Common use of Disaster Recovery Testing Requirements Clause in Contracts

Disaster Recovery Testing Requirements. Testing shall be used to perform a variety of functions and requirements including, but not limited, to the following: o Determining the feasibility of the recovery process o Verifying the compatibility of backup facilities o Ensuring the adequacy of procedures relating to the various teams working in the recovery process o Identifying deficiencies in existing procedures o Training of various team managers and members o Demonstrating the ability of the organization to recover o Providing a mechanism for maintaining and updating the recovery plan The Vendor shall provide adequate annual test time and technical assistance as required by the Eligible User. Vendors shall assist agency staff in assuring that the agency‘s backup operations can be implemented in the vendor‘s facility at the time of a disaster. Vendors shall provide a variety of test periods and lengths of test time to accommodate multiple testing needs. (e.g. Some users may require one test a year and need 48 hours to conduct the test while others may require 120 hours to complete their testing process. Other users may require multiple test times and choose to test mainframe operations one time and open source during another time.) o Service Provider may provide additional optional testing periods such as:  Semi-annual  Quarterly  Monthly The scope of the Eligible User‘s test(s) will determine the amount of lead time required for performing those tests. Vendors shall make every effort to schedule tests based upon the amount of lead time required for various testing scenarios. Vendors shall provide a scale of hours for test periods. All Tests shall be subject to immediate cancellation or termination, and shall be rescheduled as soon as possible, if and when any other Eligible User declares a disaster and requests use of the Recovery Services being tested. The Eligible User may use certain Recovery Services to test its disaster recovery capability (‗Test‖) for the number of Test Periods stated in the applicable Schedule. Service Provider shall provide technical assistance to assist Eligible User staff in assuring that the Eligible User‘s backup operations can be implemented in the vendor's Cold-site facility at the time of a disaster. Additional test periods may be offered and shall be subject to availability. Eligible Users that have state-wide field offices will have the ability to add individual Recovery Services and Network Services Agreements, governed under the master Eligible User‘s Agreement. Respondents shall also include the following information:  The number of desktops and seats available to the Eligible User‘s Disaster Recovery team during testing.  The types of tests proposed may include any of the following: o Simulation Testing  A disaster scenario should take into consideration the purpose of the test, objectives, type of test, timing, scheduling, duration, test participants, assignments, constraints, assumptions, and test steps. Testing can also include the notification procedures, temporary operating procedures, and back-up and recovery operations.  During the simulation, the following elements may be thoroughly tested:  Hardware  Software  Personnel  Data and voice communications  Procedures  Supplies and Forms  Documentation  Transportation  Utilities (power, air conditions, heating, ventilation)  Alternative site processing o Parallel Testing  This test can be performed in conjunction with the checklist test or simulation test. Historical transactions, such as yesterday‘s transactions, are processed against the proceeding day‘s backup files at the contingency processing site or hot-site. All reports produced at the alternate site for the current business date should agree with those reports produced at the existing processing site. o Full Interruption Testing  This test will activate the total disaster recovery plan. The test must provide the following:  Adequate scheduled time for testing  Testing shall not be scheduled at any critical point in the Eligible User‘s normal processing cycle (i.e. year-end)  Events planned shall at a minimum identify the type of disaster, the extent of the damage, recovery capability, staffing and equipment availability, backup resource availability and time/duration of the test.  The test plan shall identify the persons responsible and the time they need to perform each activity.  Testing may be conducted in parts in order to identify the workability of each part before attempting a full test.  Testing may be conducted before or after normal business hours, or on weekends to minimize disruptions. o Combination Testing Combination testing allows Eligible Users to conduct different test types at the same time. Respondents may provide optional combination testing alternatives to meet the varying needs of the Eligible Users. o Remote Testing Remote Testing allows Eligible Users to conduct tests from their primary facility or from another location without having to travel to the actual test site. Respondents may provide optional remote testing alternatives to meet the varying needs of the Eligible Users. o Other Test types Respondents may propose additional testing options not already discussed.

