impacts, allowable outage times, and recovery priorities and objectives. This information is then used to characterize the consequences of a disruption to IT resources on overall NGA business operations and mission.

(1) Assess the full range of support provided by the system and correlate and link specific system components and resources with the critical services and functions that they provide.

(2) Identify and coordinate with internal and external points of contact, customers, or service providers to characterize the means that they depend on or support the IT system. It is important to identify organizations that provide or receive data from the system, contacts supporting interconnected systems, and any NGA Interconnection Service Agreements (ISA) for information systems with partnering Intelligence Agencies that may be impacted.

(3) Fully analyze and diagram system hardware, software, network, communications, and data requirements, processes, and interdependencies.

(4) Determine the overall impact on operations if a given IT resource was disrupted or damaged to determine whether a system is mission-critical or mission-essential (definitions are located in the Appendix).

(5) Coordinate with system users and Business Continuity Planners to determine allowable outage times, RTO, and RPO as/if applicable and mitigate any gaps between system recovery and business process recovery objectives.

(6) Determine the sequence of recovery for IT systems and resources through the Enterprise Management Office (EMO).

(7) Develop and assign system and resource recovery requirements, team members, and priorities.

(8) Use CS-provided standard formats and processes for performing TIAs to ensure Agency consistency and operational efficiency.

b. Conduct a TRA and implement risk mitigation measures and controls. The TRA is conducted to determine the events and environmental surroundings that

UNCLASSIFIED 8

can adversely affect information system operations, the damage such events can cause, and the controls needed to prevent or minimize the effects of potential loss.

(1) Identify all potential system threats, impacts, and vulnerabilities to determine risks. All TRAs should consider facility threat assessments performed by other NGA Divisions/Offices (for example, SI), and incorporate applicable sections or information as appropriate. Threats to IT resources come in primarily four forms:

• Natural—fire, flood, earthquake, hurricane, blizzard, tornado

• Human—operator error, sabotage, hacker, terrorist attack

• Mechanical—equipment failure, network outage, internal power failure

• Indirect—external service provider outage, regional power outage, commercial communications provider outage, disruption to utilities

(2) Attempt to determine the risk to the IT system and risk impact on mission readiness based on the likelihood of the threat, threat impact, and probability of occurrence and assign risk levels to the specific threats identified (for example, critical, high, medium, or low).

(3) Identify controls already in place and identify and implement additional risk mitigation measures and controls as appropriate. These controls should prevent incidents from happening or limit the effects of an incident to the Agency’s mission. Some common mitigation measures include the following:

• Uninterruptible power supplies (UPS)

• Gasoline and diesel-powered generators for backup power

• Fire and smoke detectors

• Fire suppression systems

• Water sensors in the computer room ceiling and floor

• Plastic tarps to unroll over IT equipment to protect it from water damage

• Heat-resistant and waterproof containers for backup media

UNCLASSIFIED 9

• Emergency master system shutdown switch

• Frequent, scheduled backups

• Offsite storage of backup media and system documentation

• Redundant systems and communications paths

• System and network security and access controls

(4) Identify and train personnel associated with the system on how and when to use the controls.

(5) Maintain controls in good condition to ensure their effectiveness in an emergency.

(6) Identify residual risks that IT risk mitigation measures and controls cannot prevent and for which contingency plans and disaster recovery strategies must be developed and put into place (for example, a natural disaster or terrorist attack resulting in the destruction of a facility).

(7) Use CS-provided standard formats and processes for performing TRAs to ensure Agency consistency and operational efficiency. Review system risk assessments annually or after any significant changes in hardware or software.

c. Develop ITDR strategies to mitigate residual risks (as indicated in paragraph 7.b.(6)) and recover IT systems from unavoidable and unpreventable disasters.

Recovery strategies include a combination of methods that complement one another to provide recovery capability over the full spectrum of potential incidents. A wide variety of recovery approaches should be considered; the appropriate choice depends on the incident, type of system, and its operational requirements.

(1) Identify all viable system recovery options and assess the advantages, disadvantages, and associated costs (some recovery options may be cost-prohibitive) of each recovery option.

(2) In conjunction with SI, E, A, Acquisition Engineering Office (AE), and other concerned organizations, identify alternate sites to recover IT system operations that consider the amount of space required, communications/network, and other IT infrastructure requirements in the event the primary facility becomes uninhabitable or is destroyed. In general, there are five types of alternate sites available:

UNCLASSIFIED 10

• Dedicated sites owned or operated by NGA

• Sites owned and operated by the Department of Defense, other Government Agencies, or mission partners/allies

• Sites owned or operated by contractors

• Commercially-leased facilities

• Sites owned or operated by co-producer countries

(3) CS coordinates with organizations (for example, SI) on the establishment of alternate operations sites that support IT operations during a contingency or disaster including execution of any required Service Level Agreements (SLAs) for IT support services.

