STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

A disaster recovery/continuity plan must exist in accordance with DoD policy based on the applications availability requirements.

DISA Rule

SV-222636r508029_rule

Vulnerability Number

V-222636

Group Title

SRG-APP-000516

Rule Version

APSC-DV-003050

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-000445 - The organization develops a contingency plan for the information system that identifies associated contingency requirements.

Weight

10

Fix Recommendation

Create and maintain the disaster recovery/continuity plan.

Check Contents

Review disaster recovery/continuity plans.

For high risk applications, verify the disaster plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity.

For moderate risk applications, verify the disaster recovery/continuity plan exists and provides for the resumption of mission or business essential functions within 24 hours activation.

For low risk applications, verify the disaster recovery/continuity plan exists and provides for the partial resumption of mission or business essential functions within 5 days of activation.

If the disaster recovery/continuity plan does not exist or does not meet the severity level requirements, this is a finding.

Vulnerability Number

V-222636

Documentable

False

Rule Version

APSC-DV-003050

Severity Override Guidance

Review disaster recovery/continuity plans.

For high risk applications, verify the disaster plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity.

For moderate risk applications, verify the disaster recovery/continuity plan exists and provides for the resumption of mission or business essential functions within 24 hours activation.

For low risk applications, verify the disaster recovery/continuity plan exists and provides for the partial resumption of mission or business essential functions within 5 days of activation.

If the disaster recovery/continuity plan does not exist or does not meet the severity level requirements, this is a finding.

Check Content Reference

M

Target Key

4093

Comments