Section_J-Section_C.5_Attachment_C.5_ISCP_Testing_Checklist_-_Blank.pdf

Template Version 3.0– 07/01/2015

TIRNO-16-R-00026 IEP 1.5

SECTION J-ATTACHMENT C.5 5 ISCP Testing Checklist - Blank

APPLICATION ISCP TESTING CHECKLIST

IT, Cybersecurity, Security Risk Management (SRM) Security Controls Testing & Evaluation

Disaster Recovery Testing & Business Analysis (DRTBA)

Use this Checklist as an artifact for Treasury FISMA Inventory Management System (TFIMS) to record changes to the content of the Information System Contingency Plan (ISCP) based on information gathered during Testing Training & Exercise (TT&E) activities documented in Parts A, B, and C of this Checklist. Completion and documentation of these TT&E activities also provide evidence that the following requirements in the NIST 800-53A, Rev 3 (May 2010) and NIST 800-53, Rev 4 (April 2013) Appendix F, Contingency Planning Class are met: CP-2 Contingency Plan and CP-4 Contingency Plan Testing.

In preparation for the Exercises and Tests to be performed and captured in this Checklist the Business Owner must ensure that each participant has a copy of the most current version of the ISCP (received from DRTBA). The Business Owner is the only party authorized to share copies of the ISCP and is also responsible for reviewing the most current version of the POA&M prior to performing the exercises or tests to determine whether appropriate open issues or recently closed issues exist that need to be resolved during testing.

Double click on the applicable check boxes below and click on ‘checked’ to enter an X in the appropriate box.

Enter version and date of the ISCP being exercised and/or tested:

(FISMA 15 version in TFIMS downloaded and reformatted by DRTBA with new ISCP template changes)

Is this a new asset going through the Enterprise Life Cycle (ELC) process? Yes No If this is a new asset going through the ELC process, changes identified during the tabletop will be included on this checklist and in the ISCP updated by the FISMA Certification Program Office (CPO).

1. a) Type of Exercise:

Tabletop Exercise (Required for all IRS FISMA Assets) Functional Exercise (Required for all IRS FISMA Assets with a Moderate & Low Availability) Alternate Site Processing Environment (ASPE) Test (Required for all IRS FISMA Assets with High Availability & CIP assets)

1. b) Duration of Exercise:

Tabletop Exercise Beginning Time:

Tabletop Exercise Ending Time:

2. a) Application Name & Acronym:

2. b) Physical Location(s) of Application servers/hardware must be populated below by entering the Name of Site and City, State. Please indicate if a site has not been designated. DO NOT LEAVE ITEMS BLANK. If site not designated, enter in Summary Issues at the end of PART A.

Production Site:

Alternate Processing Site:

Development Site (where server(s) reside):

Offsite Storage Location:

3. a) Authorizing Official (AO) Name:

AO Title:

AO Email:

3. b) Authorizing Official Designated Representative (If Applicable):

AODR Title:

AODR Email:

4. a) Hosting Platform(s) of Application: IBM Unisys UNIX Linux Windows 2000 2003 2008 Other List:

4. b) List the platform System(s) that hosts the Application:

5. List Participants (& Business Units (BU)) Representing Application Business Owner(s) during Test/Exercise (i.e., BOD Application POCs, BOD Project Managers, BOD PMOs, etc.):

Verify Business Owner Representatives are present

6. List Participants (& Business Units (BU)) Representing Support Organizations during Test/Exercise (i.e., IT PMOs & Liaisons, EOps, UNS, Application Developers, SRM staff, etc.):

Verify Support Organization Representatives are present

7. Additional Supporting Information Needed for ISCP Exercises and Tests:

a) Does TFIMS contain POA&M information for the Application named in item 2 above related to ISCP, DR, Contingency and/or Continuity planning? Yes No If yes, give a brief description of the finding(s) and discuss possible solutions during the Tabletop Exercise:

(If TFIMS was not checked for POA&M items, BU must do so before this Checklist is submitted to the Authorizing Official for signature )

b) Which of the following occurred during the past year relating to the Application named in item 2 above? (Check all that apply) Hardware Changes Software Changes Operating System Changes Physical Relocations

No Changes

Part A: Tabletop Exercise

Name of DRTBA Facilitator:

Name & Organization of Data Collector:

Purpose of Tabletop Exercise: The purpose of this tabletop exercise is to test and/or exercise the contents of the ISCP for the application named in item 2 above to determine the plan’s accuracy and the organization’s readiness to execute the plan. As the participants are familiarized with the content of the ISCP, they will address system/organizational changes or problems encountered during plan implementation, execution, testing or deactivation.

