This DR policy provides requirements and guidance to ensure that all (Tier 1, Tier 2, Tier 3, telecommunications, network, etc.) IRS systems and applications owned or managed by IRS employees or contractors are compliant with Office of Management and Budget (OMB), Federal Information Security Management Act of 2002 (FISMA), National Institute of Standards and Technology (NIST), Treasury, and IRS guidelines. All IRS IT systems and applications must have sufficient Disaster Recovery (DR) capability to recover IRS data with system/application functionality (data is usable to customer) according to pre-defined Recovery Time Objective/Recovery Point Objective (RTO/RPO). Per RTO/RPO, as agreed upon and documented in the Information Technology Contingency Plan (ITCP), that in the event of a significant interruption or disaster, data must be available and usable to the customer.

This policy is a critical component of the IRS' overall Business Continuity Program or Business Continuity Plan (BCP). The pieces of the BCP must work together to create and support the overall Business Continuity of the IRS.

Program Guidance for the IT Disaster Recovery Program includes:

The provisions in this policy apply to all offices, business, operating, and functional units within the IRS, as well as individuals and organizations having contractual arrangements with the IRS, including employees, contractors, and vendors, which use or operate IT systems containing IRS data to accomplish the IRS mission.

This policy governs all (Tier 1, Tier 2, Tier 3, telecommunications, network, etc.) IRS components of information systems that process, store, or transmit information.

This IRM describes responsibilities of IRS and contractor personnel in regard to the IT Disaster Recovery Program.

This manual contains information on the following topic areas:

IRM 10.8.1, Information Technology (IT) Security Policy and Guidance, establishes the security program and the policy framework per Treasury requirements and other federal regulations.

IRM 10.8.2, Information Technology(IT) Security Roles and Responsibilities, details specific roles and duties across the enterprise.

The Computer Security Act of 1987: ''P.L. 100-235''

Presidential Decision Directive (PDD) 67, Enduring Constitutional Government and Continuity of Government, October, 1998

Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, November 2000

Federal Information Security Management Act (FISMA) of 2002, Public Law (P.L.) 107-347

Homeland Security Presidential Directive/HSPD –7, Critical Infrastructure Identification, Prioritization, and Protection, December 2003

National Security Presidential Directive/NSPD –51 and Homeland Security Presidential Directive/HSPD –20, National Continuity Policy, May 2007

Federal Continuity Directive 1Federal Executive Branch National Continuity Program and Requirements, February 2008

Federal Continuity Directive 2Mission Essential Function and Primary Mission Essential Function Identification and Submission Process, February 2008

Federal Emergency Management Agency (FEMA) National Response Framework, March 1999

Treasury Directive Publication (TD P) 85-01, Department of the Treasury Information Technology (IT) Security Program

Federal Preparedness Circular (FPC) 65, Federal Executive Branch Continuity of Operations (COOP), June 2004

The Director, Information Technology Disaster Recovery Organization (ITDRO), within MITS, Cybersecurity is the lead for the IRS for establishing and maintaining the IRS enterprise-wide IT DR policy, standards, and procedures, as well as, overseeing IT Business Impact Analysis (IT BIA) and testing activities of the IRS IT DR Program.

ITDRO provides guidance and direction to the IRS enterprise-wide disaster recovery efforts. The ITDRO provides a comprehensive, business-centric IT DR program designed to protect IRS operations, assets, and information.

The ITDRO is responsible for coordinating the efforts of the enterprise-wide IT DR Program as follows:

Responsibilities of the ITDRO include:

Each BOD that owns or operates IT resources shall comply with MITS requirements.

Each contractor or vendor that owns or operates IT resources on behalf of the IRS shall also comply with MITS requirements.

MITS operations is responsible for:

The BOD/Information System Owner is the agency official responsible for the overall procurement, development, integration, modification, operation and maintenance of the information system. For applications housed on systems owned by or operated by MITS, MITS will work with BODs to determine appropriate enterprise priorities and identify funding sources for the procurement of equipment. The Information System Owner is also known as the Business and Functional Unit Owner.

