Policy 7230A - Department of Administration

9.3 Contingency Operations
To facilitate contingency operations, The State of Kansas requires the assignment of
designated responsibility for contingency operations to a contingency response team.
In the event that an incident occurs, the members of this team will be charged with
executing the contingency plan. To ensure that this team is fully prepared for its
responsibilities, all team members will be trained in contingency operations within 90
days of appointment to the team and thereafter on an at least annual basis.
Contingency response is to be tested annually through the use of table top exercises
and at least every five years through the use of a full-scale test. The results of these
tests will be documented, shared with the security, IT and senior management. These
results will be used in the annual review and, where required, update of the
contingency plan.
As a component of the contingency plan, information system backups will be taken on
a regular basis. At a minimum full system backups will be taken monthly. For critical
systems, at a minimum, additional incremental weekly backups will also be taken. A
copy of each backup will be kept on site while secondary copies will be transported to
offsite storage locations. These backups will be protected to ensure integrity and strict
physical access controls. Further, to ensure that information systems are restorable,
backups will be randomly tested such that a backup for each information system is
tested at least annually. Random testing will be required for a minimum of a single
tape from one complete back-up run.
In the event that an information system must be restored from a backup, before it can
be declared production operational, it must be returned to a known secure state as
defined by the appropriate baseline. This known secure state must include the
application of all patches, hot fixes and other security control mechanisms.
30