+CP-08 [M] Telecommunications Services
---+CP-08(01) [M] Priority of Service Provisions
---+CP-08(02) [M] Single Points of Failure

CP-08 [M] Telecommunications Services

Control

Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignement: system operations] for essential mission and business functions within [Assignement: time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

Discussion

Telecommunications services (for data and voice) for primary and alternate processing and storage sites are in scope for [CP-8](#cp-8) . Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential mission and business functions despite the loss of primary telecommunications services. Organizations may specify different time periods for primary or alternate sites. Alternate telecommunications services include additional organizational or commercial ground-based circuits or lines, network-based approaches to telecommunications, or the use of satellites. Organizations consider factors such as availability, quality of service, and access when entering into alternate telecommunications agreements.

Assessment Objective

alternate telecommunications services, including necessary agreements to permit the resumption of [Assignement: system operations] , are established for essential mission and business functions within [Assignement: time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

Assessment Method

Examine

Contingency planning policy procedures addressing alternate telecommunications services contingency plan primary and alternate telecommunications service agreements system security plan other relevant documents or records

Interview

Organizational personnel with contingency plan telecommunications responsibilities organizational personnel with system recovery responsibilities organizational personnel with knowledge of requirements for mission and business functions organizational personnel with information security responsibilities organizational personnel with responsibility for acquisitions/contractual agreements

1. Vue d’ensemble

CP-08(01) [M] Priority of Service Provisions

Control

  1. Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and
  2. Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.

Discussion

Organizations consider the potential mission or business impact in situations where telecommunications service providers are servicing other organizations with similar priority of service provisions. Telecommunications Service Priority (TSP) is a Federal Communications Commission (FCC) program that directs telecommunications service providers (e.g., wireline and wireless phone companies) to give preferential treatment to users enrolled in the program when they need to add new lines or have their lines restored following a disruption of service, regardless of the cause. The FCC sets the rules and policies for the TSP program, and the Department of Homeland Security manages the TSP program. The TSP program is always in effect and not contingent on a major disaster or attack taking place. Federal sponsorship is required to enroll in the TSP program.

Assessment Objective

    1. primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed;
    2. alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed;
  2. Telecommunications Service Priority is requested for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.

Assessment Method

Examine

Contingency planning policy procedures addressing primary and alternate telecommunications services contingency plan primary and alternate telecommunications service agreements Telecommunications Service Priority documentation system security plan other relevant documents or records

Interview

Organizational personnel with contingency plan telecommunications responsibilities organizational personnel with system recovery responsibilities organizational personnel with information security responsibilities organizational personnel with responsibility for acquisitions/contractual agreements
CP-08(02) [M] Single Points of Failure

Control

Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.

Discussion

In certain circumstances, telecommunications service providers or services may share the same physical lines, which increases the vulnerability of a single failure point. It is important to have provider transparency for the actual physical transmission capability for telecommunication services.

Assessment Objective

alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services are obtained.

Assessment Method

Examine

Contingency planning policy procedures addressing primary and alternate telecommunications services contingency plan primary and alternate telecommunications service agreements system security plan other relevant documents or records

Interview

Organizational personnel with contingency plan telecommunications responsibilities organizational personnel with system recovery responsibilities primary and alternate telecommunications service providers organizational personnel with information security responsibilities

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations

Tickets liés

Liens
is blocked by CP-08 [M] Telecommunications Services – Assessment Procedure
is blocked by Telecommunications Services Availability