CP-3 Contingency training: requirements and evidence

What CP-3 contingency training requires and why assessors check it

If a moderate or high system is in scope and the audit asks for contingency training evidence, the assessor wants proof that every person with a contingency role has been trained for that role, on a schedule the organization defined itself. CP-3 requires four kinds of trigger: training within a defined period after someone takes a contingency role, training when system changes call for it, and training again at a defined frequency afterward. The organization sets the periods and frequency in its own parameters, so the first job is to write them down and make the plan, the training schedule and the role register agree. CP-3 is selected in the low, moderate and high baselines of SP 800-53B but not in the privacy baseline. Confirm the baseline in your system security plan before you build the evidence set.

The fourth element is the training content itself. The organization must review it at a defined frequency and after defined events, such as a plan revision, a change in recovery objectives or a failed exercise, and update it where needed. Assessors check whether the curriculum matches the current contingency plan, not an older version, so the review date and the revision history should be easy to show. CP-3(1), simulated events, applies only in the high baseline. If your system is high, plan a simulated event that exercises the training as well as the plan, and record what each responder did and what they got wrong.

Assessors check this control because untrained responders are a common reason recovery steps fail or run in the wrong order during a real disruption. An operator who has never restored from the alternate site or invoked the telecommunications fallback will lose time looking up steps, and the plan may not describe the system as it runs today. Ask your team to confirm who holds each contingency role, when they last trained, and which training changes followed the most recent system change. Those answers, together with training records, form the core of what CP-3 evidence looks like.

Which people, systems and third parties CP-3 covers

CP-3 applies only to the people the organization designates as having contingency roles, on the systems inside its selected baseline. Most of the effort comes from deciding who those people are, which systems fall under the control, and how outside providers with recovery duties are brought in. The cards below set out each decision and what it changes.

Plan owners and their named deputies

Plan owners maintain the system contingency plan and usually approve its updates, so they are the first group that CP-3 training applies to. Name a deputy for each plan owner, because a single owner who leaves creates a gap in the training record. Ask whether plan owners are assigned by system, by business service or by facility, since that choice sets how many people enter the training population and how often their roles change.

Recovery engineers and restore operators

Staff who rebuild servers, restore backups and bring systems back to a known state need hands-on training, not only classroom content. Their role list usually grows as new platforms are added, so the effort tracks the number of technology stacks in scope. Confirm which restore steps are performed by named engineers and which are performed by anyone on call, because the second group is harder to keep trained.

Incident commanders and crisis decision makers

People who declare a disruption, activate the plan and direct recovery need training on escalation thresholds, decision authority and coordination with incident handling. Because CP-2 and IR controls rely on the same people, one training design can often cover both families. Confirm who holds activation authority at each hour of the day, since a commander who has never run an exercise is a common gap in assessment interviews.

Alternate-site and telecommunications staff

Staff who operate an alternate processing site, alternate storage or backup telecommunications services hold contingency roles even when they work at another location or for another employer. Their training must cover site access, activation steps and the systems they will run after failover. Check whether these staff sit inside the organization or at a provider, because that answer decides who keeps the training records.

Contractors and managed service providers with recovery duties

A managed service provider that restores systems, runs backups or operates an alternate site holds contingency roles under CP-3, even though it is not an employee. The contract should state which provider staff must complete training, what evidence the provider returns, and how often. Without those terms, the organization can still be assessed on training it did not verify. Ask the provider for training records during contract review, not at assessment time.

Systems and baselines that set the population

CP-3 is selected in the low, moderate and high baselines of SP 800-53B Release 5.2.0 but not in the privacy baseline, and its enhancement CP-3(1), simulated events, is selected only in the high baseline. A system's impact level therefore decides both whether the control applies and whether simulated-event training is required. Confirm the categorization of each system before counting roles, and document any tailoring that adds or removes people from scope.

Defined training periods and triggers

CP-3 requires the organization to define its own periods: how soon after assuming a contingency role training must occur, how often refresher training runs, and which system changes trigger new training. Shorter periods raise the number of training events each year, while longer periods increase the risk that staff have forgotten their steps. Set these values in the plan or policy before the first assessment, and make sure the values match what the training records show.

