View source for Doc:NIST SP 800-53Ar1 FPD Appendix F/Enhanced/CP

{| align="right"
| __TOC__
|}

<font size="6">SP 800-53Ar1 FPD Assessment Procedure Catalog, with SP 800-53r3 Security Controls</font>


== CONTINGENCY PLANNING ==


=== CP-1 ===

{{80053Ar1FPDFamilyClass
| Family=CONTINGENCY PLANNING
| Class=OPERATIONAL
}}


{{80053Ar1FPDControlText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-1
}}


{{80053Ar1FPDControl
| CNumber=CP-1
| CName=CONTINGENCY PLANNING POLICY AND PROCEDURES
| CAPNumber=CP-1.1
| CAPAOText=Determine if:

:(i) the organization develops and formally documents [[Term:Contingency Planning|contingency planning]] policy;
:(ii) the organization [[Term:Contingency Planning|contingency planning]] policy addresses:
:* purpose;
:* scope;
:* [[Term:Roles and Responsibilities|roles and responsibilities]];
:* management commitment;
:* [[Term:Coordination|coordination]] among organizational entities; and
:* compliance;
:(iii) the organization disseminates formal documented [[Term:Contingency Planning|contingency planning]] policy to elements within the organization having associated [[Term:Contingency Planning|contingency planning]] [[Term:Roles and Responsibilities|roles and responsibilities]];
:(iv) the organization develops and formally documents [[Term:Contingency Planning|contingency planning]] procedures;
:(v) the organization [[Term:Contingency Planning|contingency planning]] procedures facilitate implementation of the [[Term:Contingency Planning|contingency planning]] policy and associated [[Term:Contingency Planning|contingency planning]] controls; and
:(vi) the organization disseminates formal documented [[Term:Contingency Planning|contingency planning]] procedures to elements within the organization having associated [[Term:Contingency Planning|contingency planning]] [[Term:Roles and Responsibilities|roles and responsibilities]].
| CAPPAMOEText=Contingency planning policy and procedures; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] responsibilities
| CAPNumber02=CP-1.2
| CAPAOText02=Determine if:

:(i) the organization defines the frequency of [[Term:Contingency Planning|contingency planning]] policy reviews/updates;
:(ii) the organization reviews/updates [[Term:Contingency Planning|contingency planning]] policy in accordance with organization-defined frequency;
:(iii) the organization defines the frequency of [[Term:Contingency Planning|contingency planning]] procedure reviews/updates; and
:(iv) the organization reviews/updates [[Term:Contingency Planning|contingency planning]] procedures in accordance with organization-defined frequency.
| CAPPAMOEText02=Contingency planning policy and procedures; other relevant documents or records
| CAPPAMOIText02=Organizational personnel with [[Term:Contingency Planning|contingency planning]] responsibilities
}}



=== CP-2 ===

{{80053Ar1FPDFamilyClass
| Family=CONTINGENCY PLANNING
| Class=OPERATIONAL
}}


{{80053Ar1FPDControlText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-2
}}


{{80053Ar1FPDControl
| CNumber=CP-2
| CName=CONTINGENCY PLAN
| CAPNumber=CP-2.1
| CAPAOText=Determine if:

:(i) the organization develops a [[Term:Contingency Plan|contingency plan]] for the information system that:
:* identifies essential missions and business functions and associated [[Term:Contingency|contingency]] requirements;
:* provides recovery objectives, restoration priorities, and metrics;
:* addresses [[Term:Contingency|contingency]] roles, responsibilities, assigned individuals with contact information;
:* addresses maintaining essential missions and business functions despite an information system [[Term:Disruption|disruption]], [[Term:Compromise|compromise]], or failure; and
:* addresses eventual, full information system restoration without deterioration of the [[Term:Security Measures|security measures]] originally planned and implemented; and
:* is reviewed and approved by designated officials within the organization;
:(ii) the organization defines key [[Term:Contingency|contingency]] personnel (identified by name and/or by role) and organizational elements designated to receive copies of the [[Term:Contingency Plan|contingency plan]]; and
:(iii) the organization distributes copies of the [[Term:Contingency Plan|contingency plan]] to organization-defined key [[Term:Contingency|contingency]] personnel and organizational elements.
| CAPPAMOEText=Contingency planning policy; procedures addressing [[Term:Contingency|contingency]] operations for the information system; [[Term:Contingency Plan|contingency plan]]; [[Term:Security Plan|security plan]]; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities
| CAPNumber02=CP-2.2
| CAPAOText02=Determine if:

