The agency operates an alternate processing facility that utilizes the information available at the alternate storage site. Operating procedures for the alternate processing site shall be documented in the information system contingency plan.
An organization is unable to recover it's technology services since it has not devised a technology strategy according to it's size, nature and complexity of business.
The organization:
a. Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable;
b. Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and
c. Ensures that the alternate processing site provides information security safeguards equivalent to that of the primary site.
An offsite, alternative processing site is available. The alternative site should not be subject to the same natural disasters of the primary site (i.e. not in proximity).
No statewide control
Obtain contingency planning policy; contingency plan; procedures addressing alternate processing sites; alternate processing site agreements; security plan; other relevant documents or records and ascertain if :
(I)the organization identifies an alternate processing site.
(ii)the organization defines in the security plan, explicitly or by reference, the time period within which processing must be resumed at the alternate processing site.
(iii)the organization initiates necessary alternate processing site agreements to permit the resumption of information system operations for critical mission/business functions within organization-defined time period.
(iv)the contingency plan identifies the primary processing site hazards; and
(v)the alternate processing site is sufficiently separated from the primary processing site so as not to be susceptible to the same hazards identified at the primary site.
(vi)the contingency plan identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.
(vii)the contingency plan defines explicit mitigation actions for potential accessibility problems.