How an assessor tests CP-3 under SP 800-53A

This table maps the five SP 800-53A determination statements for CP-3 to the examine, interview and test methods an assessor uses, and to the evidence each one usually produces. Read it row by row to see what must exist before an assessment starts and where findings tend to appear.

Assessment element	What the assessor checks	Evidence the assessor expects
Determination: training period defined	Examine the contingency plan and training curriculum for a defined period within which people assuming a contingency role must be trained.	Documented training period in the plan or training standard, and a statement of which roles it applies to.
Determination: training matched to roles	Examine the curriculum and material to confirm content differs by contingency role, such as recovery leads, system administrators and alternate site staff.	Curriculum mapped to role descriptions, with role-specific modules or sections.
Determination: training when changes require it	Interview staff to see how system changes trigger refresher training, then examine change records against training records.	Change tickets linked to training actions, plus dated completion records for affected staff.
Determination: periodic training at a defined frequency	Examine the defined frequency and test whether training records show completion within each cycle for current role holders.	Frequency stated in policy, training attendance or completion logs by person and date.
Determination: content reviewed and updated	Examine the training material for a review date and interview owners on the events that trigger an update, such as plan revisions or lessons from tests.	Version history of training material, review sign-offs, and a link to the plan revision that prompted each update.
Examine method	Review the contingency plan, curriculum, training material and training records for consistency with each other and with the defined parameters.	Current curriculum, material versions, training records with names, roles and dates.
Interview method	Speak with personnel responsible for contingency planning, plan implementation and training to confirm they know the requirement and run it as written.	Named owners, a description of how new role holders are identified, and how the training is delivered and tracked.
Test method	Observe or walk through the organizational process for contingency training, from role assignment to completion record and content update.	Process walkthrough notes, sample role assignments traced to completed training, and records of the process running.
Common finding: undefined training periods	The plan or policy says staff must be trained but leaves the period or frequency as a placeholder.	Parameter values filled in and approved, so the determination statements can be tested.
Common finding: missing records for new role holders	Staff who recently took a contingency role have no training record, or the record is dated after the assessment sample date.	Onboarding checklist that links role assignment to training completion for each new holder.
Common finding: content not updated after plan change	The contingency plan changed but the training material still describes the old recovery steps.	Documented link between each plan revision and a training content review, with dates.

Implementing CP-3 in six steps

This sequence turns the CP-3 requirement into a working training program: roles drawn from the contingency plan, defined training triggers, a curriculum, delivered and recorded training, a review cadence, and an evidence pack an assessor can test. Each step produces a document or record that the next step depends on.

Derive contingency roles from the CP-2 plan
Start with the system contingency plan (CP-2) and list every person or function named in it: plan owners, recovery leads, alternate site staff, communications contacts and anyone who executes recovery or reconstitution steps. Record each role in a role register with the name of the person or team, the plan sections they act on and their backup. The register is done when every role named in the plan appears in it and each entry has a named individual or position. The register is also the scoping document for CP-3, so the assessor will compare it against the plan.
Set the organization-defined periods and triggers
CP-3 leaves the timing to the organization. Decide and document the period within which a newly assigned contingency role holder must complete training, the system changes that require refresher training, and the recurring frequency for training. Ask the system owner and your compliance lead to approve these values in the policy or plan, because the assessor will test the values you chose against the records you keep. The output is a training schedule document with each parameter filled in and approved.
Build a role-based curriculum and simulated events
Write a curriculum that matches each role in the register to the tasks that role performs under the plan, such as invoking the plan, failover steps, restoration sequences and communications. For systems in the high baseline, add simulated events under CP-3(1), such as a scripted outage or a tabletop exercise with a defined injected scenario and expected actions. The output is a curriculum document, training material for each role, and a scenario record that states the objectives, participants and the outcomes the team must reach. Confirm with your assessor which baseline applies to the system before building the simulation requirement.
Deliver training and record completion
Run the training for each role holder within the period set in step two, and run it again when a qualifying system change occurs. Keep a signed or system-generated completion log that shows the person, the role, the course version, the date and the result. If you use a learning platform, such as a self-hosted Moodle instance, configure activity completion so that completion is recorded when a learner views the material, receives a grade or is marked complete by a trainer, and export those records to your evidence store. The output is a completion log that matches the role register one to one.
Set a review cadence tied to plan changes and tests
Assign an owner for the curriculum and set a review cycle that is triggered by changes to the contingency plan, by changes to the system architecture or recovery procedures and by findings from contingency plan tests and simulated events. Record each review with its date, reviewer, the sources it used and any content changes. The output is a review log and a version history for every training document. An assessor will look for evidence that the material was updated after the events that should have changed it, so link each update to the test finding or plan revision that caused it.
Assemble the evidence pack for assessment
Gather the artifacts an examiner will request: the role register, the approved training schedule, the curriculum and training materials with version history, the completion logs, the simulated event records, the review log and the interview notes from the people who hold contingency roles. Check that each determination statement in SP 800-53A for CP-3 has at least one artifact that answers it. The pack is complete when a reviewer who did not build it can trace every role to a completed training record and every update to a cause. Confirm with your independent assessor which format they prefer for the pack before you finalize it.