:(i) the organization coordinates [[Term:Contingency Planning|contingency planning]] activities with [[Term:Incident Handling|incident handling]] activities:
:(ii) the organization defines the frequency of [[Term:Contingency Plan|contingency plan]] reviews;
:(iii) the organization reviews the [[Term:Contingency Plan|contingency plan]] for the information system in accordance with the organization-defined frequency;
:(iv) the organization revises the [[Term:Contingency Plan|contingency plan]] to address changes to the organization, information system, or environment of operation and problems encountered during [[Term:Contingency Plan|contingency plan]] implementation, execution or testing; and
:(v) the organization communicates [[Term:Contingency Plan|contingency plan]] changes to the key [[Term:Contingency|contingency]] personnel and organizational elements as identified in CP-2.1 (ii).
| CAPPAMOEText02=Contingency planning policy; procedures addressing [[Term:Contingency|contingency]] operations for the information system; [[Term:Contingency Plan|contingency plan]]; [[Term:Security Plan|security plan]]; other relevant documents or records
| CAPPAMOIText02=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities; organizational personnel with [[Term:Incident Handling|incident handling]] responsibilities
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-2/1
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-2(1)

| CName=CONTINGENCY PLAN
| CAPNumber=CP-2(1).1
| CAPAOText=Determine if the organization coordinates the [[Term:Contingency Plan|contingency plan]] development with other organizational elements responsible for related plans.

| CAPPAMOEText=Contingency planning policy; procedures addressing [[Term:Contingency|contingency]] operations for the information system; [[Term:Contingency Plan|contingency plan]]; other related plans; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities and responsibilities in related plan areas
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-2/2
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-2(2)

| CName=CONTINGENCY PLAN
| CAPNumber=CP-2(2).1
| CAPAOText=Determine if the organization conducts capacity planning so that necessary capacity for information [[Term:Processing|processing]], telecommunications, and environmental support exists during [[Term:Contingency|contingency]] operations.
| CAPPAMOEText=Contingency planning policy; procedures addressing [[Term:Contingency|contingency]] operations for the information system; [[Term:Contingency Plan|contingency plan]]; capacity planning documents; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-2/3
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-2(3)

| CName=CONTINGENCY PLAN
| CAPNumber=CP-2(3).1
| CAPAOText=Determine if:

:(i) the organization defines the time period for planning the resumption of essential missions and business functions as a result of [[Term:Contingency Plan|contingency plan]] activation; and
:(ii) the organization plans for the resumption of essential missions and business function within organization-defined time period of [[Term:Contingency Plan|contingency plan]] activation.
| CAPPAMOEText=Contingency planning policy; procedures addressing [[Term:Contingency|contingency]] operations for the information system; [[Term:Contingency Plan|contingency plan]]; [[Term:Security Plan|security plan]]; business impact assessment; other related plans; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-2/4
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-2(4)

| CName=CONTINGENCY PLAN
| CAPNumber=CP-2(4).1
| CAPAOText=Determine if:

:(i) the organization defines the time period for planning the full resumption of affected missions and business functions as a result of [[Term:Contingency Plan|contingency plan]] activation; and
:(ii) the organization plans for the full resumption of affected missions and business functions within organization-defined time period of [[Term:Contingency Plan|contingency plan]] activation.
| CAPPAMOEText=Contingency planning policy; procedures addressing [[Term:Contingency|contingency]] operations for the information system; [[Term:Contingency Plan|contingency plan]]; [[Term:Security Plan|security plan]]; business impact assessment; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-2/5
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-2(5)

| CName=CONTINGENCY PLAN
| CAPNumber=CP-2(5).1
| CAPAOText=Determine if:

:(i) the organization plans for the continuance of essential missions and business functions with little or no loss of operational continuity; and
:(ii) the organization sustains operational continuity until full information system restoration at primary [[Term:Processing|processing]] and/or storage sites.
| CAPPAMOEText=Contingency planning policy; procedures addressing [[Term:Contingency|contingency]] operations for the information system; [[Term:Contingency Plan|contingency plan]]; business impact assessment; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-2/6
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-2(6)

| CName=CONTINGENCY PLAN
| CAPNumber=CP-2(6).1
| CAPAOText=Determine if:

:(i) the organization provides for the transfer of all essential missions and business functions to [[Term:Alternate|alternate]] [[Term:Processing|processing]] and/or storage sites with little or no loss of operational continuity; and
:(ii) the organization sustains operational continuity through restoration to primary [[Term:Processing|processing]] and/or storage sites.
| CAPPAMOEText=Contingency planning policy; procedures addressing [[Term:Contingency|contingency]] operations for the information system; [[Term:Contingency Plan|contingency plan]]; [[Term:Alternate|alternate]] [[Term:Processing|processing]] site agreements; [[Term:Alternate|alternate]] storage site agreements; [[Term:Contingency Plan|contingency plan]] testing and/or exercise documentation; [[Term:Contingency Plan|contingency plan]] test results; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities
}}



=== CP-3 ===

{{80053Ar1FPDFamilyClass
| Family=CONTINGENCY PLANNING
| Class=OPERATIONAL
}}


{{80053Ar1FPDControlText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-3
}}


{{80053Ar1FPDControl
| CNumber=CP-3
| CName=CONTINGENCY TRAINING
| CAPNumber=CP-3.1
| CAPAOText=Determine if:

:(i) the organization provides initial [[Term:Contingency|contingency]] training to personnel with [[Term:Contingency|contingency]] [[Term:Roles and Responsibilities|roles and responsibilities]] with respect to the information system;
:(ii) the organization defines the frequency of refresher [[Term:Contingency|contingency]] training; and
:(iii) the organization provides refresher training in accordance with organization-defined frequency.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Contingency|contingency]] training; [[Term:Contingency|contingency]] training curriculum; [[Term:Contingency|contingency]] training [[Term:Material|material]]; [[Term:Security Plan|security plan]]; [[Term:Contingency|contingency]] training records; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]], plan implementation, and training responsibilities
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-3/1
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-3(1)

| CName=CONTINGENCY TRAINING
| CAPNumber=CP-3(1).1
| CAPAOText=Determine if:

:(i) the organization incorporates simulated events into [[Term:Contingency|contingency]] training; and
:(ii) the incorporation of simulated events into [[Term:Contingency|contingency]] training facilitates effective response by personnel in crisis situations.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Contingency|contingency]] training; [[Term:Contingency|contingency]] training curriculum; [[Term:Contingency|contingency]] training [[Term:Material|material]]; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]], plan implementation, and training responsibilities
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-3/2
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-3(2)

| CName=CONTINGENCY TRAINING
| CAPNumber=CP-3(2).1
| CAPAOText=Determine if the organization employs automated mechanisms that provide a more thorough and realistic [[Term:Contingency|contingency]] training environment.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Contingency|contingency]] training; automated mechanisms supporting [[Term:Contingency|contingency]] training; [[Term:Contingency|contingency]] training curriculum; [[Term:Contingency|contingency]] training [[Term:Material|material]]; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]], plan implementation, and training responsibilities
}}



=== CP-4 ===

{{80053Ar1FPDFamilyClass
| Family=CONTINGENCY PLANNING
| Class=OPERATIONAL
}}


{{80053Ar1FPDControlText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-4
}}


{{80053Ar1FPDControl
| CNumber=CP-4
| CName=CONTINGENCY PLAN TESTING AND EXERCISES
| CAPNumber=CP-4.1
| CAPAOText=Determine if:

:(i) the organization defines the [[Term:Contingency Plan|contingency plan]] tests and/or exercises to be conducted;
:(ii) the organization defines the frequency of [[Term:Contingency Plan|contingency plan]] tests and/or exercises;
:(iii) the organization tests/exercises the [[Term:Contingency Plan|contingency plan]] using organization-defined tests/exercises in accordance with organization-defined frequency; and
:(iv) the organization reviews the [[Term:Contingency Plan|contingency plan]] test/exercise results and takes corrective actions.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]], procedures addressing [[Term:Contingency Plan|contingency plan]] testing and exercises; [[Term:Security Plan|security plan]]; [[Term:Contingency Plan|contingency plan]] testing and/or exercise documentation; other relevant documents or records
| CAPPAMOIText=Organizational personnel with responsibilities for reviewing or responding to [[Term:Contingency Plan|contingency plan]] tests/exercises
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-4/1
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-4(1)

| CName=CONTINGENCY PLAN TESTING AND EXERCISES
| CAPNumber=CP-4(1).1
| CAPAOText=Determine if the organization coordinates [[Term:Contingency Plan|contingency plan]] testing and/or exercises with organizational elements responsible for related plans.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Contingency Plan|contingency plan]] testing and exercises; [[Term:Contingency Plan|contingency plan]] testing and/or exercise documentation; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]], plan implementation, and testing responsibilities; organizational personnel with responsibilities for related plans
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-4/2
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-4(2)

