Assessment Objective
Determine if:
- CP-02a.
- CP-02a.01 a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements;
- CP-02a.02
- CP-02a.02[01] a contingency plan for the system is developed that provides recovery objectives;
- CP-02a.02[02] a contingency plan for the system is developed that provides restoration priorities;
- CP-02a.02[03] a contingency plan for the system is developed that provides metrics;
- CP-02a.03
- CP-02a.03[01] a contingency plan for the system is developed that addresses contingency roles;
- CP-02a.03[02] a contingency plan for the system is developed that addresses contingency responsibilities;
- CP-02a.03[03] a contingency plan for the system is developed that addresses assigned individuals with contact information;
- CP-02a.04 a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
- CP-02a.05 a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented;
- CP-02a.06 a contingency plan for the system is developed that addresses the sharing of contingency information;
- CP-02a.07
- CP-02a.07[01] a contingency plan for the system is developed that is reviewed by [Assignment: personnel or roles];
- CP-02a.07[02] a contingency plan for the system is developed that is approved by [Assignment: personnel or roles];
- CP-02b.
- CP-02b.[01] copies of the contingency plan are distributed to [Assignment: key contingency personnel];
- CP-02b.[02] copies of the contingency plan are distributed to [Assignment: organizational elements];
- CP-02c. contingency planning activities are coordinated with incident handling activities;
- CP-02d. the contingency plan for the system is reviewed [Assignment: frequency];
- CP-02e.
- CP-02e.[01] the contingency plan is updated to address changes to the organization, system, or environment of operation;
- CP-02e.[02] the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing;
- CP-02f.
- CP-02f.[01] contingency plan changes are communicated to [Assignment: key contingency personnel];
- CP-02f.[02] contingency plan changes are communicated to [Assignment: organizational elements];
- CP-02g.
- CP-02g.[01] lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing;
- CP-02g.[02] lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training;
- CP-02h.
- CP-02h.[01] the contingency plan is protected from unauthorized disclosure;
- CP-02h.[02] the contingency plan is protected from unauthorized modification.
Assessment Methods
Examine
- Contingency planning policy
- procedures addressing contingency operations for the system
- contingency plan
- evidence of contingency plan reviews and updates
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with contingency planning and plan implementation responsibilities
- organizational personnel with incident handling responsibilities
- organizational personnel with knowledge of requirements for mission and business functions
- organizational personnel with information security responsibilities
Test
- Organizational processes for contingency plan development, review, update, and protection
- mechanisms for developing, reviewing, updating, and/or protecting the contingency plan
Povezane zadeve
| Vrsta povezave | Zadeva |
|---|---|
| blocks | CP-02 [H] Contingency Plan |