Each BOD that owns or operates IT resources shall comply with the MITS requirements.

Each contractor or vendor that owns or operates IT resources on behalf of the IRS shall comply with the MITS requirements.

The BOD/Information System Owner is required to:

IRM 10.8.2, Information Technology (IT) Roles and Responsibilities, Section 2.2.5(2), (4) and (5), states in part that Business and Functional Unit Owners shall:

It is recommended that BODs work jointly with Agency-Wide Shared Services (AWSS), MITS operations and ITDRO to conduct integrated Business Continuity (BC)-Disaster Recovery(DR) exercises, whenever possible, to validate the recovery times of CBPs and supporting applications.

Contracting Officer’s (COs) acting on IRS's behalf are required to ensure the inclusion of IRS DR expectations within contracts for the purpose of DR support. Verbiage included in the contract should contain the following:

Situation Awareness Management Center (SAMC) receives, manages, and escalates advisories and alerts of physical and cyber events from across the IRS.

SAMC operates on a 24x7x365 schedule, providing immediate response required by the incident. All incidents affecting IRS operations, employees, facilities, or data processing should be reported to SAMC within a 30 minute time frame of the incident discovery (allowing for notification of local responders (Federal Protection Service (FPS), TIGTA, HAZMAT, Police, Fire Department).

For the purposes of IT Disaster Recovery, SAMC is typically notified by the site Director, Senior Commissioner's Representative, AWSS.

SAMC can be notified through 4 different modes of communication (E-mail, phone, fax, and hot line).

Single Entry Time Reporting Function/Program Codes and Internal Order Codes have been established that will be used to track Internal Revenue Service Information Technology Disaster Recovery work efforts. Any Internal Revenue Service employee involved in this work will use Function Code 800 and Program Code 800-8237X series for tracking purposes.

If you are involved in any of the activities mentioned in the chart listed in (3) below, ensure you utilize the applicable Information Technology Disaster Recovery Program Code(s), so that time spent addressing Information Technology Disaster Recovery activities may be tracked.

The chart below provides the new codes and the activities/definition related to them:

All FISMA Master Inventory (MI) GSSs and applications have an initial IT BIA conducted as part of the C&A process, See IRM 10.8.60.4.

Conducting and funding of IT BIA activities is the responsibility of the Business Owner.

The IT BIA is an ongoing, living document that must be evaluated on an annual basis or whenever there is a change to business requirements, systems, or applications or the applications or systems that affect it.

There are four primary steps to completing an IT BIA.

Critical Business Processes (CBPs) have been defined by the IRS Senior Executive team and business representatives as the most critical to the tax administration mission of the IRS supporting the overall continuity of the Federal Government. Originally established in 2002 and updated in May 2008, there are 18 IRS Critical Business Processes. They are also referred to as the IRS’s Global Priorities.

There are three categories based on their relative priority to the execution and support of the overall mission of the IRS. Those three categories are defined below.

Listed below are the 18 Critical Business Processes by Priority

All FISMA MI GSSs and applications are required to have an ITCP.

All FISMA MI GSSs and applications are required to exercise their ITCP annually.

The FISMA MI and other FISMA related information are located on the MITS Cybersecurity Web site at: http://mits.web.irs.gov/cybersecurity/FISMA/default.htm

ITCPs are to be reviewed no less than annually, or when major changes are made to the system, or contact information necessary in the event of an incident, and updated as needed.

NIST 800-34,Contingency Planning Guide for Information Technology Systems, lists seven steps to developing and maintaining an effective ITCP. The initial ITCP is developed during the IRS Certification and Accreditation (C&A) process required for every application or system before going into production.

The seven steps below provide an overview of the process:

ITCP exercises consist of Tabletop and/or Functional Exercises.

Treasury and OPM guidance requires ITCP exercise requirements be based on the Federal Information Processing Standards Publications (FIPS) 199 security availability category below:

In addition to the requirements in (2) above, all GSSs and applications, that support one of the IRS Critical Business Processes (CBPs) must have a Tabletop plus a functional exercise.

