Home / IT Policies / IS-12: IT Recovery Policy

Introduction to IS-12: UC's IT Recovery Policy

What Is IS-12?

IS-12 is UC's IT recovery policy. It establishes requirements and role-based responsibilities for creating an IT recovery plan for UC Santa Cruz Institutional Information and IT resources in the event of an emergency.

IS-12 Requirements

According to IS-12, IT recovery planning requires:

  • Alignment with UC Santa Cruz's Business Continuity Plan (BCP)
  • Oversight by a Cyber-risk Responsible Executive (CRE)
  • Adoption of a risk-based approach
  • Maintaining an inventory of Institutional Information and IT resources
  • Recovery Level Classification of Institutional Information and IT resources

Role-Based Responsibilities

IS-12 specifies the recovery-planning responsibilities of the following roles:

The Cyber-risk Responsible Executive (CRE) is responsible for approving the IT recovery plan. CREs appoint an IT Recovery Lead for the university. 

Unit Heads are responsible for Unit IT Recovery Planning, appointing Unit IT Recovery Leads, and ensuring the creation of Unit IT Recovery Teams. Unit Heads appoint Unit IT Recovery Leads (UITRL).

Unit IT Recovery Leads (UITRL) ensure that IT Recovery planning and testing take place. They communicate requirements to key parties and coordinate the execution of the plan in the event of an emergency.

Unit Information Security Leads (UISLs) ensure that the planning and execution of IT Recovery includes meeting security requirements. 

Compliance

Compliance with IS-12 can be achieved by full compliance, in which CREs and Unit Heads meet all the requirements of this policy, or iterative compliance, a multi-phased model of compliance that must:

  • Assess the initial state of IT recovery readiness 
  • Review risks and compliances 
  • Plan and implement improvements 
  • Assess progress (annually, at minimum)

Exceptions

While exceptions to an IT Recovery policy or standard may weaken UC Santa Cruz's ability to withstand a disaster, they are occasionally necessary and permitted. Units must follow a risk-based approach when requesting an exception to the controls specified in parts IV, V, and VI of the IS-12 policy. Exception requests must follow the UC Santa Cruz-approved exception process. 

Additional Resources