DMSO Mission Assurance Lexicon

Overview

The DMSO Mission Assurance Lexicon is apparently a document released by the United States Defense Modeling and Simulation Office [W]. The original documents were unable for access at the time of this writing (2007-05-26 16:52 EST), but the text was retrieved from a cached copy at Google. The HTML title is given as "Business Assurance Office (BAO) Lexicon".

Text

Term	Definition	Related Terms
Activation Phase	Initial actions taken upon system disruption or detection of imminent emergency. This phase includes activities to notify recovery personnel, assess system damage, and implement the plan.	Emergency Response, Notification
Activity Log	A record of activities and data information maintained during an emergency.
Alert	Notification that a potential emergency or crisis exists or has occurred; direction for recipient to stand by for possible activation of crisis management and to ensure emergency preparedness procedures are in place.	Notification
Alternate Site / Alternate Backup Site	An alternate location, such as an IT or computer center, that becomes operational should a primary facility become inaccessible due to a disaster.	Cold Site, Deployment/ Relocation Site, Recovery Site
Backups	Duplication or replication of systems, applications, programs, and/or production files for storage both on and/or offsite.  Data backups are vital in the restoring of corrupted or lost data, or to recover entire systems and databases in the event of a disaster.	File Shadowing
Backup Generator	An independent source of power, usually fueled by diesel or natural gas.
Business Continuity	The process on sustaining an organization’s business functions during and after a disruption. See: Business Continuity Plan
Business Continuity Management	Strategic and operational framework in which appropriate redesign is required in the way an organization provides its products and services while increasing its resilience to disruption, interruption or loss.
Business Continuity Plan (BCP)	The documentation of a predetermined set of instructions or procedures that describe how an organization’s business functions will be sustained during and after a significant event or disruption. A disaster recovery plan, business resumption plan, and occupant emergency plan may be appended to the BCP. Responsibilities and priorities set in the BCP should be coordinated with those in the Continuity of Operations Plan (COOP) to eliminate possible conflicts. See also Continuity of Operations.	Contingency Plan, Disaster Recovery Plan
Business Impact Analysis (BIA)	An analysis of all critical business functions and processes and the measured impact that a disaster would have on an organization. The BIA should quantify the total loss impact by establishing the costs (lost daily revenue) multiplied by the number of days of interruption to business.
Business Recovery	Process of returning/restoring an entity to an acceptable operational condition in order to resume business processes.	Business Resumption, Business Continuity, Reconstitution
Business Recovery Team	See:  Business Resumption Team
Business Resumption (BR)	The process of resuming an organization’s critical business processes and functions to an acceptable level of operations as defined by the organization or agency. Developing advance business resumption plans and procedures addresses all activities within the lifecycle of an event to the return to normal business operations. See Business Resumption Plan	Business Recovery, Business Continuity, Disaster Recovery Planning, Data Recovery, Restoration
Business Resumption Plan (BRP)	The documentation of a predetermined set of instructions or procedures that describe how business processes will be restored after a significant disruption has occurred.	Business Resumption, Business Continuity Plan, Disaster Recovery Plan
Business Resumption Team (BRT)	A team of subject matter experts who will support in activities of resuming critical business processes and functions after a disruption. The Business Resumption Team will integrate and collaborate with the IT Disaster Recovery Team to provide integrated business continuity support.	Disaster Recovery Team
Call Plan/Call Roster	A plan containing personal contact information and procedures for contacting everyone on a list to assess accountability and life/safety of all personnel.  Activated upon implementation of a COOP or emergency.	Call Tree
Call Tree	A common notification method that involves assigning notification duties to specific individuals, who in turn are responsible for notifying other recovery personnel. The call tree should account for primary and alternate contact methods and should discuss procedures to be followed if an individual cannot be contacted.
Certified Business Continuity Practitioner (CBCP)	A certified practitioner having subject matter expertise in the business continuity field. The Disaster Recovery International Institute (DRII) is the sole grantor for these certifications, including the MBCP (Master Business Continuity Practitioner) and ABCP (Associate Business Continuity Planner).	DRII Certified Practitioner
Checklist	A checklist is a list of items of activities and/or items contained in a plan that one must execute in event of an emergency.
