1. (a) Business Continuity Planning covers all business functions of an institution of higher education and it is a business management responsibility. Institutions of higher education should maintain a written Business Continuity Plan so that the effects of a disaster will be minimized, and the institution of higher education will be able to either maintain or quickly resume mission-critical functions. The institution of higher education head or his or her designated representative(s) shall approve the Plan. The Plan shall be distributed to key personnel and a copy stored offsite. Elements of the Plan for information resources shall include:

   1. (1) Business Impact Analysis to systematically assess the potential impacts of a loss of business functionality due to an interruption of computing and/or infrastructure support services resulting from various events or incidents. The analysis shall address maximum tolerable downtime for time-critical support services and resources including, but not limited to:

      1. (A) Personnel;
      2. (B) Facilities;
      3. (C) Technology platforms (all computer systems);
      4. (D) Software;
      5. (E) Information resources security utilities;
      6. (F) Data networks and equipment;
      7. (G) Voice networks and equipment;
      8. (H) Vital electronic records and/or data.
   2. (2) Security Risk Assessment to weigh the cost of implementing preventative measures against the risk of loss from not taking action.
   3. (3) Recovery Strategy to appraise recovery alternatives and alternative cost-estimates which shall be presented to management.
   4. (4) Implementation, testing, and maintenance management program addressing the initial and ongoing testing and maintenance activities of the Plan.

   5. (5) Disaster Recovery Plan--Each institution of higher education shall maintain a written disaster recovery plan for information resources. Information learned from tests conducted since the plan was last updated will be used in updating the disaster recovery plan. The disaster recovery plan will:

      1. (A) Contain measures which address the impact and magnitude of loss or harm that will result from an interruption;
      2. (B) Identify recovery resources and a source for each;
      3. (C) Contain step-by-step instructions for implementing the Plan;
      4. (D) Be maintained to ensure currency; and
      5. (E) Be tested either formally or informally at least annually.
2. (b) Mission critical data shall be backed up on a scheduled basis and stored off site in a secure, environmentally safe, locked facility accessible only to authorized institution of higher education representatives.

Source Note:The provisions of this §202.74 adopted to be effective November 28, 2004, 29 TexReg 10703.