Check: APSC-DV-003060
Application Security and Development STIG:
APSC-DV-003060
(in versions v5 r3 through v4 r2)
Title
Recovery procedures and technical system features must exist so recovery is performed in a secure and verifiable manner. The ISSO will document circumstances inhibiting a trusted recovery. (Cat II impact)
Discussion
Without a disaster recovery plan, the application is susceptible to interruption in service due to damage within the processing site. If the application is part of the site’s disaster recovery plan, ensure that the plan contains detailed instructions pertaining to the application. Verify that recovery procedures indicate the steps needed for secure and trusted recovery.
Check Content
Review disaster recovery plan. Verify that a disaster recovery plan is in place for the application. Verify that the recovery procedures include any special considerations for trusted recovery. If the application is not part of the site’s disaster recovery plan, or if any special considerations for trusted recovery are not documented, this is a finding.
Fix Text
Create and maintain a disaster recovery plan.
Additional Identifiers
Rule ID: SV-222637r879887_rule
Vulnerability ID: V-222637
Group Title: SRG-APP-000516
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-000448 |
The organization develops a contingency plan for the information system that provides metrics. |