| CName=CONTINGENCY PLAN TESTING AND EXERCISES
| CAPNumber=CP-4(2).1
| CAPAOText=Determine if the organization conducts [[Term:Contingency Plan|contingency plan]] testing/exercises at the [[Term:Alternate|alternate]] [[Term:Processing|processing]] site to familiarize [[Term:Contingency|contingency]] personnel with the [[Term:Facility|facility]] and available resources and to evaluate the site's capabilities to support [[Term:Contingency|contingency]] operations.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]], procedures addressing [[Term:Contingency Plan|contingency plan]] testing and exercises; [[Term:Contingency Plan|contingency plan]] testing and/or exercise documentation; [[Term:Contingency Plan|contingency plan]] test results; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-4/3
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-4(3)

| CName=CONTINGENCY PLAN TESTING AND EXERCISES
| CAPNumber=CP-4(3).1
| CAPAOText=Determine if the organization employs automated mechanisms to more thoroughly and effectively test/exercise the [[Term:Contingency Plan|contingency plan]] by providing more complete [[Term:Coverage|coverage]] of [[Term:Contingency|contingency]] issues, selecting more realistic test/exercise scenarios and environments, and more effectively stressing the information system and supported missions.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Contingency Plan|contingency plan]] testing and exercises; automated mechanisms supporting [[Term:Contingency Plan|contingency plan]] testing/exercises; [[Term:Contingency Plan|contingency plan]] testing and/or exercise documentation; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-4/4
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-4(4)

| CName=CONTINGENCY PLAN TESTING AND EXERCISES
| CAPNumber=CP-4(4).1
| CAPAOText=Determine if the organization includes a full recovery and reconstitution of the information system to a known state as part of [[Term:Contingency Plan|contingency plan]] testing.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system recovery and reconstitution; [[Term:Contingency Plan|contingency plan]] testing and/or exercise documentation; [[Term:Contingency Plan|contingency plan]] test results; other relevant documents or records
| CAPPAMOIText=Organizational personnel with information system recovery and reconstitution responsibilities; organizational personnel with [[Term:Contingency Plan|contingency plan]] testing and/or exercise responsibilities
}}



{{80053Ar1FPDFamilyClass
| Family=CONTINGENCY PLANNING
| Class=OPERATIONAL
}}


{{80053Ar1FPDControlW
| CNumber=CP-5
| CName=CONTINGENCY PLAN UPDATE
| CAPNumber=CP-5.1
| CAPWText=Incorporated into CP-2
| CAPNumber02=CP-5.2
| CAPWText02=Incorporated into CP-2
}}



=== CP-6 ===

{{80053Ar1FPDFamilyClass
| Family=CONTINGENCY PLANNING
| Class=OPERATIONAL
}}


{{80053Ar1FPDControlText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-6
}}


{{80053Ar1FPDControl
| CNumber=CP-6
| CName=ALTERNATE STORAGE SITE
| CAPNumber=CP-6.1
| CAPAOText=Determine if :
:(i) the organization establishes an [[Term:Alternate|alternate]] storage site; and
:(ii) the organization initiates necessary [[Term:Alternate|alternate]] storage site agreements to permit the storage and recovery of information system backup information.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] storage sites; [[Term:Alternate|alternate]] storage site agreements; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-6/1
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-6(1)

| CName=ALTERNATE STORAGE SITE
| CAPNumber=CP-6(1).1
| CAPAOText=Determine if:

:(i) the [[Term:Contingency Plan|contingency plan]] identifies the primary storage site hazards; and
:(ii) the [[Term:Alternate|alternate]] storage site is separated from the primary storage site so as not to be susceptible to the same hazards identified at the primary site.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] storage sites; [[Term:Alternate|alternate]] storage site; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-6/2
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-6(2)

| CName=ALTERNATE STORAGE SITE
| CAPNumber=CP-6(2).1
| CAPAOText=Determine if the [[Term:Alternate|alternate]] storage site is configured to facilitate recovery operations in accordance with recovery time objectives and recovery point objectives.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] storage sites; [[Term:Alternate|alternate]] storage site agreements; [[Term:Alternate|alternate]] storage site; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-6/3
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-6(3)

| CName=ALTERNATE STORAGE SITE
| CAPNumber=CP-6(3).1
| CAPAOText=Determine if:

:(i) the organization identifies potential accessibility problems to the [[Term:Alternate|alternate]] storage site in the event of an area-wide [[Term:Disruption|disruption]] or disaster; and
:(ii) the organization outlines explicit mitigation actions for organization identified accessibility problems to the [[Term:Alternate|alternate]] storage site in the event of an area-wide [[Term:Disruption|disruption]] or disaster.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] storage sites; [[Term:Alternate|alternate]] storage site; mitigation actions for accessibility problems to the [[Term:Alternate|alternate]] storage site; other relevant documents or records
}}



=== CP-7 ===

{{80053Ar1FPDFamilyClass
| Family=CONTINGENCY PLANNING
| Class=OPERATIONAL
}}


{{80053Ar1FPDControlText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-7
}}


{{80053Ar1FPDControl
| CNumber=CP-7
| CName=ALTERNATE PROCESSING SITE
| CAPNumber=CP-7.1
| CAPAOText=Determine if:

:(i) the organization establishes an [[Term:Alternate|alternate]] [[Term:Processing|processing]] site;
:(ii) the organization defines the time period for achieving the recovery time objectives within which [[Term:Processing|processing]] must be resumed at the [[Term:Alternate|alternate]] [[Term:Processing|processing]] site;
:(iii) the organization includes necessary [[Term:Alternate|alternate]] [[Term:Processing|processing]] site agreements to permit the resumption of information system operations for essential missions and business functions within organization-defined time period; and
:(iv) the equipment and [[Term:Supplies|supplies]] required to resume operations are available at the [[Term:Alternate|alternate]] site or contracts are in place to support delivery to the site in time to support the organization-defined time period for resumption.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] [[Term:Processing|processing]] sites; [[Term:Alternate|alternate]] [[Term:Processing|processing]] site agreements; [[Term:Security Plan|security plan]]; spare equipment and [[Term:Supplies|supplies]] at [[Term:Alternate|alternate]] [[Term:Processing|processing]] site; equipment and supply contracts; service level agreements; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-7/1
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-7(1)

| CName=ALTERNATE PROCESSING SITE
| CAPNumber=CP-7(1).1
| CAPAOText=Determine if:

:(i) the [[Term:Contingency Plan|contingency plan]] identifies the primary [[Term:Processing|processing]] site hazards; and
:(ii) the [[Term:Alternate|alternate]] [[Term:Processing|processing]] site is separated from the primary [[Term:Processing|processing]] site so as not to be susceptible to the same hazards identified at the primary site.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] [[Term:Processing|processing]] sites; [[Term:Alternate|alternate]] [[Term:Processing|processing]] site; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-7/2
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-7(2)

| CName=ALTERNATE PROCESSING SITE
| CAPNumber=CP-7(2).1
| CAPAOText=Determine if:

:(i) the organization identifies potential accessibility problems to the [[Term:Alternate|alternate]] [[Term:Processing|processing]] site in the event of an area-wide [[Term:Disruption|disruption]] or disaster; and
:(ii) the organization outlines explicit mitigation actions for organization identified accessibility problems to the [[Term:Alternate|alternate]] [[Term:Processing|processing]] site in the event of an area-wide [[Term:Disruption|disruption]] or disaster.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] [[Term:Processing|processing]] sites; [[Term:Alternate|alternate]] [[Term:Processing|processing]] site; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-7/3
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-7(3)

| CName=ALTERNATE PROCESSING SITE
| CAPNumber=CP-7(3).1
| CAPAOText=Determine if the organization develops [[Term:Alternate|alternate]] [[Term:Processing|processing]] site agreements that contain priority-of-service provisions in accordance with the organization's availability requirements.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] [[Term:Processing|processing]] sites; [[Term:Alternate|alternate]] [[Term:Processing|processing]] site agreements; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-7/4
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-7(4)

| CName=ALTERNATE PROCESSING SITE
| CAPNumber=CP-7(4).1
| CAPAOText=Determine if the [[Term:Alternate|alternate]] [[Term:Processing|processing]] site is configured so that it is ready to be used as the operational site to support essential missions and business functions.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] [[Term:Processing|processing]] sites; [[Term:Alternate|alternate]] [[Term:Processing|processing]] site; [[Term:Alternate|alternate]] [[Term:Processing|processing]] site agreements; other relevant documents or records
| CAPPAMOTText=Information system at the [[Term:Alternate|alternate]] [[Term:Processing|processing]] site
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-7/5
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-7(5)

| CName=ALTERNATE PROCESSING SITE
| CAPNumber=CP-7(5).1
| CAPAOText=Determine if the [[Term:Alternate|alternate]] [[Term:Processing|processing]] site provides information [[Term:Security Measures|security measures]] equivalent to that of the primary site.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] [[Term:Processing|processing]] sites; [[Term:Alternate|alternate]] [[Term:Processing|processing]] site; other relevant documents or records
}}



