The Chemical Safety and Hazard Investigation Board (CSB), a component agency of the Environmental Protection Agency (EPA), struggled to keep its disaster recovery plan in place during COVID-19, failing to store off-site backups and not conducting testing, according to a report released by the EPA’s inspector general.
The report, conducted on behalf of the EPA’s Office of the Inspector General and released November 18, found that the CSB was not storing offsite backups due to remote work procedures during the COVID-19 pandemic, falling short of guidance from the National Institute of Standards and Technology (NIST).
“There is risk exposure that critical systems cannot be recovered timely if the primary location is not available,” the report states. The report recommended that CSB examine alternative methods of backup storage, such as cloud or electronic vaulting, but CSB agreed to restart the regular backup process.
The lack of disaster recovery testing also raised concerns from the auditors, with no tests coming in fiscal year 2020. The root cause again fell on the pandemic and telework, with the agency not keeping up its normal procedures.
“Without adequate testing, the opportunity to practice, prepare, identify gaps, and ensure that the plan will work has not been completed,” the auditors state. The report recommends that CSB perform a disaster recovery test on an annual basis, which the agency agreed to do. CSB also agreed to conduct a belated test for fiscal year 2020 by the end of December.