IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection of Generic Components Contigenc Planning
_________________________________________________________________________________________
3.3 Contingency Planning
Description
Contingency planning comprises safeguards which, in case of
failure (due to technical reasons, caused intentionally or as a
result of negligence) of an IT system, are designed to restore
its operating state. Depending on the time of implementation
of these measures, contingency planning safeguards can be
grouped into four stages:
Stage 1: Contingency planning
In this stage, the measures suitable and economically viable for a particular IT system are
identified. It is determined which measures can be taken during operation of an IT system (e.g.
smoking ban, uninterruptible power supply, service, data backup) so that an emergency situation is
prevented and that damage resulting from an emergency situation is reduced. Furthermore,
contingency plans, which are part of a contingency manual, stipulate which measures must be taken
in case of an emergency.
Stage 2: Implementing the contingency measures accompanying IT operation
In stage 2, the contingency measures are implemented and maintained. These must be carried out
prior to an emergency situation in order to reduce the probability of an emergency or to allow swift
and cost-effective restoration of the operating state.
Stage 3: Emergency preparedness exercises
Emergency drills are particularly important in connection with stage 2 in order to train the
implementation of the measures listed in the Emergency Manual and to increase efficiency.
Stage 4: Implementing planned measures after an emergency situation arises
After it has been officially decided that an emergency situation is present, the measures set out in
the Emergency Manual for this case must be implemented without delay.
In order to be able to make contingency planning cost-effective, the costs incurred must be compared
to the potential damage (costs due to a lack of availability in the event of an emergency) and assessed.
The following costs should be considered:
- Costs for compiling contingency planning
- Costs for the implementation and maintenance of the safeguards accompanying IT operation
- Costs for emergency drills
- Costs for the restoration of the operating state
_________________________________________________________________________________________
IT-Baseline Protection Manual: Otober 2000