What CP-7 alternate processing site asks for when primary processing fails
CP-7 asks you to prove that essential operations can resume at another site within a time you have defined in advance. The control requires an alternate processing site, written agreements for transferring and resuming the system's defined essential functions, the equipment, supplies or contracts that make resumption possible, and controls at the alternate site that are equivalent to those at the primary. A compliance lead or engineer answering for CP-7 has to show all four parts, not just a site name on a diagram. The risk it addresses is simple: a primary data center, facility or hosting environment becomes unavailable, and the organization has no tested way to keep essential functions running while it recovers.
The hard part is that CP-7 fails quietly in several places. Recovery times are often never written down, so there is nothing to test against. A site can exist on paper, with a contract that has no hardware allocated, no network path, or no staff who know how to start the system. Over time the alternate site also drifts from the primary, as patches, firmware, network rules and application releases land on one side only. Ask for the defined resumption time for each essential function, the signed agreement, the inventory of spare equipment and supplies at the alternate site, and a recent configuration comparison between the two sites. The independent assessor will test those artifacts, and so should you before they do.
In SP 800-53B Release 5.2.0, CP-7 applies to the moderate and high baselines. It is not part of the privacy baseline, so a system that is scoped only to privacy controls does not inherit this requirement, although a system at moderate or high impact does. Confirm your system's baseline against your categorization before you plan the work, because the enhancements differ: the high baseline adds preparation for use on top of the separation, accessibility and priority of service enhancements that moderate also selects. Treat the baseline decision as an input to the contingency plan in CP-2, which is where the defined recovery objectives live.
Which systems and third parties CP-7 alternate processing site covers
CP-7 applies to systems at the moderate and high impact levels, and the scope you set determines which enhancements, dependencies and third parties come with it. The cards below cover the decisions that change the work and the related controls that an assessor will expect to see connected to the alternate site.
Systems carrying essential functions
CP-7 is written around resuming essential operations, so the first scoping decision is which functions count as essential and which systems support them. Map each essential function to its supporting components, including identity, data stores, network paths and integrations. A system that looks peripheral may still be a dependency that stops a critical process at the alternate site. Ask the business owners to confirm the list in writing, because the contingency plan and the alternate site design both start from it.
Impact level that selects CP-7
In SP 800-53B Release 5.2.0, CP-7 is selected for the moderate and high baselines and is not part of the privacy baseline. Confirm the system's security categorization before deciding whether CP-7 applies, and record the baseline in the system security plan. If a system is tailored away from the baseline, document the rationale, because an assessor will test the tailoring decision as well as the control.
Enhancements CP-7(1) through CP-7(4)
CP-7(1) covers separation from the primary site, CP-7(2) covers accessibility, and CP-7(3) covers priority of service. In the moderate and high baselines, CP-7(1) through CP-7(3) are selected, and CP-7(4) covers preparation for use and is selected only in the high baseline. Decide early whether the alternate site must be geographically separated, reachable by staff during a regional event, and contracted for priority restoration, since each choice changes the site agreement and its cost.
Owned, hosted or cloud alternate site
The alternate site can be a facility you own, a colocation or managed hosting provider, or a separate cloud region. Each model moves responsibility for equipment, supplies, staffing and physical protection differently, so the written agreement must match the model you choose. Confirm who provides spare equipment, how quickly capacity can be made available, and whether the provider's own controls are equivalent to the primary site. The choice also affects whether the alternate site is shared with other customers during a regional disaster.
Related controls in the catalog
The catalog names CP-2, CP-6, CP-8, CP-9, CP-10, MA-6, PE-3, PE-11, PE-12, PE-17, SC-36 and SI-13 as related controls. These cover the contingency plan, alternate storage, telecommunications, backup, recovery, maintenance support, physical access, power, environmental protection, distributed processing, and information management. Treat them as the dependencies an assessor will check against your alternate site record, and confirm each one has an owner before testing begins.
Checking the CP-5 dependency
CP-5 is not among the related controls named for CP-7 in the facts supplied for this page, so do not assume it is linked. Check the SP 800-53 Rev. 5 catalog directly for any dependency or cross-reference that bears on your alternate site arrangements, and note the result in your control documentation. Confirming this with the catalog keeps the mapping defensible when an assessor asks why a neighboring control is or is not in scope.
