Tiering Framework
Objective, criteria-based tier definitions with full traceability from scored business impact to tier assignment. Methodology aligned to NIST SP 800-34 Rev. 1 (Contingency Planning Guide) and the six impact categories defined in the Phase I BIA scope: public safety, financial/revenue, federal funding & compliance, operational disruption, legal/contractual, and public-facing service.
Tier 0 — Mission Critical
2 applicationsRTO
≤ 4 hours
RPO
≤ 15 minutes
Availability
99.9%+ / 24×7×365
- Direct, immediate impact on life safety or emergency response if unavailable
- Public safety impact score of 5
- Required for statewide emergency operations (hurricane evacuation, winter storms)
- No acceptable workaround beyond a few hours of manual operation
Typical: 511/ATMS traffic management, emergency operations
Tier 1 — Critical
5 applicationsRTO
≤ 24 hours
RPO
≤ 4 hours
Availability
99.5% / business + on-call
- Major financial exposure: payment, payroll, or federal-aid billing stoppage
- Any impact score of 5 in financial/revenue or operational disruption
- Statewide operational stoppage (all districts) within 24 hours of outage
- Shared-dependency uplift: platform that four or more Tier 0/1 systems depend on
Typical: Construction payments, ERP interfaces, enterprise GIS
Tier 2 — Important
6 applicationsRTO
≤ 72 hours
RPO
≤ 24 hours
Availability
99% / business hours
- Federal compliance exposure with deadlines measured in weeks, not hours
- District-level (not statewide) operational disruption
- Manual workaround feasible for a multi-day outage
- Public-facing services with alternate channels available
Typical: Bridge inspections, permits, document management
Tier 3 — Non-Critical
2 applicationsRTO
≤ 5 business days
RPO
≤ 72 hours
Availability
≥ 97% / business hours
- No impact score above 3 in any category
- Functions deferrable for a week or more with full manual workaround
- Administrative or periodic-reporting functions
- May carry seasonal elevation triggers (e.g., fleet during winter operations)
Typical: Fleet administration, local agency portals
Assignment Rules
Deterministic rules applied in order; every tier assignment cites the rule(s) that produced it.
| Rule | Condition | Effect | Applications citing |
|---|---|---|---|
| R1 | Public safety impact score = 5 | Assign Tier 0 | |
| R2 | Financial/revenue or operational disruption score = 5, or federal compliance = 5 with continuous (daily) obligations | Assign at least Tier 1 | |
| R3 | Federal compliance score ≥ 4 with periodic (weekly/monthly) deadlines, or any score = 4 with feasible workaround | Assign at least Tier 2 | |
| R4 | No impact score above 3 in any category | Assign Tier 3 | |
| R5 | Shared-dependency uplift: ≥ 4 Tier 0/1 applications list this system as a dependency | Uplift to at least Tier 1 | |
| R6 | Seasonal elevation: role in declared emergency operations (winter weather, hurricane) | Temporary uplift for event duration; documented in DR runbook |
Tier Assignment Traceability Matrix
Every application, its driving rule(s), and the resulting tier — auditable end to end.
| Application | Rules applied | Rationale | Assigned tier |
|---|---|---|---|
| ATMS/511 511 Traveler Information & Advanced Traffic Management System | R1 | Public safety score of 5 (R1): incident detection, evacuation lane-reversal, and public warning functions have direct life-safety impact within minutes of an outage. | Tier 0 |
| EOD Emergency Operations Dashboard | R1R6 | Public safety score of 5 (R1) during declared emergencies; R6 documents its activation-driven availability profile (24×7 during events). | Tier 0 |
| P2S Construction & Project Delivery Suite (Preconstruction-to-SiteManager) | R2 | Financial/revenue and federal compliance scores of 5 (R2): contractor payments and FHWA federal-aid billing stop with the system. | Tier 1 |
| HMMS Highway Maintenance Management System | R2 | Operational disruption score of 5 (R2): statewide maintenance dispatch halts. Safety score of 4 reinforces but does not trigger Tier 0. | Tier 1 |
| OneMap OneMap Enterprise GIS Platform | R5 | Shared-dependency uplift (R5): five Tier 0/1 applications consume OneMap services; a Tier 2 raw score is uplifted to Tier 1. | Tier 1 |
| DMV-GW SCDMV & Toll Interface Gateway | R2R3 | Financial and legal scores of 4 with revenue stoppage and interstate tolling obligations (R2 boundary case): assigned Tier 1 given likelihood 4 and absence of scalable workaround. | Tier 1 |
| SCEIS-IH SCEIS Interface Hub | R2R5 | Financial score of 5 (R2) and shared-dependency uplift (R5): four downstream business systems depend on this hub for all ERP flows. | Tier 1 |
| BrM Bridge Management System | R3 | Federal compliance score of 5 but with periodic (annual/24-month cycle) deadlines and a feasible manual workaround (R3): Tier 2, not Tier 1. | Tier 2 |
| CDA Crash Data Analytics Platform | R3 | Safety and federal scores of 4 operating on planning timescales with feasible workaround (R3): Tier 2. | Tier 2 |
| EPPS Encroachment Permit Processing System | R3 | Public-facing score of 4 with a fully feasible manual workaround (R3): Tier 2. | Tier 2 |
| EDMS Enterprise Document Management System | R3 | Legal/contractual score of 4 with multi-day tolerance (R3): Tier 2. SAN SPOF is the top remediation flag from this BIA cycle. | Tier 2 |
| WWW/CMS Public Website & Content Management System | R3R6 | Public-facing score of 5 but with alternate channels and static failover (R3): Tier 2, with R6 emergency elevation (MTD drops to 4 hours during declared events). | Tier 2 |
| RIMS Road Inventory Management System | R3 | Federal compliance score of 5 tied to an annual deadline with workaround capacity (R3): Tier 2, with a documented seasonal tolerance change during HPMS season. | Tier 2 |
| FEMS Fleet & Equipment Management System | R4R6 | No score above 3 (R4): Tier 3. R6 seasonal elevation: treated as Tier 2 during declared winter-weather and hurricane operations, when equipment readiness becomes time-critical. | Tier 3 |
| LPA Local Public Agency Portal | R4 | No impact score above 3 (R4): Tier 3. Reimbursement flows tolerate a multi-day outage with a documented fallback. | Tier 3 |
Framework note: recovery-objective thresholds are tier ceilings, not defaults — individual applications may carry tighter objectives where the business case requires (e.g., ATMS/511 at RTO 1 hour within Tier 0's ≤ 4-hour ceiling). Seasonal elevation triggers (R6) are documented in the corresponding DR runbooks rather than by permanently over-tiering low-impact systems.