Cold Site	A backup facility that has the necessary electrical and physical components of a computer facility, but does not have the computer equipment in place. The site is ready to receive the necessary replacement computer equipment in the event that the user has to move from their main computing location to an alternate site.	Backup Site, Recovery Site, Alternate Site
Consortium Agreement	An agreement made by a group of organizations to share processing facilities and/or office facilities if any one member suffers severe impact from a disaster and cannot operate self-sufficiently.	Reciprocal Agreement, Memorandum of Understanding
Contingency Planning	Management policy, plans, and procedures designed to maintain or restore business operations, including computer operations, possibly at an alternate location, in the event of an emergency, system failure, or disaster. A contingency plan may contain any number of resources including workaround procedures, an alternate site, a reciprocal agreement, or replacement resources.	Continuity of Operations Plan, Business Continuity Plan
Continuity Of Government (COG)	All measures designed or taken to ensure the uninterrupted execution of specific executive, legislative, and judicial functions of government in the event of an enemy attack on the Continental United States (CONUS).
Continuity Of Government Condition (COGCON) System	A rating system specifically designed to relate COOP actions to threat and alert posture. The new system, COOP COGCON, shows actions designated by ratings of 1 through 4, with 1 being the highest, that should be accomplished when the government’s “level of concern” changes from a range of Guarded (i.e., COGCON 4) to High (COGCON 1).	Homeland Security Advisory System
Continuity Of Operations (COOP) Plan	A COOP Plan identifies essential functions, specifies succession to office and emergency delegation of authority, provides for the safekeeping of vital records and databases, identifies alternate operating facilities, provides for interoperable communications and describes the test, training, and exercise program.	Contingency Plan
Continuity of Support Plan	The documentation of a predetermined set of instructions or procedures mandated by Office of Management and Budget (OMB) A-130 that describe how to sustain major applications and general support systems in the event of a significant disruption.
Consolidated Crisis   Management	The overall coordination or management approach of an organization's response to a crisis in an effective, timely manner, with the goal of avoiding or minimizing damage to the organization's profitability, reputation, or ability to operate. Elements include situation awareness, business intelligence, decision support, and incident management.
Crisis	A critical event(s), which if handled ineffectively, can dramatically impact an organization's profitability, reputation, or ability to operate.	Disaster, Event, Emergency, Disruption
Crisis Management	The coordination of efforts to control a crisis event consistent with strategic goals of the organization.  Crisis management responsibilities extend to pre-event prevention and preparedness, and post-event restoration and transition.	Incident Management
Crisis Management Plan (CMP)	A plan designating varied responsibilities to the ICS teams, providing guidance on authorities, communication strategies, building evacuation procedures, call plan, shelter in place procedures, and other relative information to provide support to personnel on life/safety issues during a disruptive event.	Incident Management Plan
Crisis Communication	All means of communication, both internal and external to an organization, designed and delivered to support the Crisis Management function.
Crisis Communication Plan	Typically addresses internal communication flows to personnel and management and external communication with the public. The most effective way to provide helpful information and to reduce rumors is to communicate clearly and often. The plan should also prepare the organization for the possibility that during a significant disaster the organization may be a communication-forwarding point between personnel, civil and federal authorities, and affected families and friends.
Critical Business Process (CBP)	Business activities or process information that cannot be interrupted or unavailable a predetermined amount of time without significant negative impact to an organization’s ability to continue operations.	Essential Functions
Critical Infrastructure	Basic installations and facilities on which the continuance and growth of an organization or business depend, such as power plants, transportation systems, communications systems, water supply; etc. Also, critical infrastructure includes those systems and assets so vital to the nation that their incapacity or destruction would have a debilitating impact on national security, national economic security, and/or national public health or safety.	Critical Infrastructure Plan
Critical Infrastructure Protection (CIP)	Risk management actions intended to prevent a threat from attempting to, or succeeding at, destroying or incapacitating critical infrastructures. (FPC 65, PDD 63)  See Critical Infrastructure
Cyber Incident Response Plan	The Cyber Incident Response Plan establishes procedures to address cyber attacks against an organization’s IT system(s). These procedures are designed to enable security personnel to identify, mitigate, and recover from malicious computer incidents, such as unauthorized access to a system or data, denial of service, or unauthorized changes to system hardware, software, or data (e.g., malicious logic, such as a virus, worm, or Trojan horse). This plan may be included among the appendices of the BCP.