How an assessor tests CP-7 alternate processing site
This table maps the SP 800-53A assessment methods for CP-7 to the artifacts an assessor requests and the findings that commonly appear. Read each row as a request the organization should be able to answer with a dated, specific record before the assessment begins.
| Assessment element | What the assessor asks for | Where it usually fails |
|---|---|---|
| Examine: contingency plan | The system contingency plan showing the alternate processing site, the essential functions it resumes and the recovery time defined for them | Plan names an alternate site but does not state which functions move there or within what time |
| Examine: site agreements | Signed agreements for transferring and resuming operations at the alternate site, alongside the primary site agreements that govern the arrangement | Agreement terms or service levels do not match the recovery time in the plan |
| Examine: spare equipment and supplies | Inventory of equipment and supplies held at the alternate site, with the contracts or agreements that support them | Inventory is out of date, lists hardware no longer in service or omits software licenses and network components |
| Examine: equipment and supply contracts | Current vendor or hosting contracts that provide equipment and supplies when the primary site is unavailable | Contracts have lapsed, lack delivery terms or are held by a team that no longer exists |
| Interview: personnel with contingency roles | Staff responsible for contingency planning and alternate site arrangements explain activation, access and decision authority | Interviewees describe a different activation path than the one written in the plan |
| Test: recovery at the alternate site | Records of recovery exercises at the alternate site showing scope, results, timings and corrective actions | No recent test at the alternate site, or only tabletop reviews with no restoration of systems |
| Equivalent controls at the alternate site | Evidence that access control, monitoring, backup and encryption at the alternate site match the primary site | Alternate site runs older configurations or weaker logging than production |
How to set up an alternate processing site in the right order
This sequence moves from agreed recovery objectives to a tested alternate site, and each step leaves a record that an assessor can examine. Skipping ahead, such as buying equipment before the recovery time is set, usually produces a site that cannot meet the business need.
Confirm essential functions and the recovery time
The business owners of each essential function, with IT and the contingency plan lead, agree which functions must resume at the alternate site, the order in which they return, and the defined time within which each must be running. The output is a signed recovery objective record that names the function, the owner, the time and the systems that support it. Without this record, every later decision about site capacity and cost has no basis. Confirm that the same objectives match the recovery objectives used in the system contingency plan and in CP-10.
Choose the alternate site model
Decide whether the alternate site will be a dedicated facility owned by the organization, a shared or hosted facility under contract, a second cloud region or account, or a combination. The choice depends on the recovery time, the capacity needed for essential functions and whether the site must be separated from the primary site by a defined distance or risk boundary. The output is a short decision record stating the chosen model, the rejected options and the reasons. Confirm with the risk owner that the separation chosen is acceptable for the threats the organization has identified.
Execute the site agreements and contracts
Legal and procurement teams, with the system owner, write and sign the agreements that make the alternate site available. These typically cover the right to use the facility or capacity, the resources the provider commits to, the conditions that trigger use, and the arrangements for transferring operations to the site and back. Where a provider supplies equipment or supplies, the contract should state what is provided and how quickly. The output is an executed agreement for each site or provider, stored with the contingency plan. Confirm with counsel that the terms match the recovery objectives agreed in step one.
Provision equipment, supplies and inventory
The infrastructure team provisions the hardware, network capacity, power, licenses and consumables needed to run the essential functions at the alternate site, or confirms that the contracted provider holds them. Spares and supplies should be recorded so that someone can check them without visiting the site. The output is an inventory of equipment and supplies at the alternate site, with quantities, locations, owners and the date each item was last verified. Confirm the inventory against the agreements from step three, because gaps often appear where a contract assumed the provider would supply an item that the organization was expected to buy.
Bring the alternate environment to equivalent controls
Security and infrastructure engineers build the alternate environment from the same configuration baselines used at the primary site, then apply the access, monitoring, encryption, backup and physical controls the primary site requires. Where an alternate site cannot match a control exactly, the gap should be recorded with a documented compensating measure and an owner. The output is a configuration baseline comparison that lists each setting, its value at the primary and alternate sites, and any difference with its justification. Confirm that the comparison has been reviewed by the people who own the controls, not only by the engineers who built the site.
Document the failover runbook
The contingency plan owner writes the runbook that tells operators how to declare a disruption, transfer each essential function to the alternate site, verify that it works, communicate status and return operations to the primary site. Each step should name the person responsible, the command or procedure, the check that confirms success and the escalation path if it fails. The output is an approved runbook version, reviewed with the people who will execute it, and linked from the system contingency plan. Confirm that the runbook references the current inventory, agreements and baseline comparison so that no step depends on knowledge held by one person.
Run a test and record the results
The contingency team runs a test in which essential functions are brought up at the alternate site, checked against the recovery objectives from step one and then returned to the primary site or closed out as the plan defines. Observers record the time taken, the problems found and the corrective actions assigned. The output is a signed test record that states what was tested, when, by whom, the results against each objective and the open corrective actions. Keep this record with the other documents an assessor will request, and rerun the test after material changes to the site, the systems or the agreements.