(4) Develop and implement operating system and applications software, data, and file backup requirements and procedures necessary to restore and recover the system or systems and user data in the event of an emergency.

Develop standards to mark and identify backup media to facilitate recovery when and if needed for contingencies.

(5) Identify a secure, offsite storage facility for mission-critical and mission-essential system backup data and media and the method to retrieve offsites tapes following an incident. Offsite data backup and storage must comply with the overarching NGA enterprise storage and restoration strategy.

(6) Ensure that the alternate IT operations site has adequate communications capacity and supports the same backup configuration and hardware as the primary site.

(7) Coordinate with the appropriate A and E offices to establish procedures to procure and deliver all necessary hardware, software, and office supplies to the alternate operations site should IT system hardware and software at the primary facility be damaged or destroyed, or the primary site be unavailable. There are four basic options to accomplish this task:

• Use SLAs with hardware, software, and support vendors to provide equipment in the event of an emergency.

• Purchase required equipment in advance and store at a secure off-site location.

UNCLASSIFIED 11

• Use equipment currently housed and used by another Directorate within the Agency.

• Use equipment made available through the retirement of other systems.

(8) Identify and designate all Disaster Recovery Team (DRT) personnel required to recover and reconstruct the information system at the primary or alternate operations site.

(9) Key Components ensure DRTs are trained and ready to deploy in the event of an emergency requiring information system recovery.

(10) Ensure the chosen recovery strategy can be implemented effectively within existing financial constraints.

d. Develop the ITDR plan. The ITDR Plan must contain detailed roles, responsibilities, teams, technical capabilities, and procedures required to restore an IT system following a disruption.

(1) Identify all IT system components, services, and data that will need to be recovered.

(a) Laptops. NGA laptops do not require ITDR plans unless they serve as core components of a larger production/support system.

However, NGA laptop users should ensure that any critical agency data stored on laptops is appropriately backed up so it can be recovered if necessary.

(b) Contractor Systems. Contractor owned systems not operated at the request of the government do not require ITDR plans.

(c) International Systems. If the End User (EU) production system is wholly owned and operated by the host nation, the host nation bears the responsibility for continuous sovereign operations. In the event of a catastrophic failure of any or all of the IT within the host nation; the EU will exercise sovereign contingency plans to replace failed/damaged materials, to include hardware and software; in accordance with guidance from the host nation government.

(2) Identify and address any associated NGA Inter-Agency Service Agreements (ISA) for IT services and support with partnering Agencies that may also be affected by an adverse event. An existing agreement may require planning for shared responsibility to recover or replace an IT system.

UNCLASSIFIED 12

(3) Document all system components/vital records (e.g., software and hardware configuration, data, communications, architecture diagrams) and plans for transporting backup media from the storage location(s) to the recovery site necessary to recover and reconstruct the system at the alternate site.

(4) Provide detailed step-by-step procedures in the form of narrative annexes or checklists describing how to recover, reconstruct, and perform system operations at the primary or alternate sites for an extended period.

Procedures should at a minimum address the following:

(a) Notification and Activation. This section defines initial actions to be taken once a system disruption or emergency is detected or appears to be imminent; it includes activities to notify recovery personnel, assess system damage, and authorize activation of the ITDR plan.

• Execution of any responsibilities per the facility Emergency Preparedness Plan (EPP)

• Notification of internal and external personnel, to include customers and systems users, associated with the system

• Damage assessment procedures

• ITDR plan activation procedures

(b) Recovery procedures. This section focuses on contingency measures to execute temporary IT processing capabilities at an alternate site, repair damage to the original system and site, or restore operational capabilities at the original or a new facility.

• Creation of backups and storage of backups

• Location and access to the alternate site

• Obtaining necessary office supplies and workspace

• Obtaining and installing necessary communications and network support

• Obtaining and installing necessary hardware and software components

UNCLASSIFIED 13

• Recovery sequences for restoring system software, applications, and data

• Restoring critical operating system and application software

• Obtaining and loading backup media and restoring system and user data

• System connection to network and other internal/external systems

• Testing system functionality and performance

• System access and security controls

• System certification and accreditation

(c) Restoration procedures, if applicable. This section identifies the steps necessary to end temporary IT processing capabilities and recovery activities and transfer operations back to the primary or a new facility.

