STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 6 Release: 4 Benchmark Date: 01 Oct 2025:

A contingency plan must exist in accordance with DOD policy based on the application's availability requirements.

DISA Rule

SV-222636r1051323_rule

Vulnerability Number

V-222636

Group Title

SRG-APP-000516

Rule Version

APSC-DV-003050

Severity

CAT II

CCI(s)

• CCI-000445 - Develop a contingency plan for the system that identifies associated contingency requirements.

Weight

10

Fix Recommendation

Create and maintain a contingency plan that identifies essential mission and business functions and associated contingency requirements.

Check Contents

Review contingency plans.

For high availability applications, verify the contingency plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity.

For moderate availability applications, verify the contingency plan exists and provides for the resumption of mission or business essential functions within 12 hours activation or as defined in the contingency plan.

For low availability applications, verify the contingency plan exists and provides for the partial resumption of mission or business essential functions within 5 to 30 days of activation as defined in the contingency plan.

If the contingency plan does not exist or does not meet the severity level requirements, this is a finding.

Vulnerability Number

V-222636

Documentable

False

Rule Version

APSC-DV-003050

Severity Override Guidance

Review contingency plans.

For high availability applications, verify the contingency plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity.

For moderate availability applications, verify the contingency plan exists and provides for the resumption of mission or business essential functions within 12 hours activation or as defined in the contingency plan.

For low availability applications, verify the contingency plan exists and provides for the partial resumption of mission or business essential functions within 5 to 30 days of activation as defined in the contingency plan.

If the contingency plan does not exist or does not meet the severity level requirements, this is a finding.

Check Content Reference

M

Target Key

4093