Organizations must develop and operate a testing program in non-disaster situations so that IRS leadership and personnel have familiarity with contingency plans and procedures and validates the IRS’ contingency capabilities through regular tests, training, and exercises. It can also identify issues or deficiencies for remediation. (IRS-defined)

Exercises and tests offer different ways of ensuring that ISCPs provide viable and actionable procedures to recover or restore IRS systems and applications to their original state in the event of a disruption. (IRS-defined)

Steps to establish a Test, Training and Exercise (TT&E) program should include the following: (NIST 800-84: Chapter 2)

The following elements are suggested to be included in a TT&E policy: (NIST 800-84: Section 2.1)

Refer to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-84, for guidance on establishing an effective ISCP testing program and the various methods and approaches for conducting exercise activities. (IRS-defined)

All tests and exercises must include some kind of determination of the effects on the organization’s operations and provide for a mechanism to update and improve the plan as a result. (IRS-defined)

The depth and rigor of ISCP testing activities increases with the FIPS 199 availability security objective. Refer to the ISCP templates (FIPS 199 LOW, MODERATE, and HIGH systems) in NIST SP 800-34 Contingency Planning Guide for Federal Information Systems, for details for conducting testing activities appropriate to their respective impact level. (IRS-defined)

The depth and rigor of ISCP testing activities increases with the FIPS 199 availability security objective. (IRS-defined)

The ISCP must provide procedures and capabilities for recovering a system or application in the event of a system disruption. The plan must address the resources, roles, responsibilities, and procedures for restoration of information systems and recovery of business applications and processes after a disruption. (IRS-defined)

The keystroke procedures located in the ISCP are an information system-focused part of the plan designed to restore operability of the target system or application, at an alternate site after an emergency. (IRS-defined)

The purpose of the keystroke recovery procedures is to provide documented, detailed step-by-step procedures to facilitate recovery of capabilities at an alternate site; the scope is information system-focused and limited to major disruptions. (IRS-defined)

Tabletop exercises are discussion-based exercises only and do not involve deploying or recovering systems, equipment, or other resources. (NIST 800-84: Chapter 4)

An ISCP tabletop exercise is a simulation of an emergency designed to validate the viability of one or more aspects of an ISCP. (NIST 800-84: Chapter 2)

Personnel with roles and responsibilities in a particular ISCP should be invited to attend the tabletop exercise to validate the content of the plan during a discussion of their roles and responses to emergency situations, execution of responses in a simulated operational environment, or other means of validating responses that do not include using the actual operational environment. (NIST 800-84: Chapter 2)

ISCP tabletop exercises are scenario-driven (such as a power failure in one of the organization’s computing centers or a fire causing certain systems to be damaged) with additional situations often being presented during the course of an exercise. (NIST 800-84: Chapter 2)

ISCP tabletop exercises help to identify gaps and inconsistencies within ISCPs and procedures, as well as cases where personnel need additional training or when training needs to be changed. Deficiencies identified during tabletop exercises are documented in the ISCP Testing Checklist as part of the exercise process. (NIST 800-84: Chapter 2)

Information or procedures needing validation during the ISCP tabletop exercise include but are not limited to roles and responsibilities, hardware and software inventories, keystroke recovery procedures, data back-up procedures, and interdependencies that are documented in the plan. (NIST 800-84: Section 4.2.3)

An ISCP tabletop exercise schedule must be created annually by the ISCPT staff. BOD POC’s must be notified and their approval obtained by the ISCPT staff when a tabletop exercise is being scheduled. (NIST 800-84: Section 4.1)

IRS must conduct ISCP tabletop exercises for applicable applications or systems at least annually. Applicable applications or systems include those that are classified as Tier 1, 2 or 3. (IRS-defined)

The topics should be determined. Discussion topics may include the roles and responsibilities of personnel with regard to disaster recovery and incident response. Discussion topics may also include processes and procedures for disaster recovery and incident response. (NIST 800-84: Section 4.2.1)

The scope should be determined. Senior-level teams and operational-level teams should participate in separate tabletop exercises initially because of their different levels of responsibility and then in a combined exercise to validate coordination between the groups. (NIST 800-84: Section 4.2.2)