How learning platforms can record CP-3 completions

A learning platform can record CP-3 completions, but the platform does not decide whether training meets the control. Training mechanisms are a choice the organization makes, and the organization owns the definition of what counts as trained. The evidence an assessor will look for is the record of who was trained, on which contingency training content, when they completed it and what result they achieved. Before configuring anything, the contingency planning lead and the training owner should agree that definition in writing, covering the roles in scope, the content each role must complete, the triggers for retraining after a system change and the pass threshold where a knowledge check applies.

Self-hosted Moodle, licensed under GPL-3.0-or-later, can produce much of that record. Its activity completion feature marks an activity complete for each learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions set for that activity. For CP-3 this choice matters. A view-based condition shows that someone opened a contingency training module but not that they understood it. A grade-based condition with a pass mark, or a manual tick backed by a signed attestation, is closer to demonstrating competence. The course should use the condition that matches the organization's own definition, and each activity's completion settings should be documented alongside the training content so that a reviewer can see why a learner was marked complete.

Completion data is only evidence if someone checks it and keeps it. Administrators should run completion reports on a schedule, confirm that role-based enrolments match the contingency roles in the plan, and follow up on overdue learners before a defined deadline passes. Exports of completion and grade records, the course version in force at the time, and the training material itself should be retained for the period the organization sets in its records policy, and access to those records should be controlled. The organization should also confirm with its auditor which record formats and retention periods they will accept, since NIST does not prescribe a specific learning system or record format for CP-3.

Evidence that passes a CP-3 test

An assessor testing CP-3 works from the training plan outward: who holds contingency roles, what they were trained on, when, and whether the content kept pace with the system. The cards below cover the records that answer those questions and how to keep each one current between formal assessments, so the evidence reflects the system as it runs today.

Contingency role register

A maintained list of every person with a contingency role, such as recovery coordinator, backup operator, alternate site responsible or communications lead, tied to the system and the date each assignment began. CP-3 training is matched to roles, so the register is the starting point for every other record. Check that it matches the roles named in the system contingency plan and that a role change updates the register within the period the organization defined for assuming a role.

Defined training schedule

The written schedule that sets the periodic training frequency and the window for training people who newly assume a contingency role. It also lists the triggers that require training after system changes. The assessor compares the schedule with the organization's own defined values, so confirm that the values in the schedule match those in the system security and privacy plan. Undefined or blank parameters are a common reason a test fails.

Curriculum and materials with version history

The contingency training curriculum and the course materials, kept under version control with dated revisions and an owner for each change. An assessor reviews whether the content reflects the current contingency plan, recovery procedures and alternate site arrangements. Keeping a changelog that links each revision to a plan update or a system change shows the content is reviewed and updated at the defined frequency and after the defined events.

