Contingency/incident plans

Table of Contents

You, as the customer, are responsible for contingency planning (disaster recovery planning) and security incident
response planning for your customer system. To help, this page has suggestions for developing your plans.

Here’s the cloud.gov division of responsibility, as described in our System Security Plan and Control-by-Control
Inheritance matrix:

• cloud.gov is responsible for its own contingency plan and security incident response plan for platform resources, such
  as issues at the operating system level. - Each customer Application System Owner is responsible for plans at your
  customer application level (your code that your team deploys on cloud.gov). Your agency should determine your specific
  requirements as part of your ATO process.

Customer contingency plan suggestions

From our Control-by-Control Inheritance matrix:

• CP-2: “The application owner is responsible for developing a contingency plan that addresses the listed items for the
  application.” - CP-4: “The application owner is responsible for testing the contingency plan for the application.”

You can build a brief contingency plan that focuses on communications around the application and management of your
application code and data.

For example, consider writing down which roles on your team are subscribed to cloud.gov status
updates (such as Application System Owner and Product Manager), and link to parts of
the cloud.gov documentation that give instructions for re-deploying your application or restoring data backups. If your
agency doesn’t provide a template, NIST provides templates, and feel free to adapt the cloud.gov contingency plan.

Functional exercise plan template

If your agency doesn’t provide a template, here’s a template that you can use, based on NIST SP 800-84 Sample
Functional Exercise Scenario (starting on
page B-2): Word .docx format or PDF format.

Customer incident response plan suggestions

• IR-3: “The application owner is responsible for testing the incident response for the application.” - IR-4:
  “Application owners must define events and SLAs for the detection and reporting of suspicious activities. The
  application owner must have their own procedures and processes in place to respond to all reported incidents.”

Along the same lines as the contingency plan, you can build a brief security incident response plan that focuses on
communications for your application.

For example, consider writing down who you need to notify at your agency if you have a security incident in your
application, as well as which role on your team is responsible for notifying cloud.gov of the incident and asking
cloud.gov for support. If your agency doesn’t provide a template, NIST provides templates, and feel free
to adapt the cloud.gov incident response plan.