Changes identified during the tabletop exercise will be captured on this checklist and incorporated into the ISCP by the BU within 15 work days after the date the AO has signed this checklist or no later than June 1, whichever comes first.

Scope: The scope of this tabletop exercise applies to the application named above in item 2 as installed at the location(s) listed and on the platform(s) identified in item 4.

Methodology: Participants identified in items 5 and 6 above will receive the most current copy of the ISCP for the application named above in item 2. They will become familiar with the contents of the ISCP in order to participate in a structured walkthrough of the primary sections of the ISCP. The walkthrough will demonstrate the participants’ understanding of individual roles and responsibilities captured in the plan. Use scenario simulations to assist in the exercise, if relevant, for exercising recovery procedures in the ISCP.

Objectives of the Tabletop Exercise: Objectives of the exercise are to:

- Review ISCP and familiarize participants with the notification and recovery procedures in the plan;

- Walk through and validate the roles and responsibilities and the processes and procedures in the ISCP;

- Identify needed updates, lessons learned, or changes to the ISCP and notate them in the appropriate sections of this Checklist.

Scenario – Application Failure:

A localized threat at the primary production location has caused a disruption of the Application listed in item 2 on page 1 of this Checklist. The application/server has become inoperable and recovery procedures at an alternate site must be initiated.

Recovery personnel at the alternate site have been notified to begin recovery activities.

Global Changes:

The following changes to the ISCP may be global in scope.

Annotate content changes in red for the entire document:

Lessons Learned:

Section 1 Introduction

Section 1 contains Introductory information for the ISCP. It documents the Background, Scope, and Assumptions.

Annotate content changes in red for Section 1:

Section 2 Supporting Information

Section 2 contains the Supporting Information for the Application to include; Description, Environment, Application Users and ISCP Roles & Responsibilities.

Annotate content changes

Section 2:

Section 3 Activation, Notification & Outage Assessment

Section 3 describes activation of the ISCP and how key personnel are notified when a disruption occurs.

Discussion: Is the Enterprise Service Desk (ESD) the first point of contact during an outage or disruption?

Yes No

If no, who is the initial point of contact?

How are Business Application Users notified in the event of an outage or disruption?

Is there a call tree in place for the Recovery Teams?

Who is responsible for alerting the recovery team in the event of a disruption, outage, or disaster?

Annotate content changes

Section 3:

Section 4 Recovery Phase

Section 4 includes procedures and activities that focus on contingency measures to recover IS processing capabilities.

Enter responses for the questions below:

Is the application fully dependent on the System for operation and user functionality?

Yes No

Are Application backups performed by IT? Yes No

If no, who conducts backups?

Are backups encrypted before being shipped off-site? Yes No

Are keystroke recovery procedures included in Section 4.2.2? Yes No

Annotate content changes

Section 4:

Section 5 Reconstitution Phase

Section 5 describes how to restore the application to its original condition.

Annotate content changes

Section 5:

Appendix A:

Appendix A contains a list of Internal Stakeholders, ISCP Leadership, ISCP Recovery Teams, Building and Facility POCs, Key Personnel Acceptance Sheet and Vendor Specific Contacts.

Enter responses for the questions below:

Have Key Stakeholders who require a copy of the ISCP been identified in Appendix A?

Have Key Personnel that support this Application been advised of their role as described in the ISCP?

Have key personnel acknowledged that they understand that they may be called on to perform recovery and resumption duties?

Is there a process in place for key personnel to review updates and acknowledge receipt of the ISCP?

Annotate content changes

Appendix A:

Non-Primary Appendixes

B - Service Level Agreements (SLA) C – Threats and Preventive Controls D – Report Toolkit

Review Appendix B, C and D. Indicate any required content changes below.

Annotate content changes in red for Appendixes B, C and D:

Appendix E:

Appendix E contains the Business Impact Analysis (BIA) information.

Enter responses for the questions below:

What is the Recovery Time Objective (RTO) for the application?