Damage Assessment	Process of assessing the amount of damage immediately following a crisis or disaster; evaluation on damages to equipment, hardware, vital records, office facilities, etc., and examination of what can be salvaged or restored and/or what must be replaced.
Data Mirroring	The act of copying data from one location to a storage device in real time. Because the data is copied in real time, the information stored from the original location is always an exact copy of the data from the production device. Data mirroring is useful in the speedy recovery of critical data after a disaster. Data mirroring can be implemented locally or offsite at a completely different location.
Data Transfer	See: Electronic Vaulting
Decision Support Portal (DSP)	The DSP is a comprehensive emergency management support tool.  Capabilities include: tailored desktops, document repository, calendar, geographical information system, situation report capability, iJet advisory and travel intelligence integration, integrated emergency broadcasting using SendWordNow, via a third-party vendor.	Decision Support System
Decision Support System (DSS)	Management system tool providing situation and awareness updates and status of threats, incidents, and events, reporting enterprise-wide. The Decision Support Portal (DSP), developed by Booz Allen Hamilton, has been implemented and tailored for use at various agencies.	Situation Awareness
Delegation of Authority	Predetermination of authorities to implement policy and key decisions to ensure rapid response to an emergency requiring COOP plan implementation (FPC 65).
Deployment	Mobilization, movement, or relocation of essential personnel and transfer of operations to an alternate site in order to manage the resumption of critical business functions and processes.
Deputy Incident Commander	As a member of the Incident Command Team, the Deputy Incident Commander, under the direction of the Incident Commander, organizes and directs the Emergency Operations Center (EOC); assumes interim command and responsibility of the Incident Commander when the Incident Commander is not available; verifies execution of the Incident Commander's directives; ensures that the personnel in charge of functional units detail the activities of their section in reports as necessary; reviews situation reports for completeness.
Devolution	The capability to transfer authority and responsibility for essential functions from an agency’s primary operating staff and facilities to other employees and facilities, and to sustain that operational capacity for an extended period.
Disaster	Any natural catastrophe (e.g., hurricane, tornado, earthquake, etc.) regardless of cause; any fire, flood, or explosion, causing extensive damage or loss; the inability of an organization to provide critical business functions for a significant period of time, typically necessitating deployment from primary to alternate location.	Crisis, Disruption, Emergency
Disaster Recovery Plan (DRP)	A plan that applies to major, usually catastrophic, events that deny access to the normal facility for an extended period. Frequently, DRP refers to an IT-focused plan designed to restore operability of the target system, application, or computer facility at an alternate site after an emergency. The DRP scope may overlap that of an IT contingency plan; however, the DRP is narrower in scope and does not address minor disruptions that do not require relocation.	Information Technology (IT) Disaster Recovery Plan
Disaster Recovery Team	See: Business Resumption Team	Business Recovery Team
Disruption	An unplanned event that causes the general system or major application to be inoperable for an unacceptable length of time (e.g., minor or extended power outage, extended unavailable network, or equipment or facility damage or destruction).	Crisis, Emergency, Event
Distributed System	An interconnected set of multiple autonomous processing elements, configured to exchange and process data to complete a single business function. To the user, a distributed system appears to be a single source. Distributed systems use the client-server relationship model to make the application more accessible to users in different locations.	Server
Distributive Adaptive Capacity	Distributing the ability to adapt to any crisis throughout an enterprise, i.e., creating hubs, networks, and nodes throughout an organization to enable all divisions of an agency to maximize its ability to respond effectively to a crisis.
Drill	See: Exercise
Electronic Vaulting	Electronically forwarding backup data to an offsite server or storage facility. Vaulting eliminates the need for shipment and significantly shortens the time required to move the data offsite.	Vital Records, Data Transfer
Emergency	A sudden, unexpected event or crisis requiring immediate action due to potential threat to human capital, the environment, or property.	Crisis, Event, Disaster
Emergency Management	Activities associated with the development, coordination, and direction of all emergency-related planning, preparedness, readiness assurance, response, and recovery measures designed to protect people, assets, and programs and to ensure the continuity of essential functions and facilities in the event of an emergency or other national security-related contingency	Contingency Planning
Emergency Management Center (EMC)	A site managed by a team of trained personnel that, when activated during an event, will be operational in exercising command and control activities during an event.	Warm Site
Emergency Operations Center (EOC)	A site from which response teams/officials (municipal, county, state and federal) exercise command and control in an emergency or disaster.