=== CP-8 ===

{{80053Ar1FPDFamilyClass
| Family=CONTINGENCY PLANNING
| Class=OPERATIONAL
}}


{{80053Ar1FPDControlText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-8
}}


{{80053Ar1FPDControl
| CNumber=CP-8
| CName=TELECOMMUNICATIONS SERVICES
| CAPNumber=CP-8.1
| CAPAOText=Determine if:

:(i) the organization establishes [[Term:Alternate|alternate]] telecommunications services to support the information system;
:(ii) the organization defines in the time period within which resumption of information system operations must take place; and
:(iii) the organization establishes necessary [[Term:Alternate|alternate]] telecommunications service agreements to permit the resumption of telecommunications services for essential missions and business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] telecommunications services; [[Term:Security Plan|security plan]]; primary and [[Term:Alternate|alternate]] telecommunications service agreements; list of essential missions and business functions; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-8/1
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-8(1)

| CName=TELECOMMUNICATIONS SERVICES
| CAPNumber=CP-8(1).1
| CAPAOText=Determine if:

:(i) the organization develops primary and [[Term:Alternate|alternate]] telecommunications service agreements that contain priority-of-service provisions in accordance with organizational availability requirements; and
:(ii) the organization requests Telecommunications Service Priority for all telecommunications services used for [[Term:National Security|national security]] emergency preparedness in the event that the primary and/or [[Term:Alternate|alternate]] telecommunications services are provided by a [[Term:Common Carrier|common carrier]].
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] telecommunications services; primary and [[Term:Alternate|alternate]] telecommunications service agreements; Telecommunications Service Priority documentation; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-8/2
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-8(2)

| CName=TELECOMMUNICATIONS SERVICES
| CAPNumber=CP-8(2).1
| CAPAOText=Determine if the organization obtains [[Term:Alternate|alternate]] telecommunications services with consideration for reducing the likelihood of sharing a single point of failure with primary telecommunications services.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] telecommunications services; primary and [[Term:Alternate|alternate]] telecommunications service agreements; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities; telecommunications service providers
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-8/3
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-8(3)

| CName=TELECOMMUNICATIONS SERVICES
| CAPNumber=CP-8(3).1
| CAPAOText=Determine if:

:(i) the organization identifies the primary provider's telecommunications service hazards; and
:(ii) the [[Term:Alternate|alternate]] telecommunications service providers are separated from the primary telecommunications service providers so as not to be susceptible to the same hazards.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] telecommunications services; primary and [[Term:Alternate|alternate]] telecommunications service agreements; [[Term:Alternate|alternate]] telecommunications service provider's site; primary telecommunications service provider's site; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities; telecommunications service providers
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-8/4
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-8(4)

| CName=TELECOMMUNICATIONS SERVICES
| CAPNumber=CP-8(4).1
| CAPAOText=Determine if the organization requires primary and [[Term:Alternate|alternate]] telecommunications service providers to have [[Term:Contingency|contingency]] plans.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing [[Term:Alternate|alternate]] telecommunications services; primary and [[Term:Alternate|alternate]] telecommunications service agreements; other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]], plan implementation, and testing responsibilities; telecommunications service providers
}}



=== CP-9 ===

{{80053Ar1FPDFamilyClass
| Family=CONTINGENCY PLANNING
| Class=OPERATIONAL
}}


{{80053Ar1FPDControlText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-9
}}


{{80053Ar1FPDControl
| CNumber=CP-9
| CName=INFORMATION SYSTEM BACKUP
| CAPNumber=CP-9.1
| CAPAOText=Determine if:

:(i) the organization defines the frequency of conducting user-level information backups to support recovery time objectives and recovery point objectives;
:(ii) the organization defines the frequency of conducting system-level information backups to support recovery time objectives and recovery point objectives;
:(iii) the organization defines the frequency of conducting information system documentation backups (including security-related information) to support recovery time objectives and recovery point objectives;
:(iv) the organization backs up user-level information in accordance with the organization-defined frequency;
:(v) the organization backs up system-level information in accordance with the organization-defined frequency; and
:(vi) the organization backs up information system documentation in accordance with the organization-defined frequency.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system backup; [[Term:Security Plan|security plan]]; backup storage location(s); information system backup logs or records; other relevant documents or records
| CAPPAMOIText=Organizational personnel with information system backup responsibilities
| CAPNumber02=CP-9.2
| CAPAOText02=Determine if the organization protects the confidentiality and integrity of backup information at the storage location.
| CAPPAMOEText02=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system backup; information system design documentation; information system [[Term:Configuration Settings|configuration settings]] and associated documentation; backup storage location(s); other relevant documents or records
| CAPPAMOIText02=Organizational personnel with information system backup responsibilities
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-9/1
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-9(1)

| CName=INFORMATION SYSTEM BACKUP
| CAPNumber=CP-9(1).1
| CAPAOText=Determine if:

:(i) the organization defines the frequency of information system backup testing; and
:(ii) the organization conducts information system backup testing in accordance with organization-defined frequency to verify backup media [[Term:Reliability|reliability]] and [[Term:Information Integrity|information integrity]].
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system backup; [[Term:Security Plan|security plan]]; information system backup test results; backup storage location(s); other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-9/2
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-9(2)

| CName=INFORMATION SYSTEM BACKUP
| CAPNumber=CP-9(2).1
| CAPAOText=Determine if the organization uses a sample of backup information in the restoration of selected information system functions as part of [[Term:Contingency Plan|contingency plan]] testing.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system backup; information system backup test results; [[Term:Contingency Plan|contingency plan]] testing and/or exercise documentation; [[Term:Contingency Plan|contingency plan]] test results; other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-9/3
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-9(3)

| CName=INFORMATION SYSTEM BACKUP
| CAPNumber=CP-9(3).1
| CAPAOText=Determine if the organization stores backup copies of operating system and other [[Term:Critical Information|critical information]] [[Term:System Software|system software]], as well as copies of the information system [[Term:Inventory|inventory]] (including hardware, software, and [[Term:Firmware|firmware]] components) in a separate [[Term:Facility|facility]] or in a fire-rated [[Term:Container|container]] that is not collocated with the operational system.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system backup; backup storage location(s); other relevant documents or records
| CAPPAMOIText=Organizational personnel with [[Term:Contingency Planning|contingency planning]] and plan implementation responsibilities; organizational personnel with information system backup responsibilities
}}


{{80053Ar1FPDCEnhancementW
| CNEnhancement=CP-9(4)
| CName=INFORMATION SYSTEM BACKUP
| CAPNumber=CP-9(4).1
| CAPWText=Incorporated into CP-9
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-9/5
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-9(5)

| CName=INFORMATION SYSTEM BACKUP
| CAPNumber=CP-9(5).1
| CAPAOText=Determine if:

:(i) the organization defines the time period and rate of transferring information system backup information to the [[Term:Alternate|alternate]] storage site to support recovery time objectives and recovery point objectives; and
:(ii) the organization transfers information system backup information to the [[Term:Alternate|alternate]] storage site in accordance with the organization-defined frequency and transfer rate.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system backup; [[Term:Security Plan|security plan]]; information system backup test results; [[Term:Alternate|alternate]] site service agreements; backup storage location(s); other relevant documents or records
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-9/6
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-9(6)

| CName=INFORMATION SYSTEM BACKUP
| CAPNumber=CP-9(6).1
| CAPAOText=Determine if:

:(i) the organization maintains a redundant, secondary backup system that is not collocated with the primary backup system for the information system; and
:(ii) the redundant, secondary backup system can be activated to accomplish information system backups without causing loss of information or [[Term:Disruption|disruption]] to the operation.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system backup; information system backup test results; [[Term:Contingency Plan|contingency plan]] test results; [[Term:Contingency Plan|contingency plan]] testing and/or exercise documentation; secondary backup storage location(s); redundant secondary system for information system backups; other relevant documents or records
}}



=== CP-10 ===

{{80053Ar1FPDFamilyClass
| Family=CONTINGENCY PLANNING
| Class=OPERATIONAL
}}


{{80053Ar1FPDControlText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-10
}}


{{80053Ar1FPDControl
| CNumber=CP-10
| CName=INFORMATION SYSTEM RECOVERY AND RECONSTITUTION
| CAPNumber=CP-10.1
| CAPAOText=Determine if the organization provides automated mechanisms and/or manual procedures for the recovery and reconstitution of the information system to known state after a [[Term:Disruption|disruption]], [[Term:Compromise|compromise]], or failure.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system recovery and reconstitution; information system [[Term:Configuration Settings|configuration settings]] and associated documentation; information system design documentation; other relevant documents or records
| CAPPAMOTText=Automated mechanisms and/or manual procedures for implementing information system recovery and reconstitution operations
}}