What is the Recovery Time Objective (RTO) for the System Platform?

Does the application RTO take into consideration that the host system must be restored before the application can be recovered?

What are the Application level CBPs listed in Appendix E.2.8?

Does the Application have Alternate or Work Around Procedures? Yes No

If yes, who is responsible for ensuring the secondary activities are implemented?

Are the names and the activities included in Appendix A?

Who is responsible for performing these activities?

Annotate content changes

Appendix E:

Contingency Planning Controls The following Contingency Planning (CP) controls are from NIST SP 800-53, Rev. 4.

Control

Control Name Description Common Control?

CP-1 Contingency Planning Policy and Procedures

A formal, documented contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance

Yes

CP-2 Contingency Plan (including plan update)

Contingency plan for the information system that identifies: restoration priorities, CBPs, BIA information, contingency roles and contact information, full restoration without deterioration of the security measures, contingency plan changes, and is approved by the AO.

Yes

CP-3 Contingency Training

The organization trains personnel in their contingency roles and responsibilities with respect to the information system and provides refresher training

Yes

CP-4 Contingency Plan Testing

Tests and/or exercises the contingency plan for the information system annually using tabletop/functional exercises and DR Tests to determine the plan’s effectiveness and the organization’s readiness to execute the plan; and reviews the contingency plan test/exercise results and initiates corrective actions. (Objective A, B, Enhancements 1, 2)

Yes

CP-5 (Withdrawn) Contingency Plan Update N/A

CP-6 Alternate Storage Site

The organization establishes an alternate storage site including necessary agreements to permit the storage and recovery of information system backup info.

No

CP-7 Alternate Processing Site

Establishes an alternate processing to permit the resumption of information system operations for essential missions and business functions.

No

CP-8 Telecommunica-tions Services

The organization establishes alternate telecommunications services. No

CP-9 Information System Backup

Conducts backups of user and system level info, & security-related info, and protects confidentiality and integrity of backup info at storage location. (Enhancement 1)

Yes

CP-10 Information System Recovery & Reconstitution

The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

No

CP-11 Alternate Communications Protocols

The information system provides the capability to employ [organization defined alternative communications protocols] in support of maintaining continuity of operations.

Not Selected

CP-12 Safe Mode The information system, when [organization-defined conditions] are detected, enters a safe mode of operation with [organization defined restrictions of safe mode operation].

Not Selected

CP-13 Alternative Security Mechanisms

The organization employs [organization defined alternative or supplemental security mechanisms for satisfying security functions] when the primary means of implementing the security function is unavailable or compromised.

Not Selected

Summary Results

Actual Results:

Participants were trained on the contents of the ISCP(s) for the application listed in item 2 above?

Yes No

Participants walked through key areas of the ISCP? Yes No

ISCP roles and responsibilities were discussed and changes identified? Yes No

Personnel from the Business Owner participated? Yes No

Personnel from Support Organizations participated (i.e., EOps, Application Development, UNS, etc.)?

Yes No

Result Metric: An acceptable ISCP Tabletop Exercise was completed based on participation from personnel listed in blocks 5 & 6 of this checklist?

Acceptable Not Acceptable

Summary Issues

List issues identified during the exercise that require AO evaluation before Checklist is signed.

POA&M Items List findings identified during the exercise that require corrective action and input into the POA&M in TFIMS.

Date Exercise Completed:

Part B: Functional Exercise

This Section is to be completed by DRTBA personnel (or by Business Owner IT personnel if the application is not supported by IT). Personnel performing this Functional Exercise must submit the populated and completed Checklist, including supporting evidence, to DRTBA within 10 days after the Functional Exercise is completed.

Ensure that all participants have current copies of the ISCP in TFIMS as the authoritative document used to access the recovery procedures to ensure that the plan and procedures are valid, accurate, and current. Follow guidelines in the ISCP Functional Exercise/Testing Methodology and Procedures.

Documentation of this artifact to complete the Functional Exercise provides evidence to support the testing of CP-6 Alternate Storage Site and CP-9 Information System Backup, requirements in the NIST 800-53, Rev 4 (April 2013) Appendix F family of controls for Contingency Planning Class.

