New Control

Reference: § 3.4.3 ¶ 7

Guidance: Alternate sites may be owned and operated by the organization (internal recovery), or commercial sites may be available under contract. If contracting for the site with a commercial vendor, adequate testing time, work space, security requirements, hardware requirements, telecommunications requirements, support services, and recovery days (how long the organization can occupy the space during the recovery period) must be negotiated and clearly stated in the contract. Customers should be aware that multiple organizations may contract with a vendor for the same alternate site; as a result, the site may be unable to accommodate all of the customers if a disaster affects enough of those customers simultaneously. The vendor's policy on how this situation should be addressed and how priority status is determined should be negotiated.

New Control: Include priority-of-service provisions in Service Level Agreements for all alternate facilities.

Reasoning for No Match: New CC: Include priority-of-service provisions in Service Level Agreements for [all] alternate facilities. Parent: 745 - Establish, implement, and maintain Service Level Agreements for all alternate facilities.