BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CP-08(04) Provider Contingency Plan

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
first version loaded CP High baseline part of CP-8

Title

Provider Contingency Plan

Control

(a) Require primary and alternate telecommunications service providers to have contingency plans;
(b) Review provider contingency plans to ensure that the plans meet organizational contingency requirements; and
(c) Obtain evidence of contingency testing and training by providers [Assignment: organization-defined frequency].

Discussion

Reviews of provider contingency plans consider the proprietary nature of such plans. In some situations, a summary of provider contingency plans may be sufficient evidence for organizations to satisfy the review requirement. Telecommunications service providers may also participate in ongoing disaster recovery exercises in coordination with the Department of Homeland Security and state and local governments. Organizations may use these types of activities to satisfy evidentiary requirements related to service provider contingency plan reviews, testing, and training.

Parameters

cp-8.4_prm_1: organization-defined frequency
cp-08.04_odp.01: frequency
cp-08.04_odp.02: frequency

Related controls

cp-3, cp-4

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).