Emergency Preparedness	The discipline and tools to facilitate an organization’s readiness to respond to an emergency in a coordinated, timely, and effective manner.	Emergency Response
Enterprise Management	The systemic understanding and management of business operations within the context of the organization’s culture, beliefs, mission, objectives and organizational structure.  Enterprise-wide programs and structures, including Business Crisis and Continuity Management, should be aligned and integrated with overall Enterprise Management.	Business Crisis and Continuity Management
Environmental Sensing	Continual monitoring of the relevant internal and external business environment to detect, communicate and initiate appropriate actions to prevent, prepare for, respond to, recover, resume, restore and transition from a potential or actual crisis event.
Enterprise Resilience	A state of balance between efficiency and effectiveness.  Resilience is in the people, processes, technology, and infrastructure supporting enterprise-wide mission-critical business processes.	Mission Assurance
Emergency Response	Immediate reaction to an incident or emergency to assess the damage or impact and to ascertain the level of containment and control activity required. In addition to addressing matters of life safety and evacuation, “response” also addresses the policies, procedures, and actions to be implemented in the event of an emergency. Also, the step or stage that immediately follows a disaster event where actions begin as a result of the event having occurred.	Emergency Preparedness
Essential Functions	FPC 65 defines essential functions as those that enable the Federal government to provide vital services, exercise civil authority, maintain the safety and well being of the general populace, and sustain the industrial/economic base in an emergency.
Evacuation Plan	See: Occupational Emergency Plan
Exercise	An activity to improve team awareness and performance ability and instill collaborative decision-making; a testing of organization’s plans and procedures.	Drill, Tabletop Exercise, Simulation, Mock Disaster
Fault Tolerance	The ability of a system to respond gracefully to an unexpected hardware or software failure. There are many levels of fault tolerance, the lowest being the ability to continue operation in the event of a power failure. Many fault-tolerant computer systems mirror all operations -- that is, every operation is performed on two or more duplicate systems, so if one fails the other can take over.	Data Mirroring
File Shadowing	A technique that maintains a replica of the database or file system by continuously capturing changes to a log and applying the changes in the log to the replicating server.	Backups, Electronic Vaulting
General Support System	An interconnected information resource under the same direct management control that shares common functionality. It usually includes hardware, software, information, data, applications, communications, facilities, and people and provides support for a variety of users and/or applications. Individual applications support different mission-related functions. Users may be from the same or different organizations.
Global Leadership Business Assurance Team (GLBAT)	The GLBAT provides strategic guidance and authority for firm crisis management activities to manage serious events and disruptions affecting single and/or multiple Booz Allen offices.  The GLBAT supports the CFBAT, regional teams, and local crisis management teams. The GLBAT is chaired by the General Counsel and includes the firm’s Treasurer, Chief Administrative Officer, and Chief Human Resources Officer.
Hazard or Threat Identification	The process of identifying situations or conditions with the potential to cause injury to people, damage to property, or damage to the environment.	Risk Identification, Risk and Threat and Vulnerability Analysis
High-Risk/High Vulnerability Area	Area in which there exists a potential high risk of impact to a densely populated area, and has high impact and risk to critical infrastructure particularly (e.g., susceptible to high-intensity earthquakes, floods, tsunamis, or other disasters).
Homeland Security Advisory System (HSAS)	A threat condition/advisory system that provides a comprehensive and effective means to disseminate information and warnings regarding the potential risk of terrorist acts to Federal, State, and local authorities and to the American people.
Hot Site	A fully operational off-site data processing facility equipped with hardware and system software to be used in the event of a disaster.  An internal hot site is a fully equipped processing site owned and operated by the organization.  A warm site is a partially equipped alternate site.
Human Resources (HR) Coordinator	As a member of the Incident Command Team, the HR Coordinator performs human resources and administrative functions in response to a crisis and provides resource support to the CMT before and during a crisis, including providing the manpower needed to respond to an incident.
