Contingency Planning Guide for Federal Information Systems¶
Swanson, M., Bowen, P., Phillips, A. W., Gallup, D., & Lynes, D. (2010). Contingency Planning Guide for Federal Information Systems. National Institute of Standards and Technology.
Cited by¶
16 citations across 16 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Recovery
- The possibly-transformed endpoint appears as build-back-better: after a ransomware recovery, the organization typically does not restore the identical vulnerable configuration but rebuilds with segmented networks and immutable backups — a transformed working state suited to the changed threat environment.
This sourceSpecifies IT contingency and disaster-recovery planning, including rebuilding to a hardened (build-back-better) configuration after a major incident.
- The possibly-transformed endpoint appears as build-back-better: after a ransomware recovery, the organization typically does not restore the identical vulnerable configuration but rebuilds with segmented networks and immutable backups — a transformed working state suited to the changed threat environment.
- Redundancy
- They can overlap; NIST CP-9(6) describes backup using a noncollocated redundant secondary.
This sourceGuidance on a qualifying secondary and shared-site failure boundaries, not evidence of a deployment.
- They can overlap; NIST CP-9(6) describes backup using a noncollocated redundant secondary.
Domain-specific¶
- Data Backup Method
- What makes these one method family is the available retain-and-reconstruct relation: there is a target state, material that survives the relevant change, and a way to turn that material back into that state.
This sourceGuidance and definition, not evidence of a specific deployment.
- What makes these one method family is the available retain-and-reconstruct relation: there is a target state, material that survives the relevant change, and a way to turn that material back into that state.
Mechanisms¶
- Backup and Restore Verification
- Its failure mode is complacency: a backup job that reports success while producing unusable files, discovered only during a real crisis because no one ever tried a restore.
This sourceRequires testing backup information and exercising restoration so recoverability is verified before an actual disruption.
- Its failure mode is complacency: a backup job that reports success while producing unusable files, discovered only during a real crisis because no one ever tried a restore.
- Backup Snapshot
- The guarding discipline is to schedule periodic test-restores against the 3-2-1 rule
This sourceRequires contingency plans to include system-recovery procedures from backup media and to test restoration as part of contingency-plan exercises.
- The guarding discipline is to schedule periodic test-restores against the 3-2-1 rule
- Checkpoint Hardening Window
- Its strength is that it converts a hope ("the backup is fine") into a passed test
This sourceStates that contingency-plan testing validates recovery capabilities rather than leaving them assumed.
- Its strength is that it converts a hope ("the backup is fine") into a passed test
- Context Reinstatement Protocol
- The discipline that guards against it is to treat reinstatement as unproven until a re-entry integrity check confirms it, and never to act in the gap between "feels restored" and "verified restored."
This sourceRequires validation testing before a recovered system is declared ready to return to normal operation.
- The discipline that guards against it is to treat reinstatement as unproven until a re-entry integrity check confirms it, and never to act in the gap between "feels restored" and "verified restored."
- Critical Function Triage Matrix
- Pre-set targets are defensible
This sourceUses business-impact analysis to establish recovery objectives and priorities from criticality, outage impact, and tolerable downtime.
- Pre-set targets are defensible
- Degraded-Mode Runbook
- Disaster Recovery Plan
- Recovery time — how fast function must return (the RTO), which sets how much warm standby you pre-pay for.
This sourceDefines the recovery-time objective and links tighter restoration targets to more capable prearranged recovery resources.
- Recovery time — how fast function must return (the RTO), which sets how much warm standby you pre-pay for.
- Governance RACI With Backups
- Its strength is that it removes the "who's even allowed to decide?" hesitation before it can cost days, and it turns key-person risk from a surprise into a visible map
This sourceMaps contingency roles, key personnel, contact information, and alternates so dependencies are explicit.
- Its strength is that it removes the "who's even allowed to decide?" hesitation before it can cost days, and it turns key-person risk from a surprise into a visible map
- Manual Fallback Workflow
- Its failure mode is the dormant path that decayed
This sourceRequires contingency procedures to be maintained and periodically exercised so recovery capability does not quietly degrade.
- Its failure mode is the dormant path that decayed
- Recovery Drill and Restore Test
- The discipline is to vary and harden the scenario over time, to drill the whole interdependent system rather than the convenient slice, and to treat any drill that "passed" too easily as a sign the scenario was too kind.
This sourceCalls for contingency exercises that test the whole interdependent recovery system.
- The discipline is to vary and harden the scenario over time, to drill the whole interdependent system rather than the convenient slice, and to treat any drill that "passed" too easily as a sign the scenario was too kind.
- Runbook Rehearsal
- Each becomes a logged correction: the runbook is edited, the missing authority is delegated in advance, the ambiguous step is disambiguated, and the timing is re-baselined — with a note to rehearse again after the fixes land.
This sourceContingency exercises should produce documented results and corrective actions that update the plan.
- Each becomes a logged correction: the runbook is edited, the missing authority is delegated in advance, the ambiguous step is disambiguated, and the timing is re-baselined — with a note to rehearse again after the fixes land.
- Subsidy Dependency Assessment
- Its failure mode is that dependence concentrated in a single traced input is a single point of failure, and an assessment can under-count these by looking at aggregate performance rather than at what one input uniquely carries.
This sourceRecommends eliminating single points of failure by identifying functions that lack redundant paths or backup components.
- Its failure mode is that dependence concentrated in a single traced input is a single point of failure, and an assessment can under-count these by looking at aggregate performance rather than at what one input uniquely carries.
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Not recorded. Neither this nor any other of the 16 citations of this work carries a recorded support check.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 2 other ways.
- https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final ×1
- https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf ×1
Registry ID ref:0dcd2f0e78f8 · see in the full table