INTERIM - Business Continuity and Disaster Recovery standard

Overview

This updated standard is to help align existing IT practices around Contingency Planning to the requirements in NIST 800-53 (CP | 3.6.x) as well as industry best practices.

What is in this document:

  • The definition of the BC/DR Tiers
  • Methodology for calculating relevant BC/DR metrics
  • Review timelines for various tiers

What is NOT in the document:

  • The contents of the BC/DR plan template
  • Full coverage of 3.6.* under NIST 800-53

Policy Reference

APM 30.11 University Data Classification and Standards
APM 30.XX Business Continuity and Disaster Recovery (PENDING)

Purpose

This Business Continuity and Disaster Recovery (BC/DR) standard supports APM 30.xx Business Continuity and Disaster Recovery, and APM 30.11 University Data Classification and Standards and other relevant university policies.

Scope

All managed and unmanaged systems that access, store or process University of Idaho data (see APM 30.14 C-6) or using University of Idaho technology resources (see APM 30.12 C-1) at the Low, Moderate, or High risk levels (see APM 30.11).

The scope of this standard does not supersede approved system security plans, laws, regulations, or contractual limitations or requirements.

Standards

  1. Business Impact Assessment (BIA).

    1. Pre-assessment.

      1. System owners or their designee must verify if any of the conditions below are met:

        1. There are no legal, contractual, or other external requirements for the environment that require a BIA or BC/DR plan.

        2.  There is no risk to human health or safety if the system is unavailable or data is lost.

        3. The financial loss per hour is less than .3% (or roughly 1 day) of the annual budget for the department/group responsible for the system.

        4. The educational impact is within acceptable thresholds for the relevant academic group.

        5. There are no other reasons that system should have a full BIA and BC/DR plan.

      2. If all of the conditions above are met, the system is a Tier 3 system.

    2. Business Impact Assessment.

      1. System owners or their designee must complete the full business impact assessment for Tier 1 and Tier 2 systems.

      2. System owners must document dependencies.

        1. Must document only direct dependencies.

      3. Calculations.

        1. Maximum Tolerable Downtime (MTD) and Recovery Time Objective (RTO) of critical processes will be determined at the discretion of the system owner.

          1. MTD will be calculated as the amount of time until the amount of productivity lost due to the system being unavailable is unacceptable.

            1. For example: If an unacceptable loss is $100, and $10 of productivity is lost per hour, the MTD is 10 hours.

          2. RTO will be calculated as the target recovery time of specific system components to meet the MTD of the processes that rely on them.

          3. Must take dependent systems into account.

        2. Recovery Point Objective (RPO) of critical data will be determined at the discretion of the data steward.

          1. RPO will be calculated as the amount of time passed until the quantity of data lost by the system being unavailable is unacceptable or one half of the amount of time that it is acceptable to be in an emergency operations mode.

            1. Example: If the unacceptable amount of money lost is $1000 and each transaction averages to roughly $10 per transaction and there are 10 transaction per hour, the RPO is $1000/($10*10/hr) = 10 hours.

          2. Must include both critical user and system configuration where applicable.

      4. Tiering.

        1. If the MTD is below 4 working hours, a business continuity plan is required.

          1. Business continuity plans may also be required by external obligations.

          2. Business continuity plans may also be required if emergency operations mode is required.

        2. If the RPO is within 1 business day, a disaster recovery plan is required.

          1. Disaster recovery plan may also be required by external obligations.

        3. If both a business continuity plan and disaster recovery plan are required, it is a Tier 1 system, if one is required it is a Tier 2 system, if neither is required, it is a Tier 3 system.

          1. The Chief Information Security Officer (CISO) or Chief Information Officer (CIO) may override the tier where appropriate.

    3. System owners or their designee must review their business impact assessments at the relevant intervals:

      1. Tier 3 systems: upon significant changes to the system and at the discretion of the system owner.

      2. Tier 2 systems: every 5 years.

      3. Tier 1 systems: annually.

      4. The schedule may be overridden by a defined schedule within an approved BC/DR plan.

  2. BC/DR Plans.

    1. System owners or their designee must complete relevant sections per the BIA to the satisfaction of all the approvers of the BC/DR plan.

      1. This includes the plan maintenance and testing section for all Tier 1 and Tier 2 systems.

    2. Plans must be stored in an approved storage location meeting requirements for moderate risk data.

      1. Plan may be re-identified as low or high risk and stored in appropriate storage locations by the system owner.

    3. System owners or their designee must review their BC/DR at the relevant intervals:

      1. Tier 3 systems: upon significant changes to the system and at the discretion of the system owner.

      2. Tier 2 systems: every 5 years.

      3. Tier 1 systems: annually.

      4. The schedule may be overridden by a defined schedule within an approved BC/DR plan.

    4. System owners or their designee must communicate BC/DR plans to all relevant individuals.

      1. Including anyone named in the plan or expected to execute the plan.

    5. Backups and Alternative sites or tools.

      1. Must meet relevant OIT Security standards for the data being processed, stored, or accessed by the backup or alternative.

      2. Must be logically and/or physically separated from primary sites or tools to the level acceptable to the system owner and relevant stakeholders. 

      3. Must be configured to meet recovery objectives. 

Definitions

  1. BC/DR
    Business Continuity and Disaster Recovery

  2. Maximum Tolerable Downtime (MTD)
    The amount of time mission/business process can be disrupted without causing significant harm to the organization’s mission.

  3. Recovery Point Objective (RPO)
    The point in time to which data must be recovered after an outage.

  4. Recovery Time Objective (RTO)
    The overall length of time an information system’s components can be in the recovery phase before negatively impacting the organization’s mission or mission/business processes.

  5. Tier 1 systems
    Systems that have the highest availability requirements in that they have components that must be online during an emergency as well as need to be recovered as soon as possible.

  6. Tier 2 systems 
    Systems that have any availability requirements, specifically have components that must either be online during an emergency or must be recovered as soon as possible.

  7. Tier 3 systems 
    Systems that have no major availability requirements.

Other References

NIST SP 800-184
NIST SP 800-53
45 CFR § 164.308 (HIPAA)
16 CFR § 314.4 (GLBA)

Standards Owner

Office of Information Technology Information Security Office

Revision History

10/30/2026 – Original Standard

  • Full alignment with pending BC/DR policy (N. Flynn, M. Parks)
Print Article