MITRE Sample Content of a Contingency Plan

 


A Contingency Plan is a requirement in order to be considered certified in many organizations. Because of their importance, Contingency Plans shall be dated, signed and promulgated at a high level within the organization. Each corresponding section of the Plan, Programmatic and Mission-Oriented, has an appropriate focus of risk management, and both are integrated into a coherent, single Contingency Plan. The sample plan below is based on the information discussed previously in Y2K Contingency Management Plan Outline
at http://www.mitre.org/research/y2k/docs/CONTINGENCY_PLAN.html,
and Y2K Contingency Plan Guidelines
at http://www.mitre.org/research/y2k/docs/CONTINGENCY_GUIDELINES.html

Programmatic Section
This section details the plans for system remediation management, and describes management of resources which can be operated in reduced or minimal modes. This section is prepared by systems developers, operators, and maintainers in consultation with user s. It addresses the actions to be performed when a foreseen Y2K problem results in degraded system performance. An example of this sort of contingency is when, say in late 1998, it is discovered that some external interface has serious problems and there is no time left, given its priority, to fully remediate all the input and output conversion capabilities. This could happen, for example, in a payroll application. Data sources containing non-compliant date formats could not be fixed as quickly as the maj ority of sources. Then a contingency activity might be to plan for a conversion engine, perhaps involving separate computer facilities to reformat the data from the few non-compliant sources as a stopgap until the fully compatible form is available, possi bly after the Year 2000 deadline.

Mission-Oriented Section
This section deals with operational risk management and is prepared by systems users in consultation with developers, operators, and maintainers. It addresses the actions to be performed by the users immediately before, during, and immediately after a Y2K -related contingency. Examples of this kind of contingency include power outages, system crashes, bad data, loss of communications, etc. A contingency activity might be to make sure backup power could be obtained, and the engineering resources to attach i t and allow interrupted operations to continue in a backup mode until the time when primary power could be reconnected.

Additional Considerations
The scope of the plans must be clearly stated, including expected contingency duration, for both kinds of contingencies. Priorities must be carefully defined, established, and agreed to by all parties concerned. Early on, cost estimates to set up and impl ement the plans should be developed and considered for possible trade-offs. The responsibilities for developing and maintaining each Contingency Plan must be established, as well as the time period between major reviews. Continued Contingency Plan mainten ance will be tracked through each organization's validation process.

Remaining Sections
The remaining sections provide details for the preparation of each type of contingency--Programmatic and Mission-Oriented--with Risk Management subsections for the latter, for each of three phases--Planning, Execution, and Recovery--with the last section being Recommendations. Each project will have different analysis factors depending on local and system-specific parameters. Risk Management involves enumerating possible alleviating or aggravating occurrences that affect each possible failure mode, and at tempting to provide meaningful weighting of the effects of isolated factors on the total system performance or degradation. Recommendations will be resulting prioritized actions to minimize or control the effects of the most likely negative outcomes.

Sample Contingency Plan Information

If you have access to .mil sites and would like to see a sample Operational Contingency Plan or if you need further guidance, there is other information available for review including the following:

You can find Organizational level plans and guidance for Year 2000 at the following websites:

For other information on Contingency Planning, please take a look at the following: