Information systems must be consistently available to conduct and support business operations.
Information systems must have a defined availability classification, with appropriate controls enabled and incorporated into development and production processes based on this classification.
System and network failures must be reported promptly to the organization’s lead for Information Technology (IT) or designated IT operations manager.
Users must be notified of scheduled outages (e.g., system maintenance) that require periods of downtime. This notification must specify the date and time of the system maintenance, expected duration, and anticipated system or service resumption time.
Prior to production use, each new or significantly modified application must have a completed risk assessment that includes availability risks. Risk assessments must be completed in accordance with the Risk Assessment Policy (reference (a)).
Capacity management and load balancing techniques must be used, as deemed necessary, to help minimize the risk and impact of system failures.
Information systems must have an appropriate data backup plan that ensures:
All sensitive data can be restored within a reasonable time period.
Full backups of critical resources are performed on at least a weekly basis.
Incremental backups for critical resources are performed on at least a daily basis.
Backups and associated media are maintained for a minimum of thirty (30) days and retained for at least one (1) year, or in accordance with legal and regulatory requirements.
Backups are stored off-site with multiple points of redundancy and protected using encryption and key management.
Tests of backup data must be conducted once per quarter. Tests of configurations must be conducted twice per year.
Information systems must have an appropriate redundancy and failover plan that meets the following criteria:
Network infrastructure that supports critical resources must have system-level redundancy (including but not limited to a secondary power supply, backup disk-array, and secondary computing system). Critical core components (including but not limited to routers, switches, and other devices linked to Service Level Agreements (SLAs)) must have an actively maintained spare. SLAs must require parts replacement within twenty-four (24)hours.
Servers that support critical resources must have redundant power supplies and network interface cards. All servers must have an actively maintained spare. SLAs must require parts replacement within twentyfour (24) hours.
Servers classified as high availability must use disk mirroring.
Information systems must have an appropriate business continuity plan that meets the following criteria:
Recovery time and data loss limits are defined in Table 3.
Recovery time requirements and data loss limits must be adhered to with specific documentation in the plan.
Company and/or external critical resources, personnel, and necessary corrective actions must be specifically identified.
Specific responsibilities and tasks for responding to emergencies and resuming business operations must be included in the plan.
All applicable legal and regulatory requirements must be satisfied.