Name & Organization of Facilitator:

Name & Organization of Data Collector:

Purpose of Functional Exercise: The purpose of this exercise is to meet annual ISCP testing requirements and to ensure that appropriate key personnel are able to perform restoration activities for the application as outlined in the ISCP. The use of this checklist during the functional exercise ensures that an artifact is created to document that the exercise was performed.

Scope: The scope of this exercise applies to the application(s) named above in item 2 as installed at the location(s) listed and on the platform(s) identified in item 4.

Methodology: Participants identified in items 5 and 6 above will first be familiarized with the ISCP(s) for the application(s) named above in item 2. Participants will then exercise recovery procedures as described in the plan. Use scenario simulations to assist in the exercise, if relevant, for exercising and testing recovery procedures in the ISCP.

Objectives of the Functional Exercise: Objectives of the exercise are to complete the activities outlined in items 1 through 4 below and document actions on the Checklist. Supporting documentation should also be submitted with the Checklist for each action that is performed.

Expected Results: Participants are expected to complete the exercise activities outlined below in items 1 through 4 and document their actions and results under each activity in the Checklist.

Perform the following activities for the Functional Exercise:

1. Check the backup process to ensure backups are made and verify that the backup media/tapes are readable.

Comments:

Lessons Learned:

a. Evidence: Ensure that the documented evidence validates the following criteria:

To ensure backups are made:

Show the association between the application and the host server name for which backup media was made.

Show the host server name on the evidence document.

Show the name of the back-up tool used to originally save data to backup media.

To verify that backups are readable:

Show that the data on the backup media being read is valid for the application being exercised.

If a screen print is taken of the data, show the association between the screen print and the application.

If an explanation is needed to describe the link between the screen print of the backup media and the application, enter in the comments field below.

b. Provide a screen print or log print with criteria above verifying that the backup was made.

2. Verify that backup media is encrypted and stored at designated alternate/offsite storage locations and retrievable during normal working hours.

Comments:

Lessons Learned:

a. Enter backup media information below:

Name of IRS-owned Alternate/Offsite Storage Facility

Location of IRS-owned Alternate/Offsite Storage Facility

b. Evidence: Ensure that the documented evidence validates the following criteria:

Identify the encryption tool used to encrypt data prior to sending backup media to offsite storage.

If data is not encrypted, document that fact in the Summary Findings area of Part B below.

If data is not sent to an offsite storage location, document that fact in the Summary Findings area of Part B below.

Include on the evidence the date and time that the request for backup media retrieval is made.

Include on the evidence the date and time that the backup media is received by the requestor.

c. Provide routing sheet/form/email request as required by offsite storage facility showing the above criteria.

Summary Results

Actual Results: Back-up media was created? Yes No If no, enter as a Summary Finding below.

Back-up media was stored in an alternate/offsite storage location? Yes No If no, enter as a Summary Finding below.

Back-up media was encrypted? Yes No If no, enter as a Summary Finding below.

Back-up media was able to be retrieved? Yes No If no, enter as a Summary Finding below.

Back-up media was readable? Yes No If no, enter as a Summary Finding below.

Result Metric: An acceptable Functional Exercise was achieved based on the completion as indicated in items 1 through 3 above.

Acceptable Not Acceptable

NIST 800-53A If result metric is acceptable, the Functional Exercise supports testing of CP-4, CP-6, and CP-9 of the NIST family of controls.

Summary Findings

List Vulnerabilities/Findings identified during the exercise that require corrective action and input into the POA&M in TFIMS.

Date Exercise Completed:

Part C: Alternate Site Processing Environment (ASPE) Test or Production Operational Recovery

Ensure that all participants have access to the most current version of the ISCP found in TFIMS as it is the authoritative document used for the recovery procedures. Additionally, existing ISCPs for system recovery must also be used and validated as appropriate. The ASPE Test requires that each participant be prepared to validate that the contents of the ISCP are valid, accurate, and current.

Purpose of Test:

The purpose of testing is to meet annual requirements and to ensure that appropriate key recovery personnel are able to restore the application, component, system, and/or site to an operational state within the timeframe set as the Recovery Time Objective (RTO) for the System or Application, whichever applies, and to determine the effectiveness and the organization’s readiness to execute the ISCP. According to NIST SP 800-84 Section 6, tests can be performed as part of standard operational activities, such as restoring a backup, moving a server from one room to another, upgrading or patching operating systems or applications, or changing hardware components (e.g., swapping hard drives, replacing a failed power supply). Combining tests with operational activities is generally more efficient than performing them separately and is less likely to negatively impact operations.

