CP-001-Business-Continuity-Planning - Version 2 - Effective Date 03/13/2018

Sep 22, 2026

Upload by James

Establishes requirements for developing formal, documented contingency plans for UTHSC IT resources to maintain and resume normal business operations after emergencies, disasters, or extraordinary disruptions. Defines scope and key concepts including Business Impact Analysis (BIA), critical functions, and critical systems using data classification, legal/statutory contingency requirements, and Recovery Time Objective (RTO). Assigns responsibilities between the Office of Cybersecurity and data/system custodians and owners, and specifies standard plan elements such as activation authority, contacts, asset identification, backup/restore, testing, training, and mission-critical system history.

LanguageEnglish

CategoryLetters

FormatPDF

Pages7

Reading Time3 min

AccessFree to download

Purpose

Scope

Definitions

Responsibilities

Standard Requirements

Contingency plan elements

| Responsible Office: Office of Cybersecurity | Last Review: 04/20/2021
Next Review: 04/20/2023 | | --- | --- | | Contact: Chris Madeksho | Phone: 901.448.1579
Email: [mmadeksh@uthsc.edu](mmadeksh@uthsc.edu) | Purpose To establish requirements for the development of formal documented contingency plans for UTHSC IT Resources to maintain and resume normal business operation, recovering from an emergency, disaster, or other extraordinary disruption. The overall goal is to ensure that all departments and business units of the University are prepared to rapidly restore critical functions in the aftermath of any emergency or disaster. Scope All UTHSC IT Resources deemed necessary (critical system) to recover essential business functions or dependent business functions. Definitions Business Impact Analysis (BIA): An analysis of an information system’s requirements, functions, and interdependencies used to characterize system contingency requirements and priorities in the event of a significant disruption. Critical functions: functions required to enable, support, and implement the safekeeping of our students, staff, and visitors and facilitate the resumption of academic, research, and administrative programs. Critical systems: an UTHSC IT Resource having attributes including, but not limited to: a. Any system containing the authoritative copy of UTHSC data or information with a classification rating of 3 in any area using the guidelines set forth in GP- 002-Data & System Classification. b. Any system requiring contingency plans as prescribed by Federal or State statutes or regulations. c. Any system identified as having a Recovery Time Objective (RTO) or less than 24 hours. d. Deemed critical by the Business Impact Analysis (BIA) . | | | | --- | --- | | UT Health Science Center:
CP-001-Business Continuity Planning | | | Version 2 | Effective Date: 03/13/2018 | Data owner: The person who is ultimately responsible for the data and information being collected and maintained by his or her department or division. Disaster: Any IT incident which is determined to have potential impacts on the business continuity and ongoing operations of Southern Oregon University. • Major Disaster: A major disaster will normally have extensive damage to system hardware, software, networks, and/or operating environment. • Minor Disaster: A minor disaster will be characterized by an expected downtime of well below the RTO determined in the business impact analysis, and minor damage to hardware, software, and/or operating environment. Recovery Time Objective (RTO): The overall length of time an information system’s components can be in the recovery phase before negatively impacting the organization’s mission or mission/business processes. System owner: Person or organization having responsibility for the development, procurement, integration, modification, operation, and maintenance, and/or final disposition of an information system UTHSC Information Technology (IT) Resource: Any data, device, or other component of the information environment that supports information-related activities. Assets generally include hardware (e.g. servers and switches), software (e.g. mission critical applications and support systems) and information. Responsibilities Office of Cybersecurity is responsible for: • Developing a contingency plan template that guides data and system custodians and owners through all required elements. • Ensuring all contingency planning requirements and activities are in compliance with UTHSC policies; local, state and federal laws and guidelines. • Advising the Data or System Custodian and the Data or System Owner with regard to the technical aspects of these duties. Data and System Custodian in close collaboration with the Data and System Owner is responsible for: • Developing the contingency plan containing all required elements for the UTHSC IT Resource within scope. | | | | ---

FAQs

What is the purpose of CP-001 Business Continuity Planning?

It defines requirements for creating formal contingency plans so UTHSC departments can rapidly restore critical functions after an emergency, disaster, or extraordinary disruption.

What systems are in scope for this contingency planning requirement?

All UTHSC IT resources deemed necessary for recovering essential or dependent business functions, including critical systems identified through data classification, statutory contingency plan requirements, or RTO targets.

Which standard plan elements must be included in the contingency plan?

The plan must address business continuity, emergency mode operation, and recovery, and include items such as activation authority, points of contact, asset and risk identification, backup and offsite storage, restoration procedures, testing and training records, and mission-critical system history.

Sep 22, 2026

Upload by James