(5) Identify, designate, and document all DRT personnel and procedures necessary to implement the ITDR plan. Review team personnel assignments annually or as key staff rotate.

(6) CSM provides standard formats, processes, and guidance to personnel who develop and maintain ITDR plans.

(7) Directorates and Offices monitor ITDR plan development for each application, system, and network, or combination, required to meet specific organization operational requirements, internal and external.

e. Exercise the ITDR plan.

(1) Test each ITDR plan element at least annually. MAC I systems require semi-annual testing.

(2) Ensure ability of DRTs and associated personnel to implement the ITDR plan.

(3) Confirm and validate the accuracy of individual recovery procedures.

UNCLASSIFIED 14

(4) Verify compatibility of alternate site and backup facilities and equipment.

(5) Assess overall effectiveness of the ITDR plan. CSM, in accordance with applicable regulations and standards, provide criteria against which to measure/evaluate plan effectiveness.

(6) CSM plans, develops, and provides oversight for ITDR testing, training, and exercise (TT&E).

(7) Directorates and Offices ensure annual maintenance, training, and exercise of organization ITDR plans supporting mission-critical functions.

f. Maintain ITDR plans in a ready state that accurately reflects system requirements, procedures, organizational structure, and policies.

(1) Review and update plans periodically (at minimum annually) to ensure new information is documented and contingency measures are revised if required.

(2) Review and updates plans whenever significant changes occur to any element of the plan (that is, key personnel, business process improvements, hardware and software upgrades), and keep Information System Security Officers (ISSOs) informed of any changes.

g. Implement the ITDR plan(s) in the event of a disaster. Ultimately, NGA and its Divisions/Offices will use a suite of plans (for example, Emergency Preparedness Plans (EPP), COOP, BCP, and ITDR plans), in conjunction with an integrated NGA Crisis Response Plan, to adequately prepare resumption, recovery, and restoration activities for disruptions affecting the organization’s facilities, command and control, business processes, and IT systems. Personnel authorized to declare a disaster and to implement the ITDR plan should be identified within the ITDR plan itself. ITDR plan implementation will normally coincide with EPP, COOP, and BCP activation.

(1) The NGA Site Incident Commander (IC) and the Incident Management Team (IMT) have the overall responsibility for coordinating all NGA facility disaster recovery efforts and ensuring safety of all personnel in conjunction with local IMT authority.

(2) As the IC/IMT is monitoring the situation at the incident site, the Office of the NGA Command Center (ONC) activates the Command Center Augmentation (CCA). The CCA is a group of subject matter experts that provide information support to the ONC and the EXCOM.

UNCLASSIFIED 15

(3) Once the IC/IMT declares the facility or area safe for work to commence, the E Site Leads, under the auspices of the NGA CIO and Director of E, implement ITDR plans and coordinate information systems recovery efforts for their assigned facilities. Status reports on actions taking place at the incident site are sent to the SI Operations Center and the ONC/CCA. The Enterprise Service Center (ESC) will serve as the Operations Center for the Director, Enterprise Operations (E).

UNCLASSIFIED 16

Appendix

Definitions

Note: The following definitions have been derived from multiple sources. The majority are taken from the Disaster Recovery Institute International’s (DRII) Professional Practices Glossary. DRII is the internationally recognized organization that established the continuity planning industry's international standards/professional practices for Business Continuity Planners. Other definitions are taken directly from within DoD regulations. The associated DoD regulation is referenced immediately following the definition. Additionally, some definitions have been modified slightly for applicability within NGA. These definitions will usually include the acronym “NGA” within the definition.

1. Activation: The implementation of business continuity capabilities, procedures, activities, and plans in response to an emergency or disaster declaration; the execution of the recovery plan.

2. Allowable Outage Time: The maximum allowable time that a resource can be unavailable before the resulting impact becomes unacceptable.

3. Alternate Site: An operating facility or location to be used by business functions when the primary facility is unavailable.

4. Backup: A copy of data, files, and/or programs made to facilitate information system and process recovery if and when necessary.

5. Business Continuity Plan (BCP): A document that defines resources, recovery responsibilities, and a predetermined set of instructions or procedures that describe how business processes will be restored after a significant disruption to business operations has occurred.