Objectives of Test:

1. Measure, check, and/or verify whether the component, system, or group of components and systems can be recovered and restored to the intended production configuration and original purpose in the recovery environment to ensure that the recovered production environment functions as originally intended.

2. Demonstrate that the system can be brought to an operational status by following the procedures and instructions described in the keystroke section of the ISCP.

3. Verify that there are a sufficient number of personnel at the recovery site trained to recover systems and production data to the expected state so that operations can resume in a synchronized manner.

Was the application/system included in an ASPE Test? Yes No

If no, and you are using an alternative activity to support testing, such as Production Operational Recovery, complete the sections below starting with Type of Test and provide supporting evidence such as screen shots and recovery start and completion timelines.

If yes, the ASPE Test Plan, Test Case Daily Action Report, Vulnerabilities Matrix, and Executive Overview/Summary Report were completed to document the ASPE Test and are included in the evidence package for the System and Application. Ensure that the AO reviews the Application specific vulnerabilities listed below when submitting the completed Checklist for AO signature.

The following vulnerabilities were identified during the ASPE Test for the Application named on this checklist and are captured in the Vulnerabilities Matrix. The finding(s) must be recorded in TFIMS in the Application POA&M.

Application Finding(s):

Type of Test:

(Double click on the correct box and click ‘checked’)

Component This type of test involves a limited target such as recovery of an application, a server, an operating system, a domain, etc., and includes recovery by a limited group of key recovery personnel and organizations.

System This type of test targets multiple components, organizations, applicable key recovery personnel, and/or sites and would require more coordination than in a component test.

Comprehensive A comprehensive test involves potentially all personnel and full recovery of all components and systems at a site and/or multiple sites. This type of test requires very extensive coordination and planning and must include consideration of all resources, business priorities, and costs necessary to perform the test.

Production Operational Recovery The information documented for this test is a result of KISAM tickets or UWRs that are submitted to request restoration of information systems, installation and/or start up of new systems, OS changes, power failures, etc. Combining tests with operational activities is generally more efficient than performing them separately and is less likely to negatively impact operations.

Other Describe type of test:

Scope of Test:

(Double click on the box and click ‘checked’ for all platforms that apply)

The scope of the recovery test includes the following areas. Enter details for each item below that applies to the test.

Enter Location or Production Site to be Recovered and Location of Recovery Site (i.e., Detroit to Memphis):

Platform(s): IBM Unisys UNIX Linux Windows 2000 Windows 2003 Windows 2008 Network Other

IBM Mainframe: CAPS IAP Master File SACS

System & Title of System:

List Operating System:

LPARs Applications

Unisys

ALNs Applications

System & Title of System:

List Operating System:

UNIX Linux

System & Title of System:

List Operating System(s):

Tested Server Names Domains Applications

Windows 2000 Windows 2003 Windows 2008

System & Title of System:

List Operating System(s):

Tested Server Names Applications

Network Identify components

Other List Operating System(s) (i.e., IOS v 12.3)

Test Recovery Personnel (from IT and BODs in recovery roles)

For Test Results see the documentation included in the Evidence Package.

Examples: System Administrators, Schedulers, Computer Operators, Computer System Specialist, Resident Program Analysts, On-line Systems Computer Specialist, Database Administrator, Business Unit POCs, etc.

Name Title & Org Phone Site Test/Restoration Duties

Backup Media Information For Test Results see the documentation included in the Evidence Package.

Name of Alternate/Offsite Storage

IRS-owned or Vendor-owned

Storage Facility Hours of Operation

Date & Time Backup Requested

Date & Time Backup Delivered

Additional Cost Incurred - Retrieval

Backup Media Identification

System Restoration For Test Results see the documentation included in the Evidence Package.

Action Date Time

Equipment set up

Operating System loaded

System Software loaded

Configuration Settings loaded

Application data loaded

Application data validated

Validate application usability by the end user

Describe other actions taken:

Recovery Start Time:

Recovery Completion Time:

ISCP Proposed Changes For Test Results see the Vulnerabilities Matrix included in the Evidence Package.