Imaging	Imaging represents another contingency solution. A standard desktop computer image can be stored, and the corrupted computer can be reloaded. Imaging will install the applications and setting stored in the image; however, all data currently on the disk will be lost. Therefore, PC users should be encouraged to back up their data files. Because disk images can be large, dedicated storage, such as a server or server partition, may need to be allocated for the disk images alone.
Incident Command System (ICS)	The combination of facilities, equipment, personnel, procedures, and communications tools operating within a common organizational structure used to manage assigned resources to effectively accomplish stated objectives pertaining to an incident. The ICS forms the basis for an effective emergency management system for organizations of all sizes, all types of incidents and degrees of severity; provides an escalation framework for managing information technology, disaster recovery, and overall business resumption/continuity operations; develops a “tiered” system activating organizational layers when appropriate and utilized only as dictated by incident complexity; creates clear lines and rules of authority, communication and planning strategies to efficiently and effectively support a unified management team.b	Unified Command and Control
Incident Command Team	Personnel (e.g., financial, logistics, operational) at the local, regional, or national office office, who may, upon delegation of authority, activate a plan.
Incident Commander	Leads the local Incident Command Team and reports up to senior management during a crisis; the IC has authority to activate a plan. See Incident Command Team	Deputy Incident Commander
Incident Management Plan (IMP)	A plan of procedures that will enable the control and coordination of all activities needed to manage an incident throughout the incident life cycle under the ICS system.	Crisis Management Plan, Incident Response Plan
Incident Response	The act of responding to a disaster or other significant event that could significantly impact an organization, its people, or its ability to function productively.  An incident response may include evacuation of a facility, initiating a disaster recovery plan, performing damage assessment, and any other measures necessary to bring an organization to a more stable status.
Incident Response Plan	The documentation of a predetermined set of instructions or procedures to detect, respond to, and limit consequences of a malicious cyber attacks against an organization’s IT systems.
Indications and Warning	See: Threat; Single Points of Failure
Information Assurance	Integrated information technology security program that includes capabilities such as managing data backup, classified document control and vital records.
Information Technology (IT) System	Any major application or general support system identified by boundaries around a set of processes, communications, storage and related architecture.
Information Technology (IT) Contingency Planning	Refers to the dynamic development of a coordinated recovery strategy for IT systems (major application or general support system), operations, and data after a disruption.  Because an IT contingency plan should be developed for each major application and general support system, multiple contingency plans may be maintained within the organization’s BCP.	IT Disaster Recovery Plan, Disaster Recovery Plan, Business Impact Analysis, Contingency Plan
Integrated Risk Management	An approach that addresses risks – information, financial, personnel and operations – in an integrated, uniform, and systematic manner across the enterprise. Risk management provides a whole view of activities across an agency, moving beyond stovepiped security.
Integrated Security	An integrated approach combining the areas of Physical Security, Cyber and IT Security, and Personnel Security.
Integrated Test	A test conducted on multiple components of a plan, typically under simulated operating conditions.
Interdependencies	Identification of those critical functions shared by agencies – both internal and external.  Each agency must provide a reciprocal arrangement to ensure that these critical functions can be continued, and that the interdependency must be accounted for in both COOP and BC plans.	Risks
Interim Site	A temporary location used to continue performing business functions after vacating a recovery site and before the original or new home site can be occupied.	Staging Area
Liaison/Information/ Communications Coordinator	A member of Incident Command Team, the Liaison / Information / Communications function is a primary component of providing vital information to the ICS for appropriate decision support and situational awareness, as well as synthesizing data feeds to external points of contact.
Lifecycle	Duration of an event from impact to resumption of normalized business operations.
Local Area Network (LAN)	Short distance network used to connect terminals, computers, and peripherals under some standard form, usually within one building or a group of buildings. A LAN does not use public carriers to link its components, although it may have a "gateway" outside the LAN that uses a public carrier. A LAN is owned by a single organization; it can be as small as two PCs attached to a single hub, or it may support hundreds of users and multiple servers.