Application or system ISCP Leadership and operational-level personnel, including a data collector (as designated by the BOD), should be invited to ISCP tabletop exercises to discuss individual and team roles, responsibilities, and to validate information contained in the plan. (NIST 800-84: Section 4.2.4)

The ISCPT facilitator leads the discussion among the tabletop exercise participants. (NIST 800-84: Section 4.2.5)

Logistics for ISCP tabletop exercises should be coordinated. (NIST 800-84: Section 4.2.6)

The tabletop exercise material should be developed. (NIST 800-84: Section 4.3)

The ISCP Testing Checklist is an IRS internal document designed to assist BODs and support staff in navigating through tabletop exercise events. The BOD designated data collector records information and actions that occur during the exercise using an applicable version of the ISCP Testing Checklist. Refer to Exhibit 10.8.62-1 and 10.8.62-2 at the end of this document. (NIST 800-84: Section 4.2.5; IRS-defined)

Functional exercises allow personnel to validate application/system operational readiness for emergencies by validating backup procedures – specifically with regards to backup retrieval, reading backup data, and validation of offsite storage.(NIST 800-84: Chapter 5)

Functional exercises allow staff to execute their roles and responsibilities as they would in a recovery situation. (NIST 800-84: Chapter 5)

A functional exercise schedule should be created annually by the ISCPT staff and shared with Data Management and BOD IT staff. The following should be identified: (NIST 800-84: Section 5.1)

Data Management staff in IT and BOD IT must conduct functional testing using the following frequency: (IRS-defined)

Logistics for functional exercises should be coordinated. (NIST 800-84: Section 5.2.6)

The functional exercise material should be developed. (NIST 800-84: Section 5.3)

Data Management staff within IT and BOD IT must provide evidence of conducted functional tests, to include evidence of media retrieval from an offsite storage location and screen shots to validate successful testing has been completed. (IRS-defined)

Data Management staff in IT and BOD IT must record functional test results using Part B of the applicable version of the ISCP Testing Checklist. (IRS-defined)

Evidence gathered from functional tests should be submitted to the Cybersecurity, ISCPT staff within five (5) work days from the test ending date. (IRS-defined)

Evidence packages for all applications/systems receiving a functional test will be uploaded to TFIMS by the Cybersecurity, ISCPT staff before the end of each FISMA cycle. (IRS-defined)

A DR test is the method used to evaluate the organization's readiness and ability to recover an application or system from varying degrees of non-functioning to its original functional state in an alternate operational environment specified in an ISCP. (IRS-defined)

DR Tests are used to measure the effectiveness and suitability of the processes and procedures contained in ISCPs for the systems being tested and to evaluate compliance with a contingency plan. In the event of a disaster or disruption, the goal is to use ISCPs to ensure that documented operational procedures and plans result in successful recovery of business applications and systems. (IRS-defined)

The scope of tests can range from individual system components or systems to comprehensive tests of all systems and components that support an ISCP. (NIST 800-84: Section 6.2.1)

A test is conducted in as close to an operational environment as possible, testing components, or systems used to conduct daily operations. (NIST 800-84: Section 6.3)

A DR test is required annually for CIP assets, assets that support any of the MEFs or assets with a high availability categorization. (IRS-defined)

A DR test schedule should be created and managed collaboratively between the Cybersecurity, ISCPT staff and BOD IT staff annually for DR tests needed to satisfy DR testing requirements for CIP, MEF or high availability assets managed by BOD IT personnel. (NIST 800-84: Section 6.1)

Each reportable application or system involved in a DR test must have a contingency plan that includes but is not limited to: (IRS-defined)

The DR test event should be designed. The following should be identified:(NIST 800-84: Section 6.2)

The DR test material should be developed. (NIST 800-84: Section 6.3)

Each DR test for CIP, MEF or high availability assets managed by EOps must be facilitated by the EOps, ITCM staff. EOps, ITCM personnel are responsible for: (IRS-defined)

Each DR test for CIP, MEF or high availability assets managed by EOps must be observed by the Cybersecurity, ISCPT staff. (IRS-defined)

DR tests required for CIP, MEF or high availability assets managed by BOD IT personnel must be conducted by BOD IT staff. (IRS-defined)