Section and page to be updated

Changes needed as a result of testing validation

TEST FINDINGS/VULNERABILITIES

For Test Results see the Vulnerabilities Matrix included in the Evidence Package.

Describe Test/Restoration Issues Corrective Action Required

Complete evidence documentation and submit with completed Checklist for review by the AO.

Date Test Completed:

Authorizing Official’s Validation for Tabletop Exercise, Functional Exercise, and/or ASPE Test

This checklist must be returned to the DRTBA Mailbox (*IT IT DR Mailbox) within 15 work days of receipt with the AO or AODR signature and date.

As the AO (or AODR) for this Application, I certify that I have reviewed the completed ISCP Testing Checklist and the accompanying evidence for the exercise(s)/tests checked in Item 1 of this Checklist, and I validate performance of the exercise(s)/tests by signing below. My signature also validates my approval of the final revision of the ISCP to include all changes documented on this artifact and updated within 15 work days after the date the AO signs this checklist or no later than June 1, whichever comes first.

AO Signature:

Date Signed

FISMA 16 Application ISCP Template Summary of Changes

Version 2.0-07012015 Page 1

This document contains the summary of changes, by Section, that have been made to the (insert BU- Application name) ISCP as a part of the version 11.0 template. Please contact the Disaster Recovery Testing and Business Analysis (DRTBA) office via the *IT.IT.DR.Mailbox for any questions or refer to the BOD Job Aid for detailed instructions as they relate to the testing process.

FISMA 16 Process Changes

1. The number of days to obtain AO signature on the final checklist has changed from 30 calendar days to 15 work days.

2. The number of days to update the ISCP with the AO approved changes has changed from 30 calendar days to 15 work days. DRTBA will now collaborate with the BOD on updating the

ISCP.

3. The Appendix A Quarterly review process has been changed to Semi-Annual review. The

Semi-Annual reviews of Appendix A will be conducted in September and March.

4. Evidence of ISCP Distribution and Stakeholder Acknowledgement receipts will no longer be collected by DRTBA. The BOD is solely responsible for the ISCP to include the distribution to stakeholders and ensuring personnel are aware of their recovery role.

Cover Page

Template Version changed from 10.0 to 11.0 in footer of cover page.

Plan Maintenance Table

Changed ASPE Test Point of contact from Susan Bonner to Tad Scallen.

Approving Signatures

Changed the checklist name to ISCP Testing Checklist.

Table of Contents

1. Changed the checklist name to ISCP Testing Checklist.

2. Changed URL for template location from:

http://it.web.irs.gov/cybersecurity/Divisions/SRM/Policy_Guidance/DRGuidance.htm. to:

https://portal.ds.irsnet.gov/sites/CyberSRM/Public/SitePages/TestingISCP.aspx

Section 2

1. Deleted placeholder 2.1, Application Description. Application Description is located in

Appendix E.2.1.

2. Renamed 2.1.1, Application Environment to 2.1 Application Environment.

3. Renamed 2.1.2, Application Users to 2.2 Application Users.

4. Deleted placeholder 2.1.3, Application Interfaces and Dependencies. Application Interfaces and Dependencies are located in Appendix E.2.7.1.

5. Renamed 2.1.4, Interconnecting System Dependencies to 2.3 Interconnecting System

Dependencies.

6. Deleted placeholder 2.2, ISCP Roles and Responsibilities. ISCP Roles and Responsibilities are located in Appendix A.

7. Deleted placeholder 2.3, Business Impact Analysis. Business Impact Analysis is located in

Appendix E.

8. Deleted placeholder 2.3.1, Impact Factors. Impact Factors are located in Appendix E.2.6.

9. Deleted placeholder 2.3.2, Critical Business Processes. Critical Business Processes are located in Appendix E.2.8.

10. Deleted placeholder 2.3.3, Business Sub-Processes. Business Sub-Processes were deleted from the FISMA 15 ISCP template.

11. Deleted placeholder 2.3.4, Application-Level Recovery Objectives. Application-Level

Recovery Objectives are located in Appendix E.2.5.

http://it.web.irs.gov/cybersecurity/Divisions/SRM/Policy_Guidance/DRGuidance.htm https://portal.ds.irsnet.gov/sites/CyberSRM/Public/SitePages/TestingISCP.aspx

Version 2.0-07012015 Page 2

Section 4.1

Inserted new guidance text to insert “N/A” in any column where information is not available or does not exist.

