10
F. SECURITY AND PRIVACY STATEMENT
This section details the classification of the Continuity Plan. At a minimum, agencies
should classify their plan as “For Official Use Only,” as continuity plans and procedures
are sensitive, organization-specific documents. Further, if your continuity plan includes a
roster of continuity personnel that includes personal information, such as telephone
numbers, that information is protected under the Privacy Act of 1974. Organizations
should consult with their Office of Security, or similar office, to ensure their continuity
plans and procedures are properly classified and marked. This section should also contain
dissemination instructions, including to whom and via what means the agency will
disseminate the plan. Sample text for this section includes:
This document is [insert classification information here, e.g. For Official Use Only].
Portions of this Plan contain information that raises personal privacy or other concerns, and
those portions may be exempt from mandatory disclosure under the Freedom of
Information Act (see 5 United States Code §552, 41 Code of Federal Regulations Part 105-
60). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in
accordance with [insert security reference document] and is not to be released to the
public or other personnel who do not have a valid “need to know” without prior approval of
[insert title of approving authority].
Some of the information in this Plan, if made public, could endanger the lives and privacy
of employees. In addition, the disclosure of information in this plan could compromise the
security of essential equipment, services, and systems of [Organization Name] or
otherwise impair its ability to carry out essential functions. Distribution of the Continuity
plan in whole or in part is limited to those personnel who need to know the information in
order to successfully implement the plan.
[Organization Name, office name] will distribute copies of the Continuity Plan on a need
to know basis. [Insert procedures for distributing the plan to ERG members and all
personnel, e.g. via hard or electronic copy or posting on internal websites]. In addition,
copies of the plan will be distributed to other organizations as necessary to promote
information sharing and facilitate a coordinated interagency continuity effort. Further
distribution of the plan, in hardcopy or electronic form, is not allowed without approval
from [insert office or position title]. [Organization Name, office name] will distribute
updated versions of the Continuity Plan annually or as critical changes occur.
V. Concept of Operations
This section will explain how the organization will implement its Continuity of Operations
Plan, and specifically, how it plans to address each critical continuity of operations
element. This section should be separated into four phases: readiness and preparedness,
activation and relocation, continuity facility operations, and reconstitution. Devolution
planning strongly correlates in each phase, and is also addressed in this section.
A. PHASE I: READINESS AND PREPAREDNESS
Readiness is the ability of an organization to respond to a continuity event. This phase
includes all agency continuity readiness and preparedness activities. Organizations should