Completion records per person and role

Records showing which person completed which training, the role they held at the time, the date and the content version they completed. Records should tie each person to their role and the course version, not just to a course name. Learning management systems can produce these records, but the organization must confirm that completion is recorded only on evidence of finished training, such as a graded assessment or a signed attestation, rather than on a page view alone.

Records tied to system changes

Training entries or change tickets that show contingency training was delivered after a change that required it, such as a new backup target, a changed recovery sequence or a new alternate site. Link each change record in the change management system to the training action it triggered. This linkage is the evidence an assessor looks for when checking that training follows the system rather than the calendar alone.

Simulated event exercise reports

For systems categorized at the high impact level, reports from simulated events that exercise contingency roles, with the scenario, participants, objectives, observed gaps and corrective actions. SP 800-53B selects the simulated events enhancement for high systems only, so low and moderate systems do not need this report under CP-3 itself. Run these exercises alongside CP-4 testing where possible, so one exercise can produce both sets of records.

Content review and update records

Dated review records for the training content, showing the reviewer, the date, the findings and the approval. The review frequency and the events that trigger an out-of-cycle review should be stated in the policy or the schedule, and each review should reference the trigger it addressed. Keep these records with the curriculum history so the assessor can trace each revision back to a review.

What meeting CP-3 costs in money and staff time

This table breaks the CP-3 contingency training effort into its cost components, showing who is paid for each, whether it is one-time or recurring, and what drives it up. Read it to scope a quote and to decide which parts stay in-house and which are outsourced. No DeployOpen prices are implied; the figures a reader should request are listed in the last column.

Cost component	Who carries it	One-time or recurring, and drivers	What to ask for in a quote
Defining contingency roles and mapping them to training	Internal contingency planners, HR or role owners	One-time at setup, then recurring at each role change. Driven by the number of contingency roles and how often roles are reassigned.	Role inventory, the training-to-role matrix and the time the partner expects to spend on it
Writing and tailoring curricula	Internal subject experts, with optional external instructional design	One-time per curriculum, then recurring when content is reviewed. Driven by the number of systems and recovery procedures covered.	Named curriculum deliverables per role, review cycle and who approves content
Delivering training and facilitating simulated events	Internal trainers or an external facilitator	Recurring at each training cycle. Simulated events in the high baseline (CP-3(1)) add facilitation and debrief time for each exercise.	Session count per year, facilitator days, and whether simulations are scripted or run live
Learning platform licensing	Organization, through a commercial learning management system	Recurring per user or per seat under most commercial terms. Driven by headcount of users with contingency roles.	Licence model, seat count, renewal terms and any extra fees for reporting or completion tracking
Self-hosted learning platform operation	Internal platform or operations team, or an implementation partner under a retainer	No license spend for open-source software such as Moodle (GPL-3.0-or-later), but recurring effort for hosting, patching, backups, access control and upgrades.	Hosting model, patching and upgrade responsibilities, backup and restore tests, and who owns administrator access
Training records and completion tracking	Internal training or HR staff	Recurring with every training event. Driven by how completion is defined (viewed, graded or manually ticked) and by the volume of records retained for assessment.	Completion rules per course, export format for records and retention period
Review of training content after defined events	Internal contingency owners, with optional external review	Recurring, triggered by system changes, incidents or exercise findings. Driven by change frequency across the high systems.	Change trigger list, review turnaround and how findings feed back into the contingency plan
External facilitation or independent review	External consultant, implementation partner or assessor	Optional and recurring when used. Driven by the depth of review requested and the number of exercises run.	Fixed-scope deliverables, named review outputs and whether the partner prepares evidence only or also reviews the organization's own results
Auditor sampling and evidence requests	Organization for preparing evidence; independent assessor for testing	Recurring at each assessment cycle. Driven by how many role holders and training events the assessor samples.	Confirm with the assessor the sample sizes and evidence formats they expect before the assessment starts

Who owns CP-3 and what to outsource

Your organization owns CP-3 in full. The control requires you to decide who holds a contingency role, what training each role needs, how quickly new role holders must be trained, and how often and after which events the training is repeated. Those choices reflect your system, your recovery objectives and your risk appetite, so they cannot be delegated. An assessor will ask who approved the defined parameters and whether the people responsible can explain them.