See Exhibit 10.8.60-1for a definition of a tabletop and functional exercise.

Procedures for conducting ITCP Exercises are in IRM 10.8.62 Information Technology (IT) Disaster Recovery Testing, Training and Exercise Program.

Additional guidance based on Treasury, OMB or IRS requirements are issued by the Director, ITDRO each FISMA period.

When selecting fixed-site locations for recovery of IRS FISMA Master Inventory (MI) systems and applications, consideration for the time and mode of transportation necessary to move personnel there is required. This is particularly critical if personnel at the potential location do not have the skills necessary to recover/operate the equipment, systems, and applications. (Example: During a wide-spread disaster, such as that of September 11, 2001, roads and bridges may be closed to vehicles and air transportation may be restricted.) In addition, the fixed site should be in a geographic area that is unlikely to be negatively affected by the same disaster event (e.g., weather-related impacts or power grid failure) as the organization’s primary site.

Use or development of designated and potential Recovery Sites, must be submitted to and analyzed by the MITS, Enterprise Operations, Customer Relationship and Integration Division. Requests must be based on the specific requirements defined in the IT Business Impact Analysis (IT BIA).

The recovery site should have system security, management, operational, and technical controls that are equal to the production site. Such controls may include firewalls, physical access controls, data controls, and security clearance level of the site and staff supporting the site.

Recovery sites must be IRS facilities. For FISMA Master Inventory GSSs, systems and applications, to the greatest extent possible, the recovery site will be one of the three Enterprise Computing Centers.

The off-site storage location must be located in sufficient distance as to not be affected by a physical incident affecting the area of the production location but within adequate distance to retrieve stored data/documents per the documented business needs.

Contracted services for retrieval from off premise storage facilities must be based on the system/applications RTO objectives.

Yearly verification must be performed and documented to ensure that:

The annual verification shall extend to a review and update of the access control list for the off site storage, making note that, in an incident, it may be non-local staff who are called upon to retrieve/receive backup media.

The review shall also ensure that the off site copy of the DR plan is current.

All FISMA MI GSSs and applications will have recovery capability. Applications that do not support the IRS CBPs see (8) below. Funding of the DR solution is the responsibility of the Business Owner and will be addressed in the Service Level Agreement (SLA) or Memorandum of Understanding (MOU) as appropriate.

All FISMA MI GSSs and applications are required to have a DRP. All systems used for recovery shall comply with existing IRS Policies.

DR-related information, including recovery times, are documented in the ITCP and DRP.

The DRP is the responsibility of the owner of the GSS or application. It is maintained/updated by the owner and MITS operations responsible for the recovery of the GSS or application and the system(s) it resides on.

IT assets that are not listed in the FISMA MI which are determined to have an interdependency with a FISMA MI asset, are required to have a DRP.

The DRP is Appendix H to the ITCP. While it is a part of the overall ITCP, it is also a stand alone document that provides guidance and procedures, necessary for the technical recovery of a system or application at an alternate site. Depending on the size and complexity of the DRP, it will be maintained separately from the ITCP. High level guidance and reference to the DRP will be maintained in Appendix H.

The DRP shall be sufficiently detailed (detailed work steps/key strokes) and complete enough to recover the system and/or application, to the working level prescribed by the ITCP/MOU/SLA, for which it was written, by any administrator with the appropriate skills and permissions.

A risk assessment and business impact analysis shall be performed for all FISMA MI GSSs and applications that do not support the IRS' Critical Business Processes to determine the extent of necessary recovery capability.

Following the guidance provided by NIST 800-34, Contingency Planning Guide for information Technologies Systems, a DRP refers to an IT-focused plan designed to restore operability of the target system, application or computer facility at an alternate site after a major, and usually catastrophic, disaster. The steps below provide an overview of the process:

Owners of FISMA MI GSSs and applications that support a CBP are required to annually test the recovery of their system.

