Assessment Objective

Determine if:

• CP-08(04)(a)
  • CP-08(04)(a)[01] primary telecommunications service providers are required to have contingency plans;
  • CP-08(04)(a)[02] alternate telecommunications service providers are required to have contingency plans;
• CP-08(04)(b) provider contingency plans are reviewed to ensure that the plans meet organizational contingency requirements;
• CP-08(04)(c)
  • CP-08(04)(c)[01] evidence of contingency testing by providers is obtained [Assignment: frequency].
  • CP-08(04)(c)[02] evidence of contingency training by providers is obtained [Assignment: frequency].

Assessment Methods

Examine

• Contingency planning policy
• procedures addressing primary and alternate telecommunications services
• contingency plan
• provider contingency plans
• evidence of contingency testing/training by providers
• primary and alternate telecommunications service agreements
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with contingency planning, plan implementation, and testing responsibilities
• primary and alternate telecommunications service providers
• organizational personnel with information security responsibilities
• organizational personnel with responsibility for acquisitions/contractual agreements

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final