Evidence gathered from each DR test must include: (IRS-defined)

Evidence gathered from DR tests should be submitted to the Cybersecurity, ISCPT staff within fifteen (15) work days from the test ending date. (IRS-defined)

The Cybersecurity, ISCPT staff must produce a test report presentation for the DR tests at ECC-Martinsburg and ECC-Memphis. (IRS-defined)

The ECC test report presentation must include: (IRS-defined)

Evidence packages for all applications/systems tested during the DR test will be uploaded to the TFIMS by the Cybersecurity, ISCPT staff before the end of each FISMA cycle. (IRS-defined)

The ISCPT Observation Report is a presentation for Senior Management and Executives. This overview is a summary report of an ECC DR test which contains an overall synopsis of the recovery capabilities. The ISCPT Observation Report may include: (IRS-defined)

Refer to Exhibit 10.8.62-5, ECC Disaster Recovery (DR) Test Job Aid. This exhibit provides step-by-step procedures for IRS IT personnel to perform the ECC DR Tests. All ECC Disaster Recovery (DR) Tests will be conducted using the approved procedures in Exhibit 10.8.62-5. (IRS-defined)

An Alternate Site Processing (ASP) test may be conducted in lieu of a Disaster Recovery test. (IRS-defined)

During an ASP test, the application/system that is transitioned will run at the alternate site for a predetermined period of time. (IRS-defined)

An ASP test schedule must be managed by the Enterprise Operations (EOps), IT Continuity Management (ITCM) Branch staff for each ASP test EOps conducts. This schedule may be combined with the DR test schedule. (IRS-defined)

The ASP test schedule must be shared with the Cybersecurity ISCPT staff by the EOps staff annually. (IRS-defined)

Each reportable application or system involved in an ASP test must have a contingency plan that includes, but is not limited, to the following information: (IRS-defined)

Each ASP test for CIP, MEF or high availability assets managed by EOps must be facilitated by the EOps ITCM staff. EOps ITCM personnel are responsible for: (IRS-defined)

Each ASP test for CIP, MEF or high availability assets managed by EOps must be observed by the Cybersecurity ISCPT staff. (IRS-defined)

ASP tests required for CIP, MEF or high availability assets managed by BOD IT personnel must be conducted by BOD IT staff. (IRS-defined)

Evidence gathered from each ASP test must include: (IRS-defined)

Evidence gathered from ASP tests should be submitted to the Cybersecurity ISCPT staff within 15 work days from the test ending date. (IRS-defined)

Evidence collected for applications/systems tested during an ASP test will be uploaded to the TFIMS by the Cybersecurity ISCPT staff before the end of each FISMA cycle. (IRS-defined)

Refer to Exhibit 10.8.62-3, Ad Hoc Disaster Recovery/ASP Testing SOP. This exhibit provides step-by-step procedures for IRS IT or BOD Information System personnel to perform Disaster Recovery/ASP exercises. All Ad Hoc Disaster Recovery/ASP Testing will be conducted using the approved procedures in Exhibit 10.8.62-2. (IRS-defined)

Training refers to informing personnel of their roles and responsibilities within an information system contingency plan and teaching them skills related to those roles and responsibilities, thereby preparing them for participation in exercises, tests, and actual emergency situations related to the information system contingency plan. (NIST 800-84: Chapter 3)

The scheduling of training sessions will be coordinated closely with the schedules for ISCP tabletop exercises, functional exercises, and DR tests. (NIST 800-84: Chapter 3)

Training sessions will emphasize understanding the ISCP Testing process, to include following documents in preparation for participating in each test or exercise: (IRS-defined)

Recovery personnel must be trained on the following plan elements: (IRS-defined)

The ISCP Testing Checklist is a three part form that allows BODs and Support Organizations to document multiple ISCP exercise/test results on one form to create a testing artifact that includes AO authority. (IRS-defined)

The ISCP Testing Checklist provides a step-by-step process to guide participants through the most pertinent sections of the ISCP. The Checklist provides an area to document changes for each section in the ISCP and changes to procedures that might be needed. The Checklist also provides areas to document the results of functional exercises and DR tests, if applicable. (IRS-defined)

