+CP-08(04) Provider Contingency Plan

CP-08(04) Provider Contingency Plan

Control

  1. Require primary and alternate telecommunications service providers to have contingency plans;
  2. Review provider contingency plans to ensure that the plans meet organizational contingency requirements; and
  3. Obtain evidence of contingency testing and training by providers [Assignement: organization-defined frequency].

Discussion

Reviews of provider contingency plans consider the proprietary nature of such plans. In some situations, a summary of provider contingency plans may be sufficient evidence for organizations to satisfy the review requirement. Telecommunications service providers may also participate in ongoing disaster recovery exercises in coordination with the Department of Homeland Security and state and local governments. Organizations may use these types of activities to satisfy evidentiary requirements related to service provider contingency plan reviews, testing, and training.

Assessment Objective

    1. primary telecommunications service providers are required to have contingency plans;
    2. alternate telecommunications service providers are required to have contingency plans;
  2. provider contingency plans are reviewed to ensure that the plans meet organizational contingency requirements;
    1. evidence of contingency testing by providers is obtained [Assignement: frequency].
    2. evidence of contingency training by providers is obtained [Assignement: frequency].

Assessment Method

Examine

Contingency planning policy procedures addressing primary and alternate telecommunications services contingency plan provider contingency plans evidence of contingency testing/training by providers primary and alternate telecommunications service agreements system security plan other relevant documents or records

Interview

Organizational personnel with contingency planning, plan implementation, and testing responsibilities primary and alternate telecommunications service providers organizational personnel with information security responsibilities organizational personnel with responsibility for acquisitions/contractual agreements

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is blocked by CP-08(04) Provider Contingency Plan – Assessment Procedure
is blocked by Coordinate With External Service Providers
is blocked by Provider Contingency Plan