+CP [M] Contingency Planning
---+CP-01 [M] Policy and Procedures
---+CP-02 [M] Contingency Plan
------+CP-02(01) [M] Coordinate with Related Plans
------+CP-02(03) [M] Resume Mission and Business Functions
------+CP-02(08) [M] Identify Critical Assets
---+CP-03 [M] Contingency Training
---+CP-04 [M] Contingency Plan Testing
------+CP-04(01) [M] Coordinate with Related Plans
---+CP-06 [M] Alternate Storage Site
------+CP-06(01) [M] Separation from Primary Site
------+CP-06(03) [M] Accessibility
---+CP-07 [M] Alternate Processing Site
------+CP-07(01) [M] Separation from Primary Site
------+CP-07(02) [M] Accessibility
------+CP-07(03) [M] Priority of Service
---+CP-08 [M] Telecommunications Services
------+CP-08(01) [M] Priority of Service Provisions
------+CP-08(02) [M] Single Points of Failure
---+CP-09 [M] System Backup
------+CP-09(01) [M] Testing for Reliability and Integrity
------+CP-09(08) [M] Cryptographic Protection
---+CP-10 [M] System Recovery and Reconstitution
------+CP-10(02) [M] Transaction Recovery

CP [M] Contingency Planning

Contingency Planning

1. Panoramica

CP-01 [M] Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the contingency planning policy and procedures; and
  3. Review and update the current contingency planning:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Contingency planning policy and procedures address the controls in the CP family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of contingency planning policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to contingency planning policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a contingency planning policy is developed and documented;
    2. the contingency planning policy is disseminated to [Assignement: personnel or roles];
    3. contingency planning procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls are developed and documented;
    4. the contingency planning procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures;
      1. the current contingency planning policy is reviewed and updated [Assignement: frequency];
      2. the current contingency planning policy is reviewed and updated following [Assignement: events];
      1. the current contingency planning procedures are reviewed and updated [Assignement: frequency];
      2. the current contingency planning procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Contingency planning policy and procedures system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with contingency planning responsibilities organizational personnel with information security and privacy responsibilities
CP-02 [M] Contingency Plan

Control

  1. Develop a contingency plan for the system that:
    1. Identifies essential mission and business functions and associated contingency requirements;
    2. Provides recovery objectives, restoration priorities, and metrics;
    3. Addresses contingency roles, responsibilities, assigned individuals with contact information;
    4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
    5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;
    6. Addresses the sharing of contingency information; and
    7. Is reviewed and approved by [Assignement: organization-defined personnel or roles];
  2. Distribute copies of the contingency plan to [Assignement: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
  3. Coordinate contingency planning activities with incident handling activities;
  4. Review the contingency plan for the system [Assignement: frequency];
  5. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
  6. Communicate contingency plan changes to [Assignement: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
  7. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and
  8. Protect the contingency plan from unauthorized disclosure and modification.

Discussion

Contingency planning for systems is part of an overall program for achieving continuity of operations for organizational mission and business functions. Contingency planning addresses system restoration and implementation of alternative mission or business processes when systems are compromised or breached. Contingency planning is considered throughout the system development life cycle and is a fundamental part of the system design. Systems can be designed for redundancy, to provide backup capabilities, and for resilience. Contingency plans reflect the degree of restoration required for organizational systems since not all systems need to fully recover to achieve the level of continuity of operations desired. System recovery objectives reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, organizational risk tolerance, and system impact level. Actions addressed in contingency plans include orderly system degradation, system shutdown, fallback to a manual mode, alternate information flows, and operating in modes reserved for when systems are under attack. By coordinating contingency planning with incident handling activities, organizations ensure that the necessary planning activities are in place and activated in the event of an incident. Organizations consider whether continuity of operations during an incident conflicts with the capability to automatically disable the system, as specified in [IR-4(5)](#ir-4.5) . Incident response planning is part of contingency planning for organizations and is addressed in the [IR](#ir) (Incident Response) family.

Assessment Objective

    1. a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements;
      1. a contingency plan for the system is developed that provides recovery objectives;
      2. a contingency plan for the system is developed that provides restoration priorities;
      3. a contingency plan for the system is developed that provides metrics;
      1. a contingency plan for the system is developed that addresses contingency roles;
      2. a contingency plan for the system is developed that addresses contingency responsibilities;
      3. a contingency plan for the system is developed that addresses assigned individuals with contact information;
    4. a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
    5. a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented;
    6. a contingency plan for the system is developed that addresses the sharing of contingency information;
      1. a contingency plan for the system is developed that is reviewed by [Assignement: personnel or roles];
      2. a contingency plan for the system is developed that is approved by [Assignement: personnel or roles];
    1. copies of the contingency plan are distributed to [Assignement: key contingency personnel];
    2. copies of the contingency plan are distributed to [Assignement: organizational elements];
  3. contingency planning activities are coordinated with incident handling activities;
  4. the contingency plan for the system is reviewed [Assignement: frequency];
    1. the contingency plan is updated to address changes to the organization, system, or environment of operation;
    2. the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing;
    1. contingency plan changes are communicated to [Assignement: key contingency personnel];
    2. contingency plan changes are communicated to [Assignement: organizational elements];
    1. lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing;
    2. lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training;
    1. the contingency plan is protected from unauthorized disclosure;
    2. the contingency plan is protected from unauthorized modification.

