CP-1 Policy and procedures
Contingency planning policy and procedures: documenting, distributing, owning and periodically reviewing the policy and procedures behind contingency plans, backups and recovery.
CP Contingency planning
Contingency planning (CP) family of NIST SP 800-53 Rev. 5: contingency plans, training and testing, alternate storage and processing sites, telecommunications, system backup, and recovery and reconstitution.
CP-2 Contingency plan
The system contingency plan: essential functions, recovery objectives and priorities, roles and contacts, continuity and full restoration, distribution, coordination with incident handling, review, updates and protection of the plan.
CP-3 Contingency training
Contingency training for users with contingency roles, within a defined time of taking the role, after system changes and periodically, plus simulated events and training mechanisms enhancements.
CP-4 Contingency plan testing
Testing the contingency plan at a defined frequency with defined tests, reviewing results and correcting problems, plus enhancements for coordinated testing, alternate site testing, full recovery and automated testing.
CP-6 Alternate storage site
Establishing an alternate storage site with agreements for storing and retrieving backup information and controls equivalent to the primary site, plus separation, recovery objective and accessibility enhancements.
CP-7 Alternate processing site
Establishing an alternate processing site to resume essential operations within a defined time when primary processing is unavailable, with equipment, supplies or contracts in place and equivalent controls.
CP-8 Telecommunications services
Alternate telecommunications services to resume essential operations within a defined time when primary services fail at primary or alternate sites, plus enhancements on priority of service, single points of failure and provider separation.
CP-9 System backup
System backup of user-level information, system-level information and system documentation at defined frequencies, protecting backup confidentiality, integrity and availability, plus enhancements for backup testing, restore sampling and cryptographic protection.
CP-10 System recovery and reconstitution
Recovering and reconstituting the system to a known state within a time consistent with recovery time and recovery point objectives after a disruption, compromise or failure, plus transaction recovery and restore-within-time enhancements.
CP-11 Alternate communications protocols
Being able to switch to defined alternative communications protocols to maintain continuity of operations, a resilience control outside the SP 800-53B baselines.
CP-12 Safe mode
Entering a safe mode of operation with defined restrictions when defined conditions are detected, aimed at systems supporting critical functions such as real-time operations; not in any SP 800-53B baseline.
CP-13 Alternative security mechanisms
Using alternative or supplemental security mechanisms to perform defined security functions when the primary means is unavailable or compromised; not in any SP 800-53B baseline.
