SP 800-34 Rev. 1Final2010

Contingency Planning Guide for Federal Information Systems

At a glanceThe classic guide to writing and maintaining contingency and disaster recovery plans for information systems, including a business impact analysis to set recovery priorities. The templates in its appendices are a practical starting point for districts. Written for federal systems in 2010, it remains NIST's current contingency planning guide.

Reading level: Practitioner
Length: 149 pages · about 60 min for the key parts
Best for: Technology directors, IT staff and service partners, Business officials
CSF 2.0: Recover, Identify, Protect

Read it on NIST DOI 10.6028/NIST.SP.800-34r1 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The guide explains how contingency plans relate to continuity, incident response and emergency plans, then lays out a seven-step process and the structure of a plan (activation and notification, recovery, reconstitution). Appendices include plan and business impact analysis templates.

Seven steps: policy, business impact analysis, preventive controls, recovery strategies, the plan, testing and exercises, maintenance
Recovery time and data-loss objectives come from the business impact analysis

How it is organized

Background: types of continuity and contingency plans
The seven-step contingency planning process
Plan development: activation and notification, recovery, reconstitution
Technical considerations by system type
Appendices: plan templates, business impact analysis template, personnel considerations, related controls

What a school district should take from it

Decide recovery order and acceptable downtime for critical systems before an outage.
Plan for working without technology too: paper rosters, offline contact lists, manual meal counts.

How to use it in your district

Run a business impact analysis with department leaders using the appendix template.
Write a recovery plan for the top three systems, starting from the plan template.
Test a restore and a manual workaround each year and record the result as evidence.
Store a printed copy of the plan and key contacts off the network.

Common misconceptions

Backups are a contingency plan.: Backups are one part; the plan also covers who decides, recovery order, workarounds and communication.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

RC.RPIncident Recovery Plan Execution
ID.IMImprovement
PR.IRTechnology Infrastructure Resilience

Tools in the program portal

Tabletop exercisesRun a scenario and capture after-action improvements
Evidence LockerKeep the artifact that shows a practice is in place
School-year operations plannerSchedule recurring security work across the year
Cyber insurancePolicy conditions, questionnaire and Breach Day card

Related publications

IR 8286D (Update 1)Business impact analysis for cyber risk
SP 800-184Recovering from a cyber event
SP 1800-11Ransomware: recover

Citation and source

SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems. National Institute of Standards and Technology. 2010. https://doi.org/10.6028/NIST.SP.800-34r1.

Replaces: SP 800-34 Rev. 1 original release (May 2010), SP 800-34 (2002).

Topics: Recovery and continuity. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.