Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
� The development of the new data center ESOC West.
In addition, we identified the following deficiencies:
� IRM had not documented an entity-wide Business Impact Analysis (BIA) to ensure
the coordination of the recovery prioritizations of critical mission/business processes
and services in the event of a disruption within the ESOC. The BIA had not been
documented because IRM does not think that the entity-wide BIA applies to its
contingency planning process. However, NIST SP 800-34, Revision 1, 38 states that
the BIA helps identify and prioritize information systems and components critical to
supporting the organization’s mission/business processes.
� The entity-wide process-based BIA, which supports COOP functions developed by
the Office of Emergency Management (OEM) to support Federal Continuity
Directive 2 (FCD-2), does not agree with the OpenNet Contingency Plan. For
example, OEM officials stated that the infrastructure should not be interrupted in the
event of a disaster, and IRM officials stated that the infrastructure Maximum
Tolerable Downtime is 24 hours. The inconsistency between the two documents
occurred because the Department does not require OEM and IRM to coordinate with
the continuity of operations planning. According to NIST SP 800-34, Revision 1,
information systems that support COOP functions will be identified in the processbased
BIA.
An out-of-date COOP CCP increases the risk that the Department may not be able to
recover in a timely manner or may experience difficulty in recovering from a disaster.
Additionally, the IRM CCP supports the Department COOP; therefore, the COOP relies upon the
CCP to be current. Without a BIA, there is an increased risk that the Department will not
recover mission-critical functions based on established recovery priorities. Additionally, the lack
of communication between OEM and IRM may cause incongruent requirements and the
expectations in the availability of the infrastructure in the event of a disaster.
Recommendation 12. We recommend that the Chief Information Officer, as required by
NIST SP 800-34, Revision 1, “Contingency Planning Guide for Federal Information
Systems,” take the following actions:
� Update the Continuity of Operations Communication Plan annually or
when changes occur to the organization, network hardware, systems, and
applications and, if necessary, after Continuity Testing.
� Perform an entity-wide Business Impact Analysis and develop a strategy to
prioritize recovery of the critical assets within the Department of State.
� Update the Foreign Affairs Manual that contains guidance and direction for
development and implementation of Continuity of Operations
Communication Plan.
38 NIST SP 800-34, rev. 1.
25
UNCLASSIFIED