+CP [L] Contingency Planning
---+CP-01 [L] Policy and Procedures
---+CP-02 [L] Contingency Plan
---+CP-03 [L] Contingency Training
---+CP-04 [L] Contingency Plan Testing
---+CP-09 [L] System Backup
---+CP-10 [L] System Recovery and Reconstitution

CP [L] Contingency Planning

Contingency Planning

1. Översikt

CP-01 [L] Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the contingency planning policy and procedures; and
  3. Review and update the current contingency planning:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Contingency planning policy and procedures address the controls in the CP family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of contingency planning policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to contingency planning policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a contingency planning policy is developed and documented;
    2. the contingency planning policy is disseminated to [Assignement: personnel or roles];
    3. contingency planning procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls are developed and documented;
    4. the contingency planning procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] contingency planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures;
      1. the current contingency planning policy is reviewed and updated [Assignement: frequency];
      2. the current contingency planning policy is reviewed and updated following [Assignement: events];
      1. the current contingency planning procedures are reviewed and updated [Assignement: frequency];
      2. the current contingency planning procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Contingency planning policy and procedures system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with contingency planning responsibilities organizational personnel with information security and privacy responsibilities
CP-02 [L] Contingency Plan

Control

  1. Develop a contingency plan for the system that:
    1. Identifies essential mission and business functions and associated contingency requirements;
    2. Provides recovery objectives, restoration priorities, and metrics;
    3. Addresses contingency roles, responsibilities, assigned individuals with contact information;
    4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
    5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;
    6. Addresses the sharing of contingency information; and
    7. Is reviewed and approved by [Assignement: organization-defined personnel or roles];
  2. Distribute copies of the contingency plan to [Assignement: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
  3. Coordinate contingency planning activities with incident handling activities;
  4. Review the contingency plan for the system [Assignement: frequency];
  5. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
  6. Communicate contingency plan changes to [Assignement: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
  7. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and
  8. Protect the contingency plan from unauthorized disclosure and modification.

Discussion

Contingency planning for systems is part of an overall program for achieving continuity of operations for organizational mission and business functions. Contingency planning addresses system restoration and implementation of alternative mission or business processes when systems are compromised or breached. Contingency planning is considered throughout the system development life cycle and is a fundamental part of the system design. Systems can be designed for redundancy, to provide backup capabilities, and for resilience. Contingency plans reflect the degree of restoration required for organizational systems since not all systems need to fully recover to achieve the level of continuity of operations desired. System recovery objectives reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, organizational risk tolerance, and system impact level. Actions addressed in contingency plans include orderly system degradation, system shutdown, fallback to a manual mode, alternate information flows, and operating in modes reserved for when systems are under attack. By coordinating contingency planning with incident handling activities, organizations ensure that the necessary planning activities are in place and activated in the event of an incident. Organizations consider whether continuity of operations during an incident conflicts with the capability to automatically disable the system, as specified in [IR-4(5)](#ir-4.5) . Incident response planning is part of contingency planning for organizations and is addressed in the [IR](#ir) (Incident Response) family.

Assessment Objective

    1. a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements;
      1. a contingency plan for the system is developed that provides recovery objectives;
      2. a contingency plan for the system is developed that provides restoration priorities;
      3. a contingency plan for the system is developed that provides metrics;
      1. a contingency plan for the system is developed that addresses contingency roles;
      2. a contingency plan for the system is developed that addresses contingency responsibilities;
      3. a contingency plan for the system is developed that addresses assigned individuals with contact information;
    4. a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
    5. a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented;
    6. a contingency plan for the system is developed that addresses the sharing of contingency information;
      1. a contingency plan for the system is developed that is reviewed by [Assignement: personnel or roles];
      2. a contingency plan for the system is developed that is approved by [Assignement: personnel or roles];
    1. copies of the contingency plan are distributed to [Assignement: key contingency personnel];
    2. copies of the contingency plan are distributed to [Assignement: organizational elements];
  3. contingency planning activities are coordinated with incident handling activities;
  4. the contingency plan for the system is reviewed [Assignement: frequency];
    1. the contingency plan is updated to address changes to the organization, system, or environment of operation;
    2. the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing;
    1. contingency plan changes are communicated to [Assignement: key contingency personnel];
    2. contingency plan changes are communicated to [Assignement: organizational elements];
    1. lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing;
    2. lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training;
    1. the contingency plan is protected from unauthorized disclosure;
    2. the contingency plan is protected from unauthorized modification.

Assessment Method

Examine

Contingency planning policy procedures addressing contingency operations for the system contingency plan evidence of contingency plan reviews and updates system security plan other relevant documents or records

Interview

Organizational personnel with contingency planning and plan implementation responsibilities organizational personnel with incident handling responsibilities organizational personnel with knowledge of requirements for mission and business functions organizational personnel with information security responsibilities
CP-03 [L] Contingency Training

Control

  1. Provide contingency training to system users consistent with assigned roles and responsibilities:
    1. Within [Assignement: time period] of assuming a contingency role or responsibility;
    2. When required by system changes; and
    3. [Assignement: frequency] thereafter; and
  2. Review and update contingency training content [Assignement: frequency] and following [Assignement: events].