Assessment Method

Examine

Contingency planning policy procedures addressing contingency operations for the system contingency plan evidence of contingency plan reviews and updates system security plan other relevant documents or records

Interview

Organizational personnel with contingency planning and plan implementation responsibilities organizational personnel with incident handling responsibilities organizational personnel with knowledge of requirements for mission and business functions organizational personnel with information security responsibilities
CP-03 [M] Contingency Training

Control

  1. Provide contingency training to system users consistent with assigned roles and responsibilities:
    1. Within [Assignement: time period] of assuming a contingency role or responsibility;
    2. When required by system changes; and
    3. [Assignement: frequency] thereafter; and
  2. Review and update contingency training content [Assignement: frequency] and following [Assignement: events].

Discussion

Contingency training provided by organizations is linked to the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail is included in such training. For example, some individuals may only need to know when and where to report for duty during contingency operations and if normal duties are affected; system administrators may require additional training on how to establish systems at alternate processing and storage sites; and organizational officials may receive more specific training on how to conduct mission-essential functions in designated off-site locations and how to establish communications with other governmental entities for purposes of coordination on contingency-related activities. Training for contingency roles or responsibilities reflects the specific continuity requirements in the contingency plan. Events that may precipitate an update to contingency training content include, but are not limited to, contingency plan testing or an actual contingency (lessons learned), assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. At the discretion of the organization, participation in a contingency plan test or exercise, including lessons learned sessions subsequent to the test or exercise, may satisfy contingency plan training requirements.

Assessment Objective

    1. contingency training is provided to system users consistent with assigned roles and responsibilities within [Assignement: time period] of assuming a contingency role or responsibility;
    2. contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes;
    3. contingency training is provided to system users consistent with assigned roles and responsibilities [Assignement: frequency] thereafter;
    1. the contingency plan training content is reviewed and updated [Assignement: frequency];
    2. the contingency plan training content is reviewed and updated following [Assignement: events].

Assessment Method

Examine

Contingency planning policy procedures addressing contingency training contingency plan contingency training curriculum contingency training material contingency training records system security plan other relevant documents or records

Interview

Organizational personnel with contingency planning, plan implementation, and training responsibilities organizational personnel with information security responsibilities
CP-04 [M] Contingency Plan Testing

Control

  1. Test the contingency plan for the system [Assignement: frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [Assignement: organization-defined tests].
  2. Review the contingency plan test results; and
  3. Initiate corrective actions, if needed.

Discussion

Methods for testing contingency plans to determine the effectiveness of the plans and identify potential weaknesses include checklists, walk-through and tabletop exercises, simulations (parallel or full interrupt), and comprehensive exercises. Organizations conduct testing based on the requirements in contingency plans and include a determination of the effects on organizational operations, assets, and individuals due to contingency operations. Organizations have flexibility and discretion in the breadth, depth, and timelines of corrective actions.

Assessment Objective

    1. the contingency plan for the system is tested [Assignement: frequency];
    2. [Assignement: tests] are used to determine the effectiveness of the plan;
    3. [Assignement: tests] are used to determine the readiness to execute the plan;
  2. the contingency plan test results are reviewed;
  3. corrective actions are initiated, if needed.

Assessment Method

Examine

Contingency planning policy procedures addressing contingency plan testing contingency plan contingency plan test documentation contingency plan test results system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for contingency plan testing, reviewing, or responding to contingency plan tests organizational personnel with information security responsibilities
CP-06 [M] Alternate Storage Site

Control

  1. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and
  2. Ensure that the alternate storage site provides controls equivalent to that of the primary site.

Discussion

Alternate storage sites are geographically distinct from primary storage sites and maintain duplicate copies of information and data if the primary storage site is not available. Similarly, alternate processing sites provide processing capability if the primary processing site is not available. Geographically distributed architectures that support contingency requirements may be considered alternate storage sites. Items covered by alternate storage site agreements include environmental conditions at the alternate sites, access rules for systems and facilities, physical and environmental protection requirements, and coordination of delivery and retrieval of backup media. Alternate storage sites reflect the requirements in contingency plans so that organizations can maintain essential mission and business functions despite compromise, failure, or disruption in organizational systems.

Assessment Objective

    1. an alternate storage site is established;
    2. establishment of the alternate storage site includes necessary agreements to permit the storage and retrieval of system backup information;
  2. the alternate storage site provides controls equivalent to that of the primary site.