6. Business Continuity Planning: As it applies to the Defense Intelligence Components, BCP focuses on the Component's ability to continue or quickly recover its mission-essential functions following any disruption short of a major catastrophe or national security emergency. BCP may be incorporated into a specific plan or, when appropriate, in documents such as standard operating procedures, and generally are distributed widely so that all relevant personnel are familiar with the required procedures and associated responsibilities. (Ref: DoDI 3020.39)

7. Business Disruption: Any event, whether anticipated (for example, public service strike) or unanticipated (for example, blackout), that disrupts the normal course of business operations.

UNCLASSIFIED 17

8. Business Functions: Basic operating procedures used on a routine basis during normal operations that make up and support business processes.

9. Business Process: A compilation of primary business functions that represent a key element of current business operations.

10. Business Recovery Process: The common critical path that all components follow during a recovery effort. There are major phases along the path that are followed regardless of the component. The process generically encompasses procedures to include emergency response, plan activation, recovery, and restoration.

11. Clinger-Cohen Act: Enacted in 1996, the Clinger-Cohen Act requires the heads of Federal agencies to link IT investments to Agency accomplishments. The Clinger- Cohen Act also requires that Agency heads establish a process to select, manage, and control their IT investments.

12. Configuration: The functional and/or physical characteristics or layout of hardware, software, firmware, and facilities as set forth in technical documentation and designed into a product.

13. Contingency Plan: Plan used by an organization to respond to a specific system’s failure or disruption of operations designed to maintain or restore business operations, including computer operations, in the event of an emergency or disaster. A contingency plan may use any number of resources including workaround procedures, alternate work areas, reciprocal agreements, or replacement procedures.

14. Continuity of Operations Plan (COOP): The NGA COOP plan provides guidance for the continuity of NGA leadership during any contingency. The COOP plan focuses on restoring NGA's Command structure and vital command and control functions at an alternate site. Because the COOP plan addresses command-level issues, it is developed and executed independently from Directorate/Office Business Continuity Plans (BCPs) and Information Technology Disaster Recovery (ITDR) Plans.

15. Continuity of Operations (COOP) Planning: As it applies to the Defense Intelligence Components, it focuses on the Component's ability to continue mission-essential functions without unacceptable interruption in situations such as catastrophes or national security emergencies. It includes preparatory measures, response actions, and restoration activities that ensure these functions continue to maintain military effectiveness, readiness, and survivability. COOP planning designates mission-essential functions and essential personnel, alternate headquarters and work sites, and alternate processes for conducting mission-essential functions from these work sites. (Ref: DoDI 3020.39)

UNCLASSIFIED 18

16. Damage Assessment: The process of assessing physical damage, following a disaster, to computer hardware, vital records, or office facilities, and determining what can be salvaged or restored and what must be replaced.

17. Dependency: A key element that directly supports a business function(s) in day-to-day normal operations. Examples include applications and systems, interfaces, and IT infrastructure elements.

18. Disaster: A sudden, unplanned calamitous event causing great damage or loss, or any event that creates an inability on the Agency’s part to provide critical business functions for a predetermined period of time.

19. Disaster Recovery: Activities and programs designed to return an entity to an acceptable condition, or the ability to respond to service interruptions by implementing a disaster recovery plan to restore an organization’s critical business functions.

20. Disaster Recovery Plan: The document that defines the resources, actions, tasks, and data required to manage the business recovery process in the event of a business interruption. The plan is designed to assist in restoring business processes within stated disaster recovery goals.

21. Disaster Recovery Planning: The advance planning and preparations necessary to minimize loss and ensure continuity of an organization’s critical business functions in the event of a disaster.

22. Disruption: An unplanned event that causes the general system or major application to be inoperable for an unacceptable length of time (for example, minor or extended power outage, extended unavailable network, or equipment or facility damage or destruction).

23. Emergency: A sudden, unexpected event requiring immediate action due to potential threat to health and safety, the environment, or property.

24. Emergency Preparedness Plan (EPP): Plan developed by the SI site manager at each NGA site to provide information to respond, control, mitigate, and recover from the impacts of an emergency or disaster occurring on or near NGA facilities.

25. Exercise: Announced or unannounced execution of business continuity and disaster recovery procedures intended to implement existing plans and/or highlight the need for additional plan development. A comprehensive exercise typically includes the recovery of all mission critical systems and the restoration of all critical business functions. Exercises are performed for the purpose of training and conditioning team members and improving their performance.

UNCLASSIFIED 19

26. File Backup: The practice of copying a file stored on disk or tape to another disk or tape. This is done at specified intervals for protection in case the active file is damaged.

