Assessment Objective

Determine if:

• CP-03a.
  • CP-03a.01 contingency training is provided to system users consistent with assigned roles and responsibilities within [Assignment: time period] of assuming a contingency role or responsibility;
  • CP-03a.02 contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes;
  • CP-03a.03 contingency training is provided to system users consistent with assigned roles and responsibilities [Assignment: frequency] thereafter;
• CP-03b.
  • CP-03b.[01] the contingency plan training content is reviewed and updated [Assignment: frequency];
  • CP-03b.[02] the contingency plan training content is reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Contingency planning policy
• procedures addressing contingency training
• contingency plan
• contingency training curriculum
• contingency training material
• contingency training records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with contingency planning, plan implementation, and training responsibilities
• organizational personnel with information security responsibilities

Test

• Organizational processes for contingency training

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final