Load Balancing	Distributing processing and communications activity evenly across a computer network so that no single device is overwhelmed. Load balancing is especially important for networks where it's difficult to predict the number of requests that will be issued to a server. Busy Web sites typically employ two or more Web servers in a load-balancing scheme. If one server starts to get swamped, requests are forwarded to another server with more capacity. Load balancing can also refer to the communications channels themselves.
Local Crisis Management Team (CMT)	The local CMT within facilities is responsible for preparing for and managing events directly affecting the local office and staff; and may initiate lead with response to events with associated offices and clients.
Loss	Unrecoverable business resources that are redirected or removed due to a disaster. Such losses may include loss of life, revenue, market share, competitive stature, public image, facilities, or operational capability.
Maximum Allowable Outage	See: Recovery Time Objective
Memorandum of Understanding	See: Consortium Agreement
Mirror Site	Fully redundant facilities with full, real-time information mirroring. Mirrored sites are identical to the primary site in all technical respects. These sites provide the highest degree of availability because the data is processed and stored at the primary and alternate site simultaneously. These sites typically are designed, built, operated, and maintained by the organization.	Hot sites
Mission Assurance	The approach of implementing a system consisting of plans, procedures, and capabilities, which when integrated can enable an agency or organization (Federal) to ensure continuation of essential functions, thus eliminating stovepiped processes.	Business Assurance
Mission Assurance Governance Committee (MAG-C)	Working group represented by senior executive members of Federal Government agencies whose mission it is to determine and identify best practices to overcome the myriad challenges faced by their respective organizations, to pool resources, and to identify single points of failure so that in event of a disaster there is a common answer to minimize impact (derived from the firm-hosted Mission Assurance Summit Conference)
Mission-Critical Application	System applications essential to the organization’s ability to perform necessary business functions.  A loss of mission-critical applications would have a negative impact on the business, as well as legal or regulatory impacts.
Mobile Site	A self-contained, transportable shell custom-fitted with the specific IT equipment and telecommunications necessary to provide full recovery capabilities upon notice of a significant disruption.
Mock Disaster	One method of exercising teams in which participants are challenged to determine the actions they would take in the event of a specific disaster scenario. Mock disasters usually involve all, or most, of the applicable teams. Under the guidance of exercise coordinators, the teams walk through the actions they would take per their plans, or simulate performance of these actions. Teams may be at a single exercise location, or at multiple locations, with communication between teams simulating actual ‘disaster mode’ communications. A mock disaster will typically operate on a compressed timeframe representing many hours, or even days.	Simulation Exercise, Tabletop
Network Outage	An interruption in system availability resulting from a communication failure affecting a network of computer terminals, processors, and/or workstations.
Normalization	Operational activities designed to return to business as usual either at the original or new site.
Notification	See: Activation Phase, Alert
Occupational Emergency Plan (OEP)	A plan of action to prevent the loss of life and minimize injury and property damage; provides procedures on how to respond to the protection of employees, i.e., evacuation or shelter in place; defines roles, responsibilities and actions during a crisis. An OEP provides directions for facility occupants to follow in the event of an emergency situation that threatens the health and safety of personnel, the environment, or property.	Evacuation Plan, Shelter in Place
Offsite Storage Facility	Alternate facility, other than the main facility, where duplicated vital records and documentation are kept.
Operational Exercise	A test or exercise conducted on one or more components of a plan under actual operating conditions.	Drill, Simulation Exercise, Tabletop
Operational Resilience	See: Mission Assurance, Enterprise Resilience
Order of Succession	The order of succession identifies personnel responsible to assume authority for executing the contingency plan in the event the designated person is unavailable or unable to do so. The Order of Succession includes provisions for implementation and communication process to staff and others.
Physical Security Plan	Plan that identifies vulnerabilities to facilities, personnel, operations, and resources and recommends mitigation actions.
Project Team	Groups of people representing key organizational areas that work together and follow documented responsibilities for the design, development, and implementation of a business continuity plan or suite of BCP plans.	Working Groups
Project Management	Planning, organizing, and managing tasks and resources to accomplish a defined objective, usually under time and cost constraints.
Redundant Array of Independent Disks (RAID)	A category of disk drives that employ two or more drives in combination for fault tolerance and performance. RAID disk drives are used frequently on servers but are not generally necessary for personal computers.	Fault Tolerance
Reciprocal Agreement	Agreement between two organizations with basically the same equipment that allows one organization to process data for the other in case of disaster.
