Title

Disaster recovery plan does not include ESX Servers, VirtualCenter servers, virtual machines, and necessary peripherals associated with the system. (Cat II impact)

Discussion

Disaster and recovery plans should be drafted and exercised in accordance with the MAC level of the system/Enclave as defined by the DoDI 85002. Disaster plans provide for the resumption of mission or business essential functions. A disaster plan must exist that provides for the resumption of mission or business essential functions within the specified period of time depending on MAC level. (Disaster recovery procedures include business recovery plans, system contingency plans, facility disaster recovery plans, and plan acceptance).

Check Content

Request a copy of the disaster recovery plan from the IAO/SA. Review the plan to verify that the ESX Server, management applications, virtual machines, and all necessary system peripherals are included in the plan. If the plan does not include the virtual infrastructure or is incomplete, this is a finding.

Fix Text

Add the virtual infrastructure to the disaster recovery plan.

Additional Identifiers

Rule ID: SV-16794r1_rule

Vulnerability ID: V-15853

Group Title: Disaster recovery plan is not complete

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.