27. Information System (IS): Refers to any telecommunications or computer related equipment or interconnected system or subsystem of equipment that is used in the acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of voice, video, or data (digital or analog); includes software, firmware, hardware, and documentation. (Ref: DCID 6/3)

28. Information Technology (IT): Any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information.

29. Information Technology Disaster Recovery (ITDR): The act or actions required to recover critical information systems applications and processes after a major hardware and software failure, communications and network outage, or destruction of facilities has occurred.

30. IT Disaster Recovery Planning: A process that focuses on data/computing center and/or local/wide area network recovery following a disruption including specific actions for restoring or recovering IT and other systems after they fail. These plans usually include the procedures to safeguard information by conducting backups or similar procedures to permit the restoration of information. These plans are prepared by system administrators, but include appropriate links to the business continuity plans of all functions that rely on that system or IT component. (Ref: DoDI 3020.39)

31. Information Technology Disaster Recovery Plan: A written plan documenting precautions and measures to be taken so that the effects of a disaster on an organization’s IT infrastructure, critical systems applications, and data resources are minimized and the organization will be able to either maintain or resume mission-critical functions in a reasonable amount of time. The plan normally includes specific, step-by-step procedures for recovering critical information systems applications and processes to implement in the event of a major hardware and software failure, communications and network outage, or destruction of facilities.

32. Information Technology Disaster Recovery Program: Set of standard planning guidelines, policy, and procedures for the development of ITDR plans throughout

NGA.

33. Information Technology Disaster Recovery Test: Demonstration of the necessary knowledge, skills, and procedures required to correctly recover a particular information system’s hardware, operating system software, application software, communications and network connectivity, and associated data, files, or user

UNCLASSIFIED 20

information that supports the Agency’s mission should a disaster, natural or man-made, occur.

34. Level of Concern: The Level-of-Concern is a rating assigned to information systems by the DAA. A separate Level-of-Concern is assigned to each information system for confidentiality, integrity, and availability. The Level-of-Concern for confidentiality, integrity, and availability can be Basic, Medium, or High. The Level-of-Concern assigned to an IS for confidentiality is based on the sensitivity of the information it maintains, processes, and transmits. The Level-of-Concern assigned to an IS for integrity is based on the degree of resistance to unauthorized modifications. The Level-of-Concern assigned to an IS for availability, and most closely associated with ITDR requirements, is based on the needed availability of the information maintained, processed and transmitted by the system for mission accomplishment, and how much tolerance for delay is allowed. (Ref: DCID 6/3)

35. Loss: The unrecoverable business resources that are redirected or removed as a result of a business disruption. Losses may be loss of life, facilities, or operational capability.

36. Mission Assurance (MA): Functions that support development and coordination of plans and capabilities that ensure the continued production and uninterrupted flow of critical geospatial intelligence to customers.

37. Mission Assurance Category (MAC): Applicable to all DoD information systems, the Mission Assurance Category reflects the importance of information relative to the achievement of DoD goals and objectives, particularly the warfighters' combat mission. Mission assurance categories are primarily used to determine the requirements for availability and integrity. (Ref: DoDI 8500.2)

38. Mission Assurance Category I (MAC I): Includes systems handling information that is vital to the operational readiness or mission effectiveness of deployed and contingency forces in terms of both content and timeliness. The consequences of loss of integrity or availability of a MAC I system are unacceptable and could include the immediate and sustained loss of mission effectiveness. MAC I systems require the most stringent protection measures. (Ref: DoDI 8500.2)

39. Mission Assurance Category II (MAC II): Includes systems handling information that is important to the support of deployed and contingency forces. The consequences of loss of integrity are unacceptable. Loss of availability is difficult to deal with and can only be tolerated for a short time. The consequences could include delay or degradation in providing important support services or commodities that may seriously impact mission effectiveness or operational readiness. MAC II systems require additional safeguards beyond best practices to ensure assurance. (Ref: DoDI 8500.2)

UNCLASSIFIED 21

40. Mission Assurance Category III (MAC III): Includes systems handling information that is necessary for the conduct of day-to-day business, but does not materially affect support to deployed or contingency forces in the short-term. The consequences of loss of integrity or availability can be tolerated or overcome without significant impacts on mission effectiveness or operational readiness. The consequences could include the delay or degradation of services or commodities enabling routine activities. MAC III systems require protective measures, techniques, or procedures generally commensurate with commercial best practices. (Ref: DoDI 8500.2)

