Our business is impacted by events that are beyond our control. These events may be natural or manufactured, but they still can significantly impact the smooth functioning of our business processes. Preparing for these events and managing their impact on our normal functioning is important. It helps maintain the continuity of our business operations and enables us to provide our key services through these major events.

Contingency Plan (CP-2) of the University Controls Catalog states that “maintaining a contingency plan as part of the Continuity of Operations Program (COOP) is of key importance to minimize the effects of a man-made or natural disruptive event or disaster.” This control also directs that all information resource owners or designees shall document and maintain a Contingency Plan for all high and moderate impact information resources. The plan will contain a Business Impact Analysis to systematically assess the potential impact of a loss of business functionality due to an interruption of computing and/or infrastructure support services resulting from a disruptive event or incident. The analysis shall identify the following elements:

• High and moderate impact Information Resources including internal and external points of contact for personnel who provide or receive data
• A determination of the Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
• Dependent information resources to assess the impact on associated resources or processes.
• Relevant recovery priorities that consider geographic areas, accessibility, security, environment, and cost