Which NIST SP is the contingency planning guide for information technology systems?

• A. NIST SP 800-34
• B. NIST SP 800-18
• C. NIST SP 800-37
• D. NIST SP 800-60

Answer: (A)

Contingency planning for information technology systems focuses on ensuring continuity of operations and rapid recovery after disruptions. NIST SP 800-34, Contingency Planning Guide for Information Technology Systems, provides the full lifecycle for IT contingency planning: conducting a business impact analysis to identify critical assets and recovery priorities, developing and implementing recovery strategies, creating and testing contingency plans, training personnel, conducting exercises, and maintaining the plans over time. This document is the standard reference for preparing federal information systems to withstand and recover from outages.

Other NIST guides cover related but different areas: one guides the development of security plans for federal systems, another outlines applying the risk management framework to information systems, and another maps information types to security categories. None focuses on the comprehensive contingency planning lifecycle as SP 800-34 does.