25.8 VITA recommendations for a successful IT contract

25.8.8 Disaster recovery provision in IT contracts

IT contracts where the supplier has network or operational responsibilities or processes or stores Commonwealth data should include a disaster recovery plan (back-ups, hot-site, cold site) and detail supplier's responsibility to provide full or partial restoration, to participate in disaster simulation exercises and the frequency of such responsibilities, to securely hold copies of all data for quick and easy access. The contract should also provide a timeframe for returning the agency to normal service levels following the disaster. Hosting and software as a service contracts must insist that all disaster recovery facilities are in the continental U.S.