Disaster Recovery Testing Requirements. Testing shall be used to perform a variety of functions and requirements including, but not limited, to the following: o Determining the feasibility of the recovery process o Verifying the compatibility of backup facilities o Ensuring the adequacy of procedures relating to the various teams working in the recovery process o Identifying deficiencies in existing procedures o Training of various team managers and members o Demonstrating the ability of the organization to recover o Providing a mechanism for maintaining and updating the recovery plan The Vendor shall provide adequate annual test time and technical assistance as required by the Eligible User. Vendors shall assist agency staff in assuring that the agency‘s backup operations can be implemented in the vendor‘s facility at the time of a disaster. Vendors shall provide a variety of test periods and lengths of test time to accommodate multiple testing needs. (e.g. Some users may require one test a year and need 48 hours to conduct the test while others may require 120 hours to complete their testing process. Other users may require multiple test times and choose to test mainframe operations one time and open source during another time.) o Service Provider may provide additional optional testing periods such as:  ▪ Semi-annual  ▪ Quarterly  ▪ Monthly The scope of the Eligible User‘s test(s) will determine the amount of lead time required for performing those tests. Vendors shall make every effort to schedule tests based upon the amount of lead time required for various testing scenarios. Vendors shall provide a scale of hours for test periods. All Tests shall be subject to immediate cancellation or termination, and shall be rescheduled as soon as possible, if and when any other Eligible User declares a disaster and requests use of the Recovery Services being tested. The Eligible User may use certain Recovery Services to test its disaster recovery capability (‗Test‖) for the number of Test Periods stated in the applicable Schedule. Service Provider shall provide technical assistance to assist Eligible User staff in assuring that the Eligible User‘s backup operations can be implemented in the vendor's Cold-site facility at the time of a disaster. Additional test periods may be offered and shall be subject to availability. Eligible Users that have state-wide field offices will have the ability to add individual Recovery Services and Network Services Agreements, governed under the master Eligible User‘s Agreement. Respondents shall also include the following information:  ▪ The number of desktops and seats available to the Eligible User‘s Disaster Recovery team during testing.  ▪ The types of tests proposed may include any of the following: o Simulation Testing  ▪ A disaster scenario should take into consideration the purpose of the test, objectives, type of test, timing, scheduling, duration, test participants, assignments, constraints, assumptions, and test steps. Testing can also include the notification procedures, temporary operating procedures, and back-up and recovery operations.  ▪ During the simulation, the following elements may be thoroughly tested:  ▪ Hardware  ▪ Software  ▪ Personnel  ▪ Data and voice communications  ▪ Procedures  ▪ Supplies and Forms  ▪ Documentation  ▪ Transportation  ▪ Utilities (power, air conditions, heating, ventilation)  ▪ Alternative site processing o Parallel Testing  ▪ This test can be performed in conjunction with the checklist test or simulation test. Historical transactions, such as yesterday‘s transactions, are processed against the proceeding day‘s backup files at the contingency processing site or hot-site. All reports produced at the alternate site for the current business date should agree with those reports produced at the existing processing site. o Full Interruption Testing  ▪ This test will activate the total disaster recovery plan. The test must provide the following:  ▪ Adequate scheduled time for testing  ▪ Testing shall not be scheduled at any critical point in the Eligible User‘s normal processing cycle (i.e. year-end)  ▪ Events planned shall at a minimum identify the type of disaster, the extent of the damage, recovery capability, staffing and equipment availability, backup resource availability and time/duration of the test.  ▪ The test plan shall identify the persons responsible and the time they need to perform each activity.  ▪ Testing may be conducted in parts in order to identify the workability of each part before attempting a full test.  ▪ Testing may be conducted before or after normal business hours, or on weekends to minimize disruptions. o Combination Testing Combination testing allows Eligible Users to conduct different test types at the same time. Respondents may provide optional combination testing alternatives to meet the varying needs of the Eligible Users. o Remote Testing Remote Testing allows Eligible Users to conduct tests from their primary facility or from another location without having to travel to the actual test site. Respondents may provide optional remote testing alternatives to meet the varying needs of the Eligible Users. o Other Test types Respondents may propose additional testing options not already discussed.