Your hospital's equipment vendor provides many life-saving devices, from heart-monitors to EKG's, that store and sort PHI data for retrieval by the hospital's EMR system. In your Service Level Agreements (SLA), you want to make sure that equipment vendors have agreed to the essentials that HIPAA and NIST recommend are in place for a contingency situation for covered entities. Which of the following would not be a NIST recommendation?