Role assignments: Maintain the list of people with contingency roles, such as recovery leads, backup administrators and communications contacts, and keep it current.
Defined parameters: Set the training deadline for new role holders, the frequency for periodic training and the events that trigger retraining after system changes.
Content sign-off: Review and approve every curriculum and training item before it is used, and record the reviewer and date.
Simulated event decisions: Decide which scenarios are used, who participates and what counts as a passing outcome.
Ownership of results: Act on gaps found in training records and simulated events, and document the corrective action.

Confirm with your assessor which parameter values they expect to see written in your policy and plan.

Where CP-3 programs usually fall short

CP-3 looks simple on paper: train the people who run recovery, on a schedule, after changes. In practice the gaps tend to sit between the document and the operating reality. The cards below cover the ones assessors most often probe, each with a closing action you can check against your own records.

Training limited to the plan owner

Many programs train only the person who wrote the contingency plan, while the people who would execute recovery, such as system administrators, database owners, service desk staff and on-call engineers, never see the material. CP-3 applies to users with contingency roles, so the role list must come first. Check the plan's roles and contacts section against your training roster, and enroll every named role holder, including backups for each role.

No training record after system changes

The control expects training to follow system changes when those changes affect recovery. Teams often update architecture, add a service or move a database, then never trigger a training event because no one owns the link between change management and training. Add a contingency training check to the change approval workflow, and keep a dated record showing which changes required training and whether it was completed.

Defined periods that never happen

A plan may state that training occurs within a set period after someone assumes a contingency role and at a set frequency afterward, yet no calendar or tracker enforces either. Assessors compare the stated periods with the training records, so a gap between the two is an immediate finding. Pick the periods your organization has actually defined, put them into your learning platform as due dates, and review overdue assignments at each access or contingency review meeting.

Simulated events missing for high systems

CP-3(1) adds simulated events, and SP 800-53B selects it only in the high baseline. Organizations with high-impact systems often run tabletop reviews of the plan but never simulate a realistic disruption that tests how staff act on it. Schedule at least one simulated event per defined cycle, record the scenario, decisions made, gaps found and corrective actions, and link those results to the next plan update.

Training content describing old architecture

Training decks and runbooks often reflect the environment at the time they were written. When the platform moves to new hosts, a new cloud region or a replaced backup tool, staff are trained on steps that no longer work. CP-3 requires content to be reviewed and updated at a defined frequency and after defined events, so tie that review to the change log. Compare each module against the current architecture diagram and recovery procedures, and record the version and reviewer.

Completion marked without evidence of learning

A learning platform can show a module as complete when a learner opens it, which proves little about readiness. Assessors look for evidence that the training matched the contingency role and content. Where you use an open-source LMS such as Moodle, configure activity completion to require a graded check or a manual sign-off from the role owner, and export the completion and grade data as your CP-3 training record.

CP-3 contingency training questions buyers ask

How much effort does CP-3 contingency training take to meet?

The effort depends on how many people hold contingency roles, how often those roles change, and how much the training must be tailored to each role. CP-3 asks for role-based contingency training on a defined schedule, after system changes that require it, and for the training content itself to be reviewed on a defined cycle. The one-time work is defining roles, writing or adapting curricula, and building the training records. The recurring work is delivering training for new role holders, rerunning it after changes, and reviewing content. Ask any partner to break its quote into those components, and confirm with your own assessor which frequencies and periods your organization must define.

Can our organization handle CP-3 contingency training in-house?

Most organizations can do it in-house if they already run an internal training function and have a named owner for contingency planning. CP-3 is less about technology and more about showing that the right people were trained, on the right content, at the right times. The work that usually stays internal is deciding who holds contingency roles, approving the curriculum, and running the training. Teams that lack a learning platform often add one, and the open-source Moodle learning platform (GPL-3.0-or-later) can host courses and track completion, though you should confirm that its activity completion settings produce the records your assessor wants. An implementation partner can set up that environment inside your own infrastructure if you prefer not to build it yourself.

What does a partner need from our organization to start CP-3 work?

