SAMMY UI is optimized for resolutions with a width 1024px and higher.
NIST 800-34
Browse NIST 800-34
AP.TM: Test and Maintenance
Test and Maintenance
AP.TM: Do you have DRP testing and maintenance procedures in place?
  • You provide information and a schedule for the testing of the system
  • You review and test all DRPs at regular intervals (e.g., yearly)
  • You document the test results and improve the DRP
CMMI Maturity Level
Not Applicable - Not applicable
Level 1: Initial - Unpredictable and reactive. Work gets completed but is often delayed and over budget.
Level 2: Managed - Managed on the project level. Projects are planned, performed, measured, and controlled.
Level 3: Defined - Proactive, rather than reactive. Organization-wide standards provide guidance across projects, programs, and portfolios.
Level 4: Quantitatively Managed - Measured and controlled. Organization is data-driven with quantitative performance improvement objectives that are predictable and align to meet the needs of internal and external stakeholders.
Level 5: Optimized - Stable and flexible. Organization is focused on continuous improvement and is built to pivot and respond to opportunity and change. The organization’s stability provides a platform for agility and innovation.
Description

All ISCPs should be reviewed and tested at the organization defined frequency (e.g. yearly) or whenever there is a significant change to the system. Provide information and a schedule for the testing of the system. For low-impact systems, a yearly tabletop exercise is sufficient. The tabletop exercise should include all ISCP points of contact, and be conducted by an outside or impartial observer. A formal test plan is developed prior to the tabletop, and an exercise and questions are developed to include key sections of the ISCP, including a walk-through of the following:

  • Notification procedures;
  • System recovery on an alternate platform from backup media;
  • Internal and external connectivity; and
  • Reconstitution procedures. Results of the test are documented in an After Action Report, and Lessons Learned are developed for updating information in the ISCP.