Availability Policy

2025.1

Reviewed: 9/20/2024
Updated: 9/20/2024

Purpose and Scope

1. The purpose of this policy is to define requirements for proper controls to protect the availability of the organization's information systems.
2. This policy applies to all users of information systems within the organization. This typically includes employees and contractors, as well as any external parties that come into contact with systems and information controlled by the organization (hereinafter referred to as "users"). This policy must be made readily available to all users.

Background:

1. The intent of this policy is to minimize the amount of unexpected or unplanned downtime (also known as outages) of information systems under the organization's control. This policy prescribes specific measures for the organization that will increase system redundancy, introduce failover mechanisms, and implement monitoring such that outages are prevented as much as possible. Where they cannot be prevented, outages will be quickly detected and remediated.
2. Within this policy, an availability is defined as a characteristic of information or information systems in which such information or systems can be accessed by authorized entities whenever needed.

Controls and Procedures

Availability Policy

1. Information systems must be consistently available to conduct and support business operations.
2. Information systems must have a defined availability classification, with appropriate controls enabled and incorporated into development and production processes based on this classification.
3. System and network failures must be reported promptly to the organization's lead for Information Technology (IT) or designated IT operations manager.
4. Users must be notified of scheduled outages (e.g., system maintenance) that require periods of downtime, outside of IMPLAN's standard maintenance window, which is 8 PM ET on Wednesdays. This notification must specify the date and time of the system maintenance, expected duration, and anticipated system or service resumption time.
5. Prior to production use, each new or significantly modified application must have a completed risk assessment that includes availability risks. Risk assessments must be completed in accordance with the Risk Assessment Policy.
6. Server systems should only be provisioned using preapproved configurations, such as Amazon Machine Images (AMIs) published by AWS or other trusted vendors.
7. Capacity management and load balancing techniques must be used, as deemed necessary, to help minimize the risk and impact of system failures.
8. All system changes, such as the requisition of additional production system resources and capacities, must be executed following the requirements in the System Change Policy.
   a. Provisioning of AWS resources must be accomplished through configurations managed and automatically deployed by Amazon Elastic Beanstalk.
9. Information systems must have an appropriate data backup plan that ensures:
   a. All sensitive data can be restored within a reasonable time period.
   b. Full backups of critical resources are performed on at least a weekly basis.
   c. Incremental backups for critical resources are performed on at least a daily basis.
   d. Backups and associated media are retained for at least one (1) year, or in accordance with legal and regulatory requirements.
   e. Backups are stored off-site with multiple points of redundancy and protected using encryption and key management.
   f. Tests of backup data must be conducted once per quarter. Tests of configurations must be conducted twice per year.
   g. Information systems must have appropriate redundancy and disaster recovery plans to ensure uptime meets the Service Level Agreement.
10. Information systems must have an appropriate business continuity plan that meets the following criteria:
    a. Recovery time and data loss limits are defined in Table 1.
    b. Recovery time requirements and data loss limits must be adhered to with specific documentation in the plan.
    c. Company and/or external critical resources, personnel, and necessary corrective actions must be specifically identified.
    d. Specific responsibilities and tasks for responding to emergencies and resuming business operations must be included in the plan.
    e. All applicable legal and regulatory requirements must be satisfied.