All testing and exercises are coordinated by the ITDRO staff. See IRM 10.8.62, Information Technology (IT) Disaster Recovery Testing, Training and Exercise Program for guidance. The IRM documents how to begin and proceed through the ITCP and DR exercise and testing process for every application and GSS in the IRS Master Inventory. For additional information, the ITDRO can be reached via their mailbox *MITS IT DR Mailbox.

Given the costs and feasibility of conducting a full DR Test, functional tests/partial DR tests are utilized with a gradual increase in complexity and extensiveness in testing until compliance with See IRM 10.8.60.2.

A tested DR Plan is a DRP that has been subjected to an evaluation using a DR Test Plan to identify the scope, objectives, expected results, recovering the system/application using back up data on different equipment or another location. The actual summary results are used to measure the ability of the recovery personnel using the DRP to recover an IT system and its data to full operational status following a disruption.

Procedures for requesting and conducting DR Tests are in IRM 10.8.62Information Technology (IT) Disaster Recovery Testing, Training and Exercise Program

The test results are to be documented in the Summary Report within 30 days after the conclusion of the annual Disaster Recovery Test. Within 10 days after finalization, the results must be shared with the Senior Management of the recovery personnel who participated in the Disaster Recovery Test from Enterprise Computing Centers and other Enterprise Operations organizations. A copy of the completed documents are to be provided to the IT Disaster Recover Organization, Test, Training & Exercise team

All DRPs should be updated with lessons learned following any conducted tests/exercises.

System administrators, managers, or other individuals with responsibility for IT Contingency or IT DR are required to have access to or copies of applicable ITCPs and/or DRPs.

System administrators, managers, or other individuals with responsibility for IT Contingency or IT DR should be provided copies of or access to GSS and application ITCPs and/or DRPs by their management or the GSS or application owner.

Requests for copies of or access to GSS and application ITCPs and/or DRPs should be made through the employees' manager to the GSS and/or application owner.

All other requests for copies of, or access to, GSS and application ITCPs and/or DRPs shall be requested from the GSS or application owner. The request must specify what is being requested, purpose, contact person, and where it is to be sent.

TIGTA/GAO notification of audits and requests for information that involve IT DR in some way, are received by or routed through the Cybersecurity, Communications & Support Services, Program Oversight & Coordination Office for control and provided to the ITDRO.

TIGTA/GAO requests for documents, such as ITCPs or DRPs, for current or upcoming DR or IT Contingency Plan audits are to be sent to the system/application owner for release.

The ITDRO is responsible for developing and disseminating training information through MITS/FISMA Program Management Office BOD representatives to identified employees.

The ITDRO establishes training in support of the DR program.

The training established by ITDRO supports annual FISMA security training requirements.

The training established by ITDRO is available through the Enterprise Learning Management System (ELMS).

Employee's with DR responsibilities are required to complete DR-focused training each year. Training can be met through elective courses from the online services provided by IRS, on the job training (i.e. training during a DR Test) or through offerings of a private vendor. DR training classes or seminars count toward the employees annual security training requirement.

Suggested Training hours are based on the employees' role with respect to DR as indicated in the chart below. Exception, for ITDRO staff, the hours are required.

IRS ELMS training classes available for the roles above will be listed in the various established IRS Roles Requiring an IT Security Curriculum. For current information, guidance and requirements on IRS Roles Requiring an IT Security Curriculum, go to the FISMA Specialized IT Security Training web site at: http://mits.web.irs.gov/cybersecurity/FISMA/training.htm

Employees/managers must work with their training coordinator to ensure credit is given for classes relating to IT Disaster Recovery/IT Contingency Planning.

Employee's with primary or full time DR duties are encouraged to complete formal, vendor-sponsored DR training and test for DR certification. DR training counts towards the employees annual security training requirement. Vendor-sponsored refers to vendors that provide training on IT DR, Business Continuity, and/or IT Contingency Planning.

Employee's with DR certifications are required to complete the appropriate number of hours (CPE) yearly to maintain their certification. Hours count towards the employees annual security training requirement.

Costs of certification, testing and yearly maintenance fees may be paid for by IRS, if approved by the employees management.