CP – Contingency Planning

NIST SP 800-53B – CP – Contingency Planning

1.Kravtext (engelskt original)#

CP-1 – Policy and Procedures#

• a. Develop, document, and disseminate to [organization-defined personnel or roles]:
  • 1. [organization-level or mission/business process-level or system-level] contingency planning policy that:
    • (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    • (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
  • 2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls;
• b. Designate an [organization-defined official] to manage the development, documentation, and dissemination of the contingency planning policy and procedures; and
• c. Review and update the current contingency planning:
  • 1. Policy [organization-defined frequency] and following [organization-defined events] ; and
  • 2. Procedures [organization-defined frequency] and following [organization-defined events].

CP-2 – Contingency Plan#

• a. Develop a contingency plan for the system that:
  • 1. Identifies essential mission and business functions and associated contingency requirements;
  • 2. Provides recovery objectives, restoration priorities, and metrics;
  • 3. Addresses contingency roles, responsibilities, assigned individuals with contact information;
  • 4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
  • 5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;
  • 6. Addresses the sharing of contingency information; and
  • 7. Is reviewed and approved by [organization-defined personnel or roles];
• b. Distribute copies of the contingency plan to [organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
• c. Coordinate contingency planning activities with incident handling activities;
• d. Review the contingency plan for the system [organization-defined frequency];
• e. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
• f. Communicate contingency plan changes to [organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
• g. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and
• h. Protect the contingency plan from unauthorized disclosure and modification.

CP-2(1) – Coordinate with Related Plans

Coordinate contingency plan development with organizational elements responsible for related plans.

CP-2(3) – Resume Mission and Business Functions

Plan for the resumption of [all or essential] mission and business functions within [organization-defined time period] of contingency plan activation.

CP-2(8) – Identify Critical Assets

Identify critical system assets supporting [all or essential] mission and business functions.

CP-3 – Contingency Training#

• a. Provide contingency training to system users consistent with assigned roles and responsibilities:
  • 1. Within [organization-defined time period] of assuming a contingency role or responsibility;
  • 2. When required by system changes; and
  • 3. [organization-defined frequency] thereafter; and
• b. Review and update contingency training content [organization-defined frequency] and following [organization-defined events].

CP-4 – Contingency Plan Testing#

• a. Test the contingency plan for the system [organization-defined frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [organization-defined tests].
• b. Review the contingency plan test results; and
• c. Initiate corrective actions, if needed.

CP-4(1) – Coordinate with Related Plans

Coordinate contingency plan testing with organizational elements responsible for related plans.

CP-6 – Alternate Storage Site#

• a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and
• b. Ensure that the alternate storage site provides controls equivalent to that of the primary site.

CP-6(1) – Separation from Primary Site

Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.

CP-6(3) – Accessibility

Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions.

CP-7 – Alternate Processing Site#

• a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [organization-defined system operations] for essential mission and business functions within [organization-defined time period] when the primary processing capabilities are unavailable;
• b. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and
• c. Provide controls at the alternate processing site that are equivalent to those at the primary site.

CP-7(1) – Separation from Primary Site

Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.

CP-7(2) – Accessibility

Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.

CP-7(3) – Priority of Service

Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).

CP-8 – Telecommunications Services#

Establish alternate telecommunications services, including necessary agreements to permit the resumption of [organization-defined system operations] for essential mission and business functions within [organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

CP-8(1) – Priority of Service Provisions

• (a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and
• (b) Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.

CP-8(2) – Single Points of Failure

Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.

CP-9 – System Backup#

• a. Conduct backups of user-level information contained in [organization-defined system components][organization-defined frequency];
• b. Conduct backups of system-level information contained in the system [organization-defined frequency];
• c. Conduct backups of system documentation, including security- and privacy-related documentation [organization-defined frequency] ; and
• d. Protect the confidentiality, integrity, and availability of backup information.

CP-9(1) – Testing for Reliability and Integrity

Test backup information [organization-defined frequency] to verify media reliability and information integrity.

CP-9(8) – Cryptographic Protection

Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [organization-defined backup information].

CP-10 – System Recovery and Reconstitution#

Provide for the recovery and reconstitution of the system to a known state within [organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.

CP-10(2) – Transaction Recovery

Implement transaction recovery for systems that are transaction-based.

National Institute of Standards and Technology, OSCAL release 5.2.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.