A partner needs enough information about your contingency roles and existing plans to define a fixed scope. Typically that means the current system contingency plan, the list of people with recovery or response duties, the systems in scope and their impact level, your existing training materials, and any training records you already keep. The partner also needs access to the environment where training will run and a named internal owner who can approve content and decisions. The more of this you provide before scoping, the more precise the written scope and timeline will be. DeployOpen agrees scope, deliverables and timelines in writing before work starts, so the quote follows from what you share.

How long does preparation for CP-3 take?

Preparation time depends on the agreed scope, so there is no fixed duration that applies to every organization. The main drivers are the number of contingency roles, the number of systems covered, whether training materials already exist, and how many review cycles your governance process requires. An engagement that only builds a training record for a small team will take far less time than one that defines role-based curricula for several systems and sets up a learning environment. Ask any partner for a timeline tied to a written scope, and ask which dependencies, such as access approvals or stakeholder reviews, could move it.

Does CP-3 apply to the privacy baseline?

No. In SP 800-53B Release 5.2.0, CP-3 is selected for the low, moderate and high security control baselines but not for the privacy baseline. That means a system categorized at a low, moderate or high impact level carries CP-3 requirements, while the privacy baseline by itself does not include this control. Some systems that process personally identifiable information will still fall under a security baseline, so the question for your system is which security baseline applies. Confirm the baseline selection with your assessor and with the official profiles published in the usnistgov/oscal-content repository.

What will an assessor ask to see for CP-3?

An assessor working from SP 800-53A Rev. 5 will look at the contingency plan, the contingency training curriculum and materials, and the training records, and will interview the people who handle contingency planning, plan implementation and training. They will also examine the organizational processes that run contingency training. In practice, expect to show which roles require training, the defined timing for initial and periodic training, evidence of training after system changes, the review history of the curriculum, and any simulated events you have run. The assessor makes the determination and issues the report. Your organization owns the evidence, and an implementation partner can prepare it, but only the independent assessor reaches the conclusion.

Does CP-3 require simulated events, and who decides?

Simulated events are part of CP-3's enhancements, but they apply only in certain cases. SP 800-53B Release 5.2.0 selects CP-3(1), which covers simulated events, in the high baseline only. Organizations at the low or moderate baseline may not need it, though running simulated events is still a sound way to test readiness. Your organization defines the parameters, such as the scenarios and frequency, and documents them in the contingency plan. Confirm with your assessor whether your system's baseline selects the enhancement, and ask any partner how simulated exercises would be recorded so they can be shown as evidence.

How DeployOpen prepares CP-3 evidence

DeployOpen prepares the systems and records behind CP-3 contingency training, but the organization owns the control and an independent assessor decides whether it is met. DeployOpen does not issue audit reports or certifications. The work starts with a fixed scope agreed in writing before any build begins. That document names the systems and contingency roles in scope, the training events the organization must define (time limits after assignment, change triggers, refresher frequency and review cadence), the simulated events to be run, and the deliverables. Because CP-3 leaves those parameters to the organization, the written scope is where they get set, so ask each candidate partner to show how it records them.

Next, DeployOpen deploys a self-hosted learning platform inside the client's own cloud account, data center or air-gapped network, so training records stay under the client's custody. Moodle, which is GPL-3.0-or-later, is one open-source option. Its activity completion feature can mark a module complete when a learner views it, receives a grade or ticks it manually, and the team configures which condition applies to each role-based course. Hardening covers access to the training records, backups of the learning database, and logging of administrative changes. Confirm the chosen platform's capabilities against its own documentation before you rely on them, including how completion data is exported for an assessor.

The evidence pack is where CP-3 is tested. Assessors examine the training curriculum, training material and training records, and interview the people who hold contingency planning and training responsibilities. DeployOpen builds role-based curricula that map each course to a contingency role, runs the defined simulated events, and assembles records showing who was trained, when, against which material and after which trigger. It also helps the organization set up a review log for updates to the content. The organization still has to show that people actually did the training and that the content reflects its current plan, so treat the pack as a starting point that your own contingency staff must stand behind.

CP-3 Contingency training