The Checklist standardizes the process for all applications and systems, and documents all testing activities and ISCP changes. The Checklist serves as the validated artifact for ISCP testing, functional exercises, and DR Testing exercises and events. The Checklist and supporting documentation are uploaded to TFIMS after it has been reviewed and signed by the AO or AODR. (IRS-defined)

The Checklist is used to train personnel in their contingency roles and responsibilities with respect to their application or system. (IRS-defined)

Completion of the Checklist documenting performance of the required ISCP testing exercises and/or tests serves as an evidentiary artifact in TFIMS to verify that the following family of controls, if appropriate (Reference NIST 800-53): (IRS-defined)

Each BOD will be responsible for identifying a Data Collector who must document changes, issues, or findings identified during the tabletop exercise in the appropriate sections of the ISCP Testing Checklist. (IRS-defined)

The ISCP Testing Checklist will be used as an artifact in TFIMS to document all tabletop exercises, functional exercises, and DR tests that are conducted. (IRS-defined)

ISCPT utilizes the tabletop session as a training opportunity, as well as a testing exercise, to thoroughly understand the ISCP information and verify its accuracy and effectiveness. Training credit will be given to those that attend the entire tabletop exercise. (IRS-defined)

Using the approved testing schedule, the assigned ISCPT Facilitator will send a calendar invitation for the tabletop exercise to all POCs thirty (30) calendar days prior to the day of the exercise. (IRS-defined)

The assigned ISCPT Facilitator must provide the ISCP Testing Checklist with items 1-4 of the checklist pre-populated, along with the converted ISCP, to the Data Collector who is designated by the BOD Security PMO or application/system AO prior to the tabletop exercise. (IRS-defined)

Using the converted version of the ISCP along with POA&M information stored in TFIMS the Data Collector must populate items 5 through 7 and Part A on the Checklist, prior to the tabletop exercise. If necessary, the Data Collector will communicate with appropriate BOD or IRS IT personnel to complete this task. The assigned ISCPT Facilitator must provide the ISCP Testing Checklist with items 1-4 of the checklist pre-populated to the Data Collector who is designated by the BOD Security PMO or application/system AO. (IRS-defined)

Once the Data Collector has populated items 5 through 7 and Part A of the Checklist, the Data Collector must forward the Checklist and converted ISCP to all recipients, including the ISCPT Facilitator at least seven (7) business days prior to the tabletop exercise. (IRS-defined)

During the tabletop exercise, the Data Collector is responsible for capturing on the Checklist all changes, observations, lessons learned, and summary findings that result from the tabletop discussions. The Date Exercise Completed block must be entered with the date the tabletop was performed. (IRS-defined)

After the exercise, the Data Collector has fifteen (15) work days to update the Checklist with the results of the exercise. The Facilitator will coordinate with the Data Collector as needed to provide guidance and to compare notes taken during the exercise. (IRS-defined)

Once the post-tabletop Checklist update is completed, the Data Collector must send it to the ISCPT group mailbox at *IT IT DR Mailbox and the BOD Security PMO. ISCPT personnel must forward it to the assigned ISCPT Facilitator, who must review the Checklist to ensure that all information has been recorded. If Checklist corrections are needed, the Facilitator will coordinate with the Data Collector to ensure that the modifications are made. (IRS-defined)

The ISCP Facilitator will ensure that all required testing has been completed for the application or system named on the Checklist. This may mean that the Facilitator will hold the Checklist until all additional testing has been completed and can be documented in Part B or Part C of the Checklist. If no other testing is required, the ISCPT Facilitator must prepare and send the Checklist back to the Data Collector and the BOD Security PMO within seven (7) business days for AO or AODR digital signature. (IRS-defined)

The AO or AO Designee has 15 work days to sign the Checklist. (IRS-defined)

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

Functional exercises are performed by IRS IT personnel or by the BOD’s information system personnel when the application is not supported by IRS IT. Functional exercises are completed on backed-up data or information to prove back-up resiliency. (Refer to Exhibit 10.8.62-1.) (IRS-defined)

Refer to Exhibit 10.8.62-2, ISCP Functional Exercise Methodology and Procedures. This exhibit provides step-by-step procedures for a backup retrieval and sampling pull for functional exercise activities. All functional exercises will be conducted using the approved procedures in Exhibit 10.8.62-2. (IRS-defined)