Assessment Method

Examine

Contingency planning policy procedures addressing alternate storage sites contingency plan alternate storage site agreements primary storage site agreements system security plan other relevant documents or records

Interview

Organizational personnel with contingency plan alternate storage site responsibilities organizational personnel with system recovery responsibilities organizational personnel with information security responsibilities
CP-07 [M] Alternate Processing Site

Control

  1. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignement: system operations] for essential mission and business functions within [Assignement: time period] when the primary processing capabilities are unavailable;
  2. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and
  3. Provide controls at the alternate processing site that are equivalent to those at the primary site.

Discussion

Alternate processing sites are geographically distinct from primary processing sites and provide processing capability if the primary processing site is not available. The alternate processing capability may be addressed using a physical processing site or other alternatives, such as failover to a cloud-based service provider or other internally or externally provided processing service. Geographically distributed architectures that support contingency requirements may also be considered alternate processing sites. Controls that are covered by alternate processing site agreements include the environmental conditions at alternate sites, access rules, physical and environmental protection requirements, and the coordination for the transfer and assignment of personnel. Requirements are allocated to alternate processing sites that reflect the requirements in contingency plans to maintain essential mission and business functions despite disruption, compromise, or failure in organizational systems.

Assessment Objective

  1. an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignement: system operations] for essential mission and business functions, is established within [Assignement: time period] when the primary processing capabilities are unavailable;
    1. the equipment and supplies required to transfer operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within [Assignement: time period] for transfer;
    2. the equipment and supplies required to resume operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within [Assignement: time period] for resumption;
  3. controls provided at the alternate processing site are equivalent to those at the primary site.

Assessment Method

Examine

Contingency planning policy procedures addressing alternate processing sites contingency plan alternate processing site agreements primary processing site agreements spare equipment and supplies inventory at alternate processing site equipment and supply contracts service-level agreements system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for contingency planning and/or alternate site arrangements organizational personnel with information security responsibilities
CP-08 [M] Telecommunications Services

Control

Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignement: system operations] for essential mission and business functions within [Assignement: time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

Discussion

Telecommunications services (for data and voice) for primary and alternate processing and storage sites are in scope for [CP-8](#cp-8) . Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential mission and business functions despite the loss of primary telecommunications services. Organizations may specify different time periods for primary or alternate sites. Alternate telecommunications services include additional organizational or commercial ground-based circuits or lines, network-based approaches to telecommunications, or the use of satellites. Organizations consider factors such as availability, quality of service, and access when entering into alternate telecommunications agreements.

Assessment Objective

alternate telecommunications services, including necessary agreements to permit the resumption of [Assignement: system operations] , are established for essential mission and business functions within [Assignement: time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

Assessment Method

Examine

Contingency planning policy procedures addressing alternate telecommunications services contingency plan primary and alternate telecommunications service agreements system security plan other relevant documents or records

Interview

Organizational personnel with contingency plan telecommunications responsibilities organizational personnel with system recovery responsibilities organizational personnel with knowledge of requirements for mission and business functions organizational personnel with information security responsibilities organizational personnel with responsibility for acquisitions/contractual agreements
CP-09 [M] System Backup

Control

  1. Conduct backups of user-level information contained in [Assignement: system components] [Assignement: frequency];
  2. Conduct backups of system-level information contained in the system [Assignement: frequency];
  3. Conduct backups of system documentation, including security- and privacy-related documentation [Assignement: frequency] ; and
  4. Protect the confidentiality, integrity, and availability of backup information.

Discussion

System-level information includes system state information, operating system software, middleware, application software, and licenses. User-level information includes information other than system-level information. Mechanisms employed to protect the integrity of system backups include digital signatures and cryptographic hashes. Protection of system backup information while in transit is addressed by [MP-5](#mp-5) and [SC-8](#sc-8) . System backups reflect the requirements in contingency plans as well as other organizational requirements for backing up information. Organizations may be subject to laws, executive orders, directives, regulations, or policies with requirements regarding specific categories of information (e.g., personal health information). Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.

Assessment Objective

  1. backups of user-level information contained in [Assignement: system components] are conducted [Assignement: frequency];
  2. backups of system-level information contained in the system are conducted [Assignement: frequency];
  3. backups of system documentation, including security- and privacy-related documentation are conducted [Assignement: frequency];
    1. the confidentiality of backup information is protected;
    2. the integrity of backup information is protected;
    3. the availability of backup information is protected.

Assessment Method

Examine

Contingency planning policy procedures addressing system backup contingency plan backup storage location(s) system backup logs or records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with system backup responsibilities organizational personnel with information security and privacy responsibilities
CP-10 [M] System Recovery and Reconstitution

Control

Provide for the recovery and reconstitution of the system to a known state within [Assignement: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.

Discussion

Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.

Assessment Objective

  1. the recovery of the system to a known state is provided within [Assignement: time period] after a disruption, compromise, or failure;
  2. a reconstitution of the system to a known state is provided within [Assignement: time period] after a disruption, compromise, or failure.

Assessment Method

Examine

Contingency planning policy procedures addressing system backup contingency plan system backup test results contingency plan test results contingency plan test documentation redundant secondary system for system backups location(s) of redundant secondary backup system(s) system security plan other relevant documents or records

Interview

Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities organizational personnel with information security responsibilities

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni