Description
Applicability
-
An alternate storage site is an integral part of a contingency plan and applies to all high impact information resources, University Essential IT Services, and additional resources as noted.
-
The information resource owner or designee is responsible for determining how the alternate storage site is utilized.
-
Based on risk management considerations and business functions, the information resource owner may determine that it would be appropriate to apply the requirements of this Control to information resources not meeting the definition of high impact.
Implementation
-
1
The alternate storage site is physically separated from the primary storage site to reduce susceptibility to the same disruptive event, based on the relevant Business Impact Analysis.
TipThe distance should be sufficient so an event would not impact both the primary and alternate storage site. The type of event and resulting distance considered should be based on risk management considerations (e.g. planning for a building fire or power outage might dictate a separate building on the same campus; planning for a major hurricane at a coastal campus might dictate an alternate site many miles away).
-
2
The alternate storage site is configured to facilitate timely and effective recovery operations.
-
3
A contingency plan shall identify potential accessibility problems to the alternate site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
-
4
Backup and recovery procedures, and associate testing at alternate storage sites, shall be implemented as described in CP-9 Information System Backup.