Reconstitution Phase	In the Reconstitution Phase, recovery activities are terminated and normal operations are transferred back to the organization’s facility. If the original facility is unrecoverable, the activities in this phase can also be applied to preparing a new facility to support system processing requirements.	Restoration
Recovery Point Objective (RPO)	The period of time within which systems, applications, or functions must be recovered after an outage (e.g., one business day). RPOs are often used as the basis for the development of recovery strategies, and as a determinant as to whether to implement recovery strategies during a disaster situation.	Maximum Allowable Downtime
Recovery Site	See: Alternate Disaster Recovery Site, Cold Site
Recovery Strategy	An approach by an organization that will ensure its recovery and continuity in the face of a disaster or other major outage.  Plans and methodologies are determined by the organization’s strategy.  There may be more than one methodology or solution for an organization’s strategy.
Recovery Time Objective (RTO)	The maximum acceptable length of time that can elapse before the lack of a business function severely impacts the business entity. The RTO is comprised of two components: the time before a disaster is declared, and the time to perform tasks (documented in the disaster recovery plan) to the point of business resumption.	Maximum Allowable Outage
Replication	A common backup method for portable computers. Handheld computers or laptops may be connected to a PC and replicate the desired data from the portable system to the desktop computer.  With disk replication, recovery windows are minimized because data is written to two different disks to ensure that two valid copies of the data are always available.
Restoration	Process of planning for and/or implementing procedures for the repair or relocation of the primary site and its contents, and for the restoration of data and normal operations at the primary site. Salvage and restoration is the process of reclaiming or refurbishing computer hardware, vital records, office facilities, etc. following a disaster.	Salvage and Restoration, Reconstitution, Business Resumption
Risk	The potential for exposure to loss.  Risks are man-made, political or natural. The potential is usually measured by its probability in years.	Threat, Vulnerability
Risk Assessment	Process of identifying the risks to an organization, assessing the critical functions necessary for an organization to continue business operations, defining the controls in place to reduce organization exposure, and evaluating the cost for such controls. Risk assessment often involves an evaluation of the probabilities of a particular event.
Risk/ Threat/ Vulnerability Analysis and Identification	See: Hazard or Threat Identification
Risk Management	The ongoing process of assessing the risk to mission/business as part of the approach used to determine adequate security for a system by analyzing the threats and vulnerabilities and selecting appropriate, cost-effective controls to achieve and maintain an acceptable level of risk.	Risk, Risk Assessment, Risk Mitigation
Risk Mitigation	Implementation of measures to deter specific threats to the continuity of business operations, and/or respond to any occurrence of such threats in a timely and appropriate manner.
Salvage and Restoration	See: Restoration
Security/Safety/Facilities Coordinator	As a member of the Incident Command Team, the Security/Safety/Facilities Coordinator will anticipate the need for accumulation of equipment and supplies to facilitate an immediate response to a request for logistical support.  Additionally, this Coordinator is responsible for maintaining a list of private vendors that can provide logistical support, which includes the local alternate operations site.
Server	A computer or device on a network that manages network resources. For example, a file server is a computer and storage device dedicated to storing files. Any user on the network can store files on the server. A print server is a computer that manages one or more printers, and a network server is a computer that manages network traffic. A database server is a computer system that processes database queries.	Distributed System
Shelter in Place	Emergency procedures to stay in place when hazardous materials may have been released into the atmosphere.  Shelter-in-Place is an emergency response procedure aimed to keep employees safe while remaining indoors.  Employees will be asked to remain in a selected interior room with no or few windows and take refuge.  Instructions are provided for durations of a few hours, not days or weeks.
Simulation Exercise	A method of exercising teams in which participants perform some or all of their responsibilities and activities in the event of plan activation. A simulation exercise may involve one or more teams and are performed under conditions that at least partially simulate “disaster mode.”  The exercise may be performed at the designated alternate location, typically using only a partial recovery configuration.
