Policy 7230A - Department of Administration

9.1.1.c Contingency Plan Update Frequency and Scheduling
• Contingency plans will be reviewed and updated on an at least
annual basis or at such time as contingency testing or
contingency operations indicates a deficiency in the
contingency plan.
9.1.2. Test the Plan
To ensure the applicability of the plan and to verify that the plan can be acted
upon as created, periodic testing is required:
9.1.2.a Mandatory Contingency Testing Methodologies
• The following capabilities must be included in the contingency
testing program:
o System recovery to a primary platform from backup.
o System recovery to a secondary platform from backup.
o System failover from a primary system to a redundant
system.
o System failover from a primary facility to a redundant
facility.
o System performance in all circumstances.
o Restoration of normal operations in all circumstances.
o Co-ordination and communications.
• Contingency testing can be conducted in one of two ways:
o Classroom or tabletop exercises walkthrough
contingency operations without any contingency
operations occurring.
o Functional or simulation exercises recreate actual
disruptions and require the execution of contingency
operations.
9.1.2.b Contingency Testing Frequency and Scheduling
• Classroom or tabletop exercises shall be performed on at least
an annual basis.
• Functional or simulation exercises shall be performed on at
least a triennial basis.
9.2. Contingency Infrastructure
The following are the Mandatory Baselines that support the Contingency
Infrastructure section of the Default Security Requirements:
9.2.1. Required Contingency Infrastructure
Appropriate infrastructure must be put in place to provide for appropriate
ongoing operations in the event of a business impacting event:
Mandatory Baselines
Page 17 of 25