NIST SP 800-53 (controls) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| CP-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy that: (a) Addresses p | |
| CP-02 | Contingency Plan | a. Develop a contingency plan for the system that: 1. Identifies essential mission and business functions and associated contingency requirements; 2. Provides recovery objectives, restoration priorities, and metrics; 3. Addresses contingenc | |
| CP-02(01) in CP-2 |
Coordinate with Related Plans | Coordinate contingency plan development with organizational elements responsible for related plans. | |
| CP-02(02) in CP-2 |
Capacity Planning | Conduct capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations. | |
| CP-02(03) in CP-2 |
Resume Mission and Business Functions | Plan for the resumption of [Selection: all; essential] mission and business functions within [Assignment: time period] of contingency plan activation. | |
| CP-02(04) in CP-2 |
Resume All Mission and Business Functions withdrawn | ||
| CP-02(05) in CP-2 |
Continue Mission and Business Functions | Plan for the continuance of [Selection: all; essential] mission and business functions with minimal or no loss of operational continuity and sustains that continuity until full system restoration at primary processing and/or storage sites. | |
| CP-02(06) in CP-2 |
Alternate Processing and Storage Sites | Plan for the transfer of [Selection: all; essential] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that continuity through system restoration to pri | |
| CP-02(07) in CP-2 |
Coordinate with External Service Providers | Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied. | |
| CP-02(08) in CP-2 |
Identify Critical Assets | Identify critical system assets supporting [Selection: all; essential] mission and business functions. | |
| CP-03 | Contingency Training | a. Provide contingency training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: time period] of assuming a contingency role or responsibility; 2. When required by system changes; and 3. [Assignmen | |
| CP-03(01) in CP-3 |
Simulated Events | Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations. | |
| CP-03(02) in CP-3 |
Mechanisms Used in Training Environments | Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment. | |
| CP-04 | Contingency Plan Testing | a. Test the contingency plan for the system [Assignment: frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [Assignment: organization-defined tests]. b. Review the continge | |
| CP-04(01) in CP-4 |
Coordinate with Related Plans | Coordinate contingency plan testing with organizational elements responsible for related plans. | |
| CP-04(02) in CP-4 |
Alternate Processing Site | Test the contingency plan at the alternate processing site: (a) To familiarize contingency personnel with the facility and available resources; and (b) To evaluate the capabilities of the alternate processing site to support contingency ope | |
| CP-04(03) in CP-4 |
Automated Testing | Test the contingency plan using [Assignment: automated mechanisms]. | |
| CP-04(04) in CP-4 |
Full Recovery and Reconstitution | Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing. | |
| CP-04(05) in CP-4 |
Self-challenge | Employ [Assignment: mechanisms] to [Assignment: system or system component] to disrupt and adversely affect the system or system component. | |
| CP-05 | Contingency Plan Update withdrawn | ||
| CP-06 | Alternate Storage Site | a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and b. Ensure that the alternate storage site provides controls equivalent to that of the primary site. | |
| CP-06(01) in CP-6 |
Separation from Primary Site | Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats. | |
| CP-06(02) in CP-6 |
Recovery Time and Recovery Point Objectives | Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives. | |
| CP-06(03) in CP-6 |
Accessibility | Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions. | |
| CP-07 | Alternate Processing Site | a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: system operations] for essential mission and business functions within [Assignment: time period] when the primar | |
| CP-07(01) in CP-7 |
Separation from Primary Site | Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats. | |
| CP-07(02) in CP-7 |
Accessibility | Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions. | |
| CP-07(03) in CP-7 |
Priority of Service | Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives). | |
| CP-07(04) in CP-7 |
Preparation for Use | Prepare the alternate processing site so that the site can serve as the operational site supporting essential mission and business functions. | |
| CP-07(05) in CP-7 |
Equivalent Information Security Safeguards withdrawn | ||
| CP-07(06) in CP-7 |
Inability to Return to Primary Site | Plan and prepare for circumstances that preclude returning to the primary processing site. | |
| CP-08 | Telecommunications Services | Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: system operations] for essential mission and business functions within [Assignment: time period] when the primary telec | |
| CP-08(01) in CP-8 |
Priority of Service Provisions | (a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and (b) Request Telecommunications Servic | |
| CP-08(02) in CP-8 |
Single Points of Failure | Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services. | |
| CP-08(03) in CP-8 |
Separation of Primary and Alternate Providers | Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats. | |
| CP-08(04) in CP-8 |
Provider Contingency Plan | (a) Require primary and alternate telecommunications service providers to have contingency plans; (b) Review provider contingency plans to ensure that the plans meet organizational contingency requirements; and (c) Obtain evidence of contin | |
| CP-08(05) in CP-8 |
Alternate Telecommunication Service Testing | Test alternate telecommunication services [Assignment: frequency]. | |
| CP-09 | System Backup | a. Conduct backups of user-level information contained in [Assignment: system components] [Assignment: frequency]; b. Conduct backups of system-level information contained in the system [Assignment: frequency]; c. Conduct backups of system | |
| CP-09(01) in CP-9 |
Testing for Reliability and Integrity | Test backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity. | |
| CP-09(02) in CP-9 |
Test Restoration Using Sampling | Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing. | |
| CP-09(03) in CP-9 |
Separate Storage for Critical Information | Store backup copies of [Assignment: critical system software and other security-related information] in a separate facility or in a fire rated container that is not collocated with the operational system. | |
| CP-09(04) in CP-9 |
Protection from Unauthorized Modification withdrawn | ||
| CP-09(05) in CP-9 |
Transfer to Alternate Storage Site | Transfer system backup information to the alternate storage site [Assignment: organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives]. | |
| CP-09(06) in CP-9 |
Redundant Secondary System | Conduct system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations. | |
| CP-09(07) in CP-9 |
Dual Authorization for Deletion or Destruction | Enforce dual authorization for the deletion or destruction of [Assignment: backup information]. | |
| CP-09(08) in CP-9 |
Cryptographic Protection | Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: backup information]. | |
| CP-10 | System Recovery and Reconstitution | Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure. | |
| CP-10(01) in CP-10 |
Contingency Plan Testing withdrawn | ||
| CP-10(02) in CP-10 |
Transaction Recovery | Implement transaction recovery for systems that are transaction-based. | |
| CP-10(03) in CP-10 |
Compensating Security Controls withdrawn | Addressed through tailoring. | |
| CP-10(04) in CP-10 |
Restore Within Time Period | Provide the capability to restore system components within [Assignment: restoration time periods] from configuration-controlled and integrity-protected information representing a known, operational state for the components. | |
| CP-10(05) in CP-10 |
Failover Capability withdrawn | ||
| CP-10(06) in CP-10 |
Component Protection | Protect system components used for recovery and reconstitution. | |
| CP-11 | Alternate Communications Protocols | Provide the capability to employ [Assignment: alternative communications protocols] in support of maintaining continuity of operations. | |
| CP-12 | Safe Mode | When [Assignment: conditions] are detected, enter a safe mode of operation with [Assignment: restrictions]. | |
| CP-13 | Alternative Security Mechanisms | Employ [Assignment: alternative or supplemental security mechanisms] for satisfying [Assignment: security functions] when the primary means of implementing the security function is unavailable or compromised. |
56 of 1196.