As the production environment implements new technologies, strategies, and procedures, IRS IT and SRM must assess when to modify Exhibit 10.8.62-2 procedures to ensure that functional exercises can be performed to accommodate the updated production environment. (IRS-defined)

During the functional exercise,

IRS IT or BOD information system personnel must also provide evidence to validate that documented backup procedures in the ISCP are in place and that the ISCP includes information about the backup frequency, encryption of backup media, offsite storage site, and timelines for receipt of backup media from offsite storage during normal working hours and after hours. (IRS-defined)

If no documented procedures are in the ISCP describing the backup process, the issue will be documented in Part B of the Checklist. In addition, if the backed-up data or information cannot be successfully retrieved or read, or if evidence cannot be captured for the exercise, these issues will also be documented in Part B of the Checklist. (IRS-defined)

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

Once the final checklist has been prepared for AO or AODR signature, ISCPT will send the checklist to the BOD Security PMO or Data Collector.(IRS-defined)

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

Upon receipt of the signed Checklist and supporting documentation from the AO or AODR, ISCPT must upload the Checklist into TFIMS as the validated artifact along with all supporting documentation. (IRS-defined)

IRS is required to perform DR tests on all applications with a FIPS 199 High availability categorization, on assets that support any of the MEFs and on CIP assets. (IRS-defined)

DR tests involve activities such as performing cutovers from one platform or system to another, relocation of systems/applications, or recovery of platforms and their hosted applications. As DR tests are performed on systems, sites, or platforms, hosted applications can benefit from these tests through coordination of the application ISCP review and the DR test activities. (IRS-defined)

IRS or BOD IT personnel perform DR tests. During the performance of the DR Test, IRS or BOD IT personnel must complete the ISCP Testing Checklist Part C, and Test Case templates as they conduct the test. (Refer to Exhibit 10.8.62-1.) (IRS-defined)

The ISCPT Staff will coordinate with IRS IT or BOD information system personnel to identify components, systems, and/or comprehensive tests to be planned based on FISMA, Treasury, and NIST requirements, and IRS executive-level priorities. (IRS-defined)

Successful recovery of a production location at the alternate processing site is considered meeting the IRS DR Testing requirement if documentation and evidence are gathered. The Service may also consider combining tests with planned operational activities, such as restoring a backup, moving a server from one room to another, upgrading or patching operating systems or applications, or changing hardware components (e.g., swapping hard drives, replacing a failed power supply etc.). The results of this collaboration will define the scope and objectives for the tests. (IRS-defined)

The ISCPT Staff will collaborate with designated BOD POCs to determine if the tests identified in collaboration with IRS IT or BOD IT personnel are compatible with the priorities and processing timeframes of the Business Unit. ISCPT and/or IRS IT information system personnel will coordinate with BODs to determine the level of involvement required from the BOD POCs. (IRS-defined)

The ISCPT will collaborate with IRS IT or BOD information system personnel to create a DR test schedule annually based on IRS and FISMA requirements, FISMA timeframes, and business processing priorities. (IRS-defined)

The ISCPT Staff will coordinate activities with IRS IT or BOD information system personnel to ensure that the ISCP Testing Checklist, Summary Report, and all testing documentation is completed before, during, and after testing. (IRS-defined)

For Enterprise Computing Center or DR tests performed by BOD IT information system, IRS IT or BOD information system personnel will: (IRS-defined)

For the purposes of reporting on the progress of exercises and testing, ISCPT must maintain a scorecard to document the progress of the ISCP tabletop and functional exercises and the status of the DR tests. (IRS-defined)

ISCPT must upload the updated ISCP, signed Checklist, and all evidence and documentation for each ISCP tested application or system into TFIMS in a timely manner. ISCPT will also update the Contingency Planning (CP) fields in TFIMS with the appropriate dates. (IRS-defined)

The following ISCP Testing documentation is uploaded into TFIMS after exercise/testing is completed: (IRS-defined)

The following Contingency Planning (CP) fields will be updated in TFIMS after exercise/testing is completed: (IRS-defined)