+CP-02 [L] Contingency Plan

CP-02 [L] Contingency Plan

Control

  1. Develop a contingency plan for the system that:
    1. Identifies essential mission and business functions and associated contingency requirements;
    2. Provides recovery objectives, restoration priorities, and metrics;
    3. Addresses contingency roles, responsibilities, assigned individuals with contact information;
    4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
    5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;
    6. Addresses the sharing of contingency information; and
    7. Is reviewed and approved by [Assignement: organization-defined personnel or roles];
  2. Distribute copies of the contingency plan to [Assignement: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
  3. Coordinate contingency planning activities with incident handling activities;
  4. Review the contingency plan for the system [Assignement: frequency];
  5. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
  6. Communicate contingency plan changes to [Assignement: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
  7. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and
  8. Protect the contingency plan from unauthorized disclosure and modification.

Discussion

Contingency planning for systems is part of an overall program for achieving continuity of operations for organizational mission and business functions. Contingency planning addresses system restoration and implementation of alternative mission or business processes when systems are compromised or breached. Contingency planning is considered throughout the system development life cycle and is a fundamental part of the system design. Systems can be designed for redundancy, to provide backup capabilities, and for resilience. Contingency plans reflect the degree of restoration required for organizational systems since not all systems need to fully recover to achieve the level of continuity of operations desired. System recovery objectives reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, organizational risk tolerance, and system impact level. Actions addressed in contingency plans include orderly system degradation, system shutdown, fallback to a manual mode, alternate information flows, and operating in modes reserved for when systems are under attack. By coordinating contingency planning with incident handling activities, organizations ensure that the necessary planning activities are in place and activated in the event of an incident. Organizations consider whether continuity of operations during an incident conflicts with the capability to automatically disable the system, as specified in [IR-4(5)](#ir-4.5) . Incident response planning is part of contingency planning for organizations and is addressed in the [IR](#ir) (Incident Response) family.

Assessment Objective

    1. a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements;
      1. a contingency plan for the system is developed that provides recovery objectives;
      2. a contingency plan for the system is developed that provides restoration priorities;
      3. a contingency plan for the system is developed that provides metrics;
      1. a contingency plan for the system is developed that addresses contingency roles;
      2. a contingency plan for the system is developed that addresses contingency responsibilities;
      3. a contingency plan for the system is developed that addresses assigned individuals with contact information;
    4. a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
    5. a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented;
    6. a contingency plan for the system is developed that addresses the sharing of contingency information;
      1. a contingency plan for the system is developed that is reviewed by [Assignement: personnel or roles];
      2. a contingency plan for the system is developed that is approved by [Assignement: personnel or roles];
    1. copies of the contingency plan are distributed to [Assignement: key contingency personnel];
    2. copies of the contingency plan are distributed to [Assignement: organizational elements];
  3. contingency planning activities are coordinated with incident handling activities;
  4. the contingency plan for the system is reviewed [Assignement: frequency];
    1. the contingency plan is updated to address changes to the organization, system, or environment of operation;
    2. the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing;
    1. contingency plan changes are communicated to [Assignement: key contingency personnel];
    2. contingency plan changes are communicated to [Assignement: organizational elements];
    1. lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing;
    2. lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training;
    1. the contingency plan is protected from unauthorized disclosure;
    2. the contingency plan is protected from unauthorized modification.

Assessment Method

Examine

Contingency planning policy procedures addressing contingency operations for the system contingency plan evidence of contingency plan reviews and updates system security plan other relevant documents or records

Interview

Organizational personnel with contingency planning and plan implementation responsibilities organizational personnel with incident handling responsibilities organizational personnel with knowledge of requirements for mission and business functions organizational personnel with information security responsibilities

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by CP-02 [L] Contingency Plan – Assessment Procedure
is blocked by Business Continuity Management System (BCMS)
is blocked by Ongoing Contingency Planning
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.