41. Mission Essential Function (MEF): The specified or implied tasks required to be performed by, or derived from, statute or Executive order, and those organizational activities that must be performed under all circumstances to achieve DoD Component missions or responsibilities in a continuity threat or event. Failure to perform or sustain these functions would significantly impact DoD ability to provide vital services, or exercise authority, direction, and control. (Ref: DoDI 3020.26)

42. Mission-Critical Information System: A system that meets the definition of

"information system" in the Clinger-Cohen Act (see definition of Information System above), the loss of which would cause the stoppage of warfighter operations or direct mission support of warfighter operations. (Ref: DoDI 5000.2)

43. Mission-Essential Information System: A system that meets the definition of

"information system" in the Clinger-Cohen Act (see definition of Information System above), that the Component Head determines is basic and necessary for the accomplishment of the organizational mission. (Ref: DoDI 5000.2)

44. Network Outage: A disruption in system availability as a result of a communication failure affecting a network of computer terminals, processors, or workstations.

45. Operating System Software: A type of system software that, after being initially loaded into a computer by a boot program, manages all the other programs in a computer.

46. Reciprocal Agreement: Agreement between two organizations (or two business groups) with basically the same equipment and environment that allows each one to recover at each other’s site, or an agreement that allows two organizations to back up each other.

47. Recovery Capability: All of the components necessary to perform recovery. These components can include a plan, a recovery location, change control process, network rerouting, and others.

48. Recovery Location: A location, other than the primary location, used to process data or conduct critical and important business operations in the event of a business disruption. The facility is equipped with power, data, telecommunications lines, and

UNCLASSIFIED 22

space to make available necessary equipment, furniture, and records to continue business operations.

49. Recovery Point Objective (RPO): The point in time to which systems and data must be recovered after an outage (e.g., end of previous day's processing). RPOs are often used as the basis for the development of backup strategies, and as a determinant of the amount of data that may need to be recreated after the systems or functions have been recovered.

50. Recovery Procedures: Recovery procedures are contained within BCPs and IT Disaster Recovery Plans. They document the actions and activities that are necessary to recover normal business operations following a business disruption.

51. Recovery Strategy: An organizational approach and methodology ensuring its recovery and continuity in the face of a disaster or other major outage. There may be one methodology and solution or a combination of methodologies and solutions in an organization’s strategy.

52. Recovery Time: The period from the business disruption to the recovery.

53. Recovery Time Objective (RTO): The period of time within which systems, applications, or functions must be recovered after an outage (for example, one business day). RTOs are often used as the basis for the development of recovery strategies and as a determinant as to whether or not to implement the recovery strategy during a disaster situation. RTO is derived from the point/time of service disruption.

54. Response: The reaction to an incident or emergency to assess the damage or impact and to ascertain the level of containment and control activity required.

55. Restoration: Process of planning for and/or implementing procedures for the repair or relocation of the primary site and its contents, and for the restoration of normal operations at the primary site.

56. Risk: The expected loss from a given attack or incident, the potential for exposure to loss. Risks, either man-made or natural, are constant.

57. Risk Assessment and Analysis: Process of identifying the risks to an organization, assessing the critical functions necessary for an organization to continue business operations, defining the controls in place to reduce organization exposure, and evaluating the cost for such controls. Risk analysis often involves an evaluation of the probability of occurrence of a particular event.

58. Risk Management: The ongoing process of assessing the risk to mission and business operations as part of a risk-based approach used to determine adequate

UNCLASSIFIED 23

security for a system by analyzing threats and vulnerabilities and selecting appropriate, effective controls to achieve and maintain an acceptable level of risk.

59. Risk Mitigation: Implementation of measures to deter specific threats to the continuity of business operations or respond to any occurrence of such threats in a timely and appropriate manner.

60. System: Refers to any telecommunications or computer related equipment or interconnected system or subsystem of equipment that is used in the acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of voice, video, or data (digital or analog);

includes software, firmware, hardware, and documentation.

61. Technology Impact Analysis (TIA): An analysis of an IT system’s requirements, processes, and interdependencies (assessing the critical business functions supported by that IT system) used to characterize system contingency requirements and priorities in the event of a significant disruption.

62. Technology Risk Assessment (TRA): Process of identifying the risks to an IT system, defining the controls already in place and needed to reduce the systems exposure to risk, and evaluating the cost for such controls.

63. Threat Assessment: Process of formally evaluating the degree of threat to an information system and describing the nature of the threat.

64. Threat: Any circumstance or event with the potential to cause harm in the form of destruction or disclosure.

65. Vulnerability: A weakness that could be exploited.