Single Points of Failure (SPOF)	Areas outlined in a BCP identifying critical business processes and functions that would, upon impact of a disaster, severely impair or destruct the ability of an agency to resume operations. Interviews of stakeholders and examination of priorities of critical business functions would need to be conducted to determine SPOF analysis that map to critical business functions. See: Business Impact Analysis
Situation Awareness	Monitoring of all potential crisis-inducing emergencies; notification of an alert or advisory to executive leadership and senior management; collection and dissemination of all event information, physical and cyber, to national and local sites.	Decision Support System
Situation Report (SITREP)	A written, detailed account of an event or incident, which is distributed to those in the organization having a need to know through the Decision Support Portal. See Decision Support System
Staging Area	A temporary location for relocation until decision is made to deploy to alternate site or return to original site; may be used to continue performing business functions. A staging area is planned and scheduled in advance to minimize disruption.	Interim Site
Standard Operating Procedures (SOP)	Step-by-step set of instructions to an operator to carry out a process or function, or task broken down into its most basic component parts.
Structured Walk-Through Exercise	Simulated method used to exercise or test a completed plan. Team members meet to verbally walk through each step of the plan to confirm the plan effectiveness and identify gaps, bottlenecks, or other plan weaknesses. Promotes quicker response time and faster decision making skills.
Summit Series	Sponsored by Booz Allen Hamilton, the objective of the series is to facilitate the development of a professional community of mission assurance practitioners. Summit I and II were conducted in 2004.
Systems Development Life Cycle (SDLC)	SDLC is the process of developing information systems through initiation, development and acquisition, implementation, and operation and maintenance. SDLC is a systems approach to problem solving and is made up of several phases, each comprised of multiple steps.  Although contingency planning is associated with activities occurring in the operation/maintenance phase, contingency measures should be identified and integrated into ALL phases of the SDLC. Incorporating contingency planning into the SDLC reduces overall contingency planning costs, enhances contingency capabilities, and reduces impacts to system operations when the contingency plan is implemented.
Tabletop Exercise	A tabletop exercise is a specialized form of training that typically has the following characteristics: Group Training - Train a group of persons who will need to work together in an actual emergency or crisis; Scenario Based - The training seeks to simulate realistically the types of events and problems that are most likely to occur in an actual emergency or crisis; Role Based - Each participant in the training exercise carries out or performs the responsibilities of his or her actual job, office or position, or assumes the role of another person; and Facilitated - The training is guided by one or more facilitators or moderators, who lead the training, manage the scenario, and provide real-time and post-training feed-back to the participants.	Exercise, Drill
Telecommunications	Data transmitted by electrical, optical, or acoustical means between separate processing facilities.
Test Plan	A document designed to periodically exercise specific action tasks and procedures to ensure viability in a real disaster or severe outage situation.
Threat	Physical or cyber event that causes a risk to become a loss. Environmental threats include both natural disasters and aspects of adjacent and supporting infrastructure, including power failures. Adversarial threats include criminal activity (e.g., disgruntled and violent employees) and terrorism, focusing on aspects of attack by internal and external criminal adversaries, and domestic and international adversaries.	Indications and Warning, Single Points of Failure, Risk
Uninterruptible Power Supply (UPS)	A backup supply that provides continuous power to critical equipment in the event that commercial power is lost.
Vital Records	Electronic and hardcopy documents, references, and records that are required in support of essential functions and must be preserved and available for retrieval for resumption of business operations during a COOP situation.	Offsite Storage Facility, Essential Functions
Vital Records Management	The management of vital records through offsite storage facilities and establishing a backup recovery system.
Vulnerability	See: Threat, Risk
Warm Site	Partially equipped office space that contain some or all of the system hardware, software, telecommunications, and power sources. The warm site is maintained in an operational status ready to receive the relocated system. The site may need to be prepared before receiving the system and recovery personnel. In many cases, a warm site may serve as a normal operational facility for another system or function, and in the event of contingency plan activation, the normal activities are displaced temporarily to accommodate the disrupted system.	Emergency Management Center, Alternate Site
Wide Area Network (WAN)	Network linking metropolitan, campus, or local area networks across greater distances; usually accomplished using common carrier lines.
Working Groups	See: Project Teams
Workaround Procedures	Interim procedures or contingencies that may be used by a business unit to enable it to continue to perform its critical functions during temporary unavailability of specific IT application systems, electronic or hard copy data, voice or data communication systems, specialized equipment, office facilities, personnel, or external services.	Contingency Planning