Discussion

Contingency training provided by organizations is linked to the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail is included in such training. For example, some individuals may only need to know when and where to report for duty during contingency operations and if normal duties are affected; system administrators may require additional training on how to establish systems at alternate processing and storage sites; and organizational officials may receive more specific training on how to conduct mission-essential functions in designated off-site locations and how to establish communications with other governmental entities for purposes of coordination on contingency-related activities. Training for contingency roles or responsibilities reflects the specific continuity requirements in the contingency plan. Events that may precipitate an update to contingency training content include, but are not limited to, contingency plan testing or an actual contingency (lessons learned), assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. At the discretion of the organization, participation in a contingency plan test or exercise, including lessons learned sessions subsequent to the test or exercise, may satisfy contingency plan training requirements.

Assessment Objective

    1. contingency training is provided to system users consistent with assigned roles and responsibilities within [Assignement: time period] of assuming a contingency role or responsibility;
    2. contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes;
    3. contingency training is provided to system users consistent with assigned roles and responsibilities [Assignement: frequency] thereafter;
    1. the contingency plan training content is reviewed and updated [Assignement: frequency];
    2. the contingency plan training content is reviewed and updated following [Assignement: events].

Assessment Method

Examine

Contingency planning policy procedures addressing contingency training contingency plan contingency training curriculum contingency training material contingency training records system security plan other relevant documents or records

Interview

Organizational personnel with contingency planning, plan implementation, and training responsibilities organizational personnel with information security responsibilities
CP-04 [L] Contingency Plan Testing

Control

  1. Test the contingency plan for the system [Assignement: frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [Assignement: organization-defined tests].
  2. Review the contingency plan test results; and
  3. Initiate corrective actions, if needed.

Discussion

Methods for testing contingency plans to determine the effectiveness of the plans and identify potential weaknesses include checklists, walk-through and tabletop exercises, simulations (parallel or full interrupt), and comprehensive exercises. Organizations conduct testing based on the requirements in contingency plans and include a determination of the effects on organizational operations, assets, and individuals due to contingency operations. Organizations have flexibility and discretion in the breadth, depth, and timelines of corrective actions.

Assessment Objective

    1. the contingency plan for the system is tested [Assignement: frequency];
    2. [Assignement: tests] are used to determine the effectiveness of the plan;
    3. [Assignement: tests] are used to determine the readiness to execute the plan;
  2. the contingency plan test results are reviewed;
  3. corrective actions are initiated, if needed.

Assessment Method

Examine

Contingency planning policy procedures addressing contingency plan testing contingency plan contingency plan test documentation contingency plan test results system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for contingency plan testing, reviewing, or responding to contingency plan tests organizational personnel with information security responsibilities
CP-09 [L] System Backup

Control

  1. Conduct backups of user-level information contained in [Assignement: system components] [Assignement: frequency];
  2. Conduct backups of system-level information contained in the system [Assignement: frequency];
  3. Conduct backups of system documentation, including security- and privacy-related documentation [Assignement: frequency] ; and
  4. Protect the confidentiality, integrity, and availability of backup information.

Discussion

System-level information includes system state information, operating system software, middleware, application software, and licenses. User-level information includes information other than system-level information. Mechanisms employed to protect the integrity of system backups include digital signatures and cryptographic hashes. Protection of system backup information while in transit is addressed by [MP-5](#mp-5) and [SC-8](#sc-8) . System backups reflect the requirements in contingency plans as well as other organizational requirements for backing up information. Organizations may be subject to laws, executive orders, directives, regulations, or policies with requirements regarding specific categories of information (e.g., personal health information). Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.

Assessment Objective

  1. backups of user-level information contained in [Assignement: system components] are conducted [Assignement: frequency];
  2. backups of system-level information contained in the system are conducted [Assignement: frequency];
  3. backups of system documentation, including security- and privacy-related documentation are conducted [Assignement: frequency];
    1. the confidentiality of backup information is protected;
    2. the integrity of backup information is protected;
    3. the availability of backup information is protected.

Assessment Method

Examine

Contingency planning policy procedures addressing system backup contingency plan backup storage location(s) system backup logs or records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with system backup responsibilities organizational personnel with information security and privacy responsibilities
CP-10 [L] System Recovery and Reconstitution

Control

Provide for the recovery and reconstitution of the system to a known state within [Assignement: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.

Discussion

Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.

Assessment Objective

  1. the recovery of the system to a known state is provided within [Assignement: time period] after a disruption, compromise, or failure;
  2. a reconstitution of the system to a known state is provided within [Assignement: time period] after a disruption, compromise, or failure.

Assessment Method

Examine

Contingency planning policy procedures addressing system backup contingency plan system backup test results contingency plan test results contingency plan test documentation redundant secondary system for system backups location(s) of redundant secondary backup system(s) system security plan other relevant documents or records

Interview

Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities organizational personnel with information security responsibilities

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

Krav

3. Relaterade regleringar

Regleringar