{{80053Ar1FPDCEnhancementW
| CNEnhancement=CP-10(1)
| CName=INFORMATION SYSTEM RECOVERY AND RECONSTITUTION
| CAPNumber=CP-10(1).1
| CAPWText=Incorporated into CP-4(4)
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-10/2
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-10(2)

| CName=INFORMATION SYSTEM RECOVERY AND RECONSTITUTION
| CAPNumber=CP-10(2).1
| CAPAOText=Determine if the information system implements [[Term:Transaction|transaction]] recovery for systems that are [[Term:Transaction|transaction]]-based.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system recovery and reconstitution; information system design documentation; information system [[Term:Configuration Settings|configuration settings]] and associated documentation; [[Term:Contingency Plan|contingency plan]] test results; other relevant documents or records
| CAPPAMOTText=Automated mechanisms implementing [[Term:Transaction|transaction]] recovery capability
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-10/3
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-10(3)

| CName=INFORMATION SYSTEM RECOVERY AND RECONSTITUTION
| CAPNumber=CP-10(3).1
| CAPAOText=Determine if:

:(i) the organization defines in the [[Term:Security Plan|security plan]], explicitly or by [[Term:Reference|reference]], the circumstances that can inhibit recovery and reconstitution of the information system to a known state; and
:(ii) the organization provides [[Term:Compensating Security Controls|compensating security controls]] for organization-defined circumstances that can inhibit recovery and reconstitution of the information system to a known state.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system recovery and reconstitution; [[Term:Contingency Plan|contingency plan]] test procedures; [[Term:Security Plan|security plan]]; other relevant documents or records
| CAPPAMOIText=Organizational personnel with information system recovery and reconstitution responsibilities
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-10/4
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-10(4)

| CName=INFORMATION SYSTEM RECOVERY AND RECONSTITUTION
| CAPNumber=CP-10(4).1
| CAPAOText=Determine if:

:(i) the organization defines the time-periods within which information system components must be reimaged from configuration-controlled and integrity-protected disk images representing a secure, operational state for the components; and
:(ii) the organization provides the capability to reimage information system components, within organization-defined time-periods, from configuration-controlled and integrity-protected disk images representing a secure, operational state for the components.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system recovery and reconstitution; information system design documentation; information system [[Term:Configuration Settings|configuration settings]] and associated documentation; other relevant documents or records
| CAPPAMOIText=Organizational personnel with information system recovery and reconstitution responsibilities
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-10/5
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-10(5)

| CName=INFORMATION SYSTEM RECOVERY AND RECONSTITUTION
| CAPNumber=CP-10(5).1
| CAPAOText=Determine if:

:(i) the organization defines whether [[Term:Real-Time|real-time]] or near-real-time [[Term:Failover|failover]] capability will be provided for the information system;
:(ii) the organization provides the [[Term:Real-Time|real-time]] or near-real-time [[Term:Failover|failover]] capability identified for the information system;
:(iii) the organization defines the type of [[Term:Failover|failover]] capability for the information system; and
:(iv) the organization provides the organization-defined [[Term:Failover|failover]] capability for the information system.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system recovery and reconstitution; [[Term:Security Plan|security plan]]; other relevant documents or records
| CAPPAMOIText=Organizational personnel with information system recovery and reconstitution responsibilities
| CAPPAMOTText=Failover capability for the information system
}}


{{80053Ar1FPDCEnhancementText
| CNumberPage=Doc:NIST SP 800-53r3 Appendix F/CP-10/6
}}


{{80053Ar1FPDCEnhancement
| CNEnhancement=CP-10(6)

| CName=INFORMATION SYSTEM RECOVERY AND RECONSTITUTION
| CAPNumber=CP-10(6).1
| CAPAOText=Determine if the organization protects backup and restoration hardware, [[Term:Firmware|firmware]], and software.
| CAPPAMOEText=Contingency planning policy; [[Term:Contingency Plan|contingency plan]]; procedures addressing information system recovery and reconstitution; location(s) of backup and restoration hardware, [[Term:Firmware|firmware]], and software; other relevant documents or records
| CAPPAMOIText=Organizational personnel with information system recovery and reconstitution responsibilities
}}


== Source ==

:* [http://csrc.nist.gov/publications/drafts/800-53A-rev1/draft-sp800-53A-rev1-fpd.pdf Final Public Draft of NIST SP 800-53A Rev. 1 Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans] (PDF)


[[Category:RMF]]
[[Category:NIST SP 800-53A]]
[[Category:NIST SP 800-53Ar1FPD]]
[[Category:NIST SP 800-53Ar1FPD Enhanced]]