Section 4.2

1. Deleted placeholder 4.2.1, Alternate or Work-Around Processing Procedures. Alternate or

Work-Around Processing Procedures are located in Appendix E.2.4.

2. Renamed 4.2.2, Application Recovery Procedures to 4.2.1.

3. Deleted heading 4.2.3, Relevant Data.

4. Renamed 4.2.2, Application Recovery Procedures to Application Configuration.

5. Renamed 4.2.3.1, Application Configuration to 4.2.2.

6. Renamed 4.2.3.2, Code Restriction to 4.2.3.

7. Renamed 4.2.3.3, Unsupported Tools to 4.2.4.

8. Renamed 4.2.3.4, URL and DNS Information to 4.2.5.

9. Section 4.2.6 updated reference to GSS-1 DNS Information to Section 4.1.6.

10. Renamed 4.2.3.5, Application Backups to 4.2.6.

11. Section 4.2.6, Application Backups changed the EOps SLA/Customer Service website from:

http://it.web.irs.gov/sla to:

https://organization.ds.irsnet.gov/sites/ITEOpsKM/SitePages/CustomerAgreements.aspx

12. Section 4.2.6, Application Backups, in the Data Backup Details table added examples for

Backup type, Frequency, and Backup Tools/Software.

Backup type [Physical tape, virtual tape, replication]

Frequency [Daily, Weekly, Full, Incremental, Continuous]

Backup Tool/Software [Ex: DFDSS, FDR, TPCR, DataGuard, Veritas]

13. Renamed 4.2.3.6, Other to 4.2.7

Appendix A

1. Changed Appendix A reviews from Quarterly to Semi-Annually.

2. Inserted footnote “2” to identify Semi-Annual review months as September and March.

3. Changed reference to NIST 800-34, Revision 1, Section 3.6 to footnote “3”.

4. Updated the contact information for CSIRC in the ISCP Leadership table. Cell: N/A, Alternate: 901-786-7101.

5. In EOps ITCM table, replaced Susan Bonner with Tad Scallen and updated job title.

6. Changed the name of the Building and Facilities Services POCs table to Facilities

Management and Security Services POCs.

7. In the Facilities Management and Security Services POCs table header instructions renamed AWSS PSEP and REFM to AWSS FMSS.

8. Updated instruction text for the Key Personnel Distribution Acknowledgement Process to remove DRTBA from the process. The BOD is solely responsible for ensuring the ISCP is distributed and personnel are aware of their recovery roles.

Appendix B

Changed the EOps SLA/Customer Service website from: http://it.web.irs.gov/sla to:

https://organization.ds.irsnet.gov/sites/ITEOpsKM/SitePages/CustomerAgreements.aspx

Appendix E

1. E.1.2 change URL for additional References/Requirements from:

http://mits.web.irs.gov/cybersecurity/Divisions/SRM/Policy_Guidance/DRGuidance.htm

Section 4

1. Revised 2nd sentence identifying Alternate Processing Site.

2. Inserted guidance text for situations where an Alternate Processing Site has not been identified.

http://it.web.irs.gov/sla https://organization.ds.irsnet.gov/sites/ITEOpsKM/SitePages/CustomerAgreements.aspx http://it.web.irs.gov/sla https://organization.ds.irsnet.gov/sites/ITEOpsKM/SitePages/CustomerAgreements.aspx http://mits.web.irs.gov/cybersecurity/Divisions/SRM/Policy_Guidance/DRGuidance.htm

Version 2.0-07012015 Page 3 to: https://portal.ds.irsnet.gov/sites/CyberSRM/Public/SitePages/TestingISCP.aspx

2. E.2.2 correct verb agreement for the word “utilize”.

3. E.2.2 deleted the Buiness Unit BIA POC from Internal Stakeholders.

4. E.2.7.1 corrected SSP reference in instruction text.

5. Renamed E.2.7.1 Application Interfaces and Dependencies to E.2.8

6. E.2.8 inserted guidance text for BU to delete CBPs not supported by application. CBP table now includes name of the CBP and a description. Obsolete URL was removed.

7. Renamed E.2.8, Critical Business Processes to E.2.9.

https://portal.ds.irsnet.gov/sites/CyberSRM/Public/SitePages/TestingISCP.aspx