Which CP-7 evidence passes and how to keep it current
An assessor testing CP-7 looks for a chain of documents that agree with each other: the plan names the alternate site, the agreements and contracts back it, the inventory shows the equipment is there, and test records show the site actually resumes operations. The cards below cover each item and how to keep it current between assessments without relying on a single annual refresh.
Alternate site section in the contingency plan
The system contingency plan should name the alternate processing site, the essential functions it must resume, the order of recovery and the people who declare the switch. Assessors read this section first, so it has to match the agreements, inventory and test records behind it. Check that the site identifier, address and recovery sequence are the same in every document. Tie each revision of this section to a plan version number, so every test and inventory review can be traced to the plan that was in force at the time.
Signed site and supplier agreements
CP-7 expects written agreements that allow the organization to transfer and resume operations at the alternate site. Keep the signed agreement for the alternate facility, and any agreement with a hosting or recovery provider, in a register with its signature date, term, renewal date and named contacts. Confirm with counsel and the assessor which agreement wording satisfies the control, and whether primary site agreements also need to be on file. Set the review cadence from your own contract terms rather than a generic period.
Spare equipment and supplies inventory
The inventory lists the hardware, network devices, licenses, media and supplies held at or contracted for the alternate site, along with their location and status. Assessors compare this list with the systems in the plan, so a server added to production without a matching spare is a common gap. Record the date of each physical or logical check and who performed it. Set the inventory review interval from the plan and confirm it with the assessor before the first assessment.
Equipment and supply contracts
Where the alternate site relies on a provider to supply equipment or consumables on short notice, the contract must state what is delivered, within what period and under what conditions. Track each contract's delivery terms against the recovery time in the plan, because a contract that cannot meet the plan's time is evidence against the control. Ask the provider for their current capacity statement and any recent exercise results, and file both with the contract.
Primary and alternate configuration comparison
Show that the alternate environment has controls equivalent to the primary site by comparing baseline configurations, access controls, logging, network rules and security tooling. Store the comparison as a dated report generated from configuration data where possible, so the differences are visible and reviewable. Mismatches should be listed with an owner and a target date. Self-hosted configuration management and infrastructure-as-code repositories can produce this comparison when they are kept under version control.
Test records and after-action notes
Recovery tests at the alternate site should record the scenario, the scope, the start and end times, the systems brought up, the data checks performed and the problems found. After-action notes should name the owner and due date for each correction. Tie every record to the plan version tested, so an assessor can see that the procedures in use were the ones tested. Confirm with the assessor how test frequency and scope are defined in your plan, since the control leaves those choices to the organization.
Named role assignments
CP-7 depends on people who can declare the switch to the alternate site, approve it and operate it. Keep a current roster that names each role, the individual holding it, a backup, and the contact method that works when primary systems are down. Update the roster whenever staff or suppliers change, and confirm that the people listed have seen the plan and taken part in a recent exercise. A roster that names departed staff is one of the simplest findings an assessor can raise.
What meeting CP-7 alternate processing site costs
This table lists the cost components of an alternate processing site under CP-7, who is paid for each, whether it is one-time or recurring, and what moves it up or down. No figures were published for these costs, so use the table to structure written quotes rather than to estimate a budget. Ask every provider to itemize capacity, licensing and labor separately.
| Cost component | Who is paid | One-time or recurring | What drives it |
|---|---|---|---|
| Alternate site capacity (owned, colocation, or cloud) | Hosting provider, colocation operator or cloud provider | Recurring, with possible one-time setup | Impact level, number of systems that must run at the alternate site, and whether capacity is reserved or on demand |
| Site agreements and contract negotiation | Legal counsel and the provider's contracts team | One-time, with periodic renewal | Number of providers, required transfer and resume terms, and how many parties must sign |
| Spare equipment and supplies | Hardware vendors and suppliers | One-time purchase, then refresh and maintenance | Recovery time objective, hardware lead times and whether spares are cold, warm or hot |
| Engineering time for equivalent controls | Internal staff or an implementation partner | One-time build, then recurring upkeep | Gap between primary and alternate controls, degree of automation, and how much configuration is shared |
| Recovery testing at the alternate site | Internal staff, testing partner and provider for facility access | Recurring, at the frequency set in the contingency plan | Scope of each test, number of essential functions exercised, and whether tests run in production-like conditions |
| Evidence upkeep and monitoring | Internal staff or an implementation partner; monitoring tooling | Recurring | Evidence volume, log retention, and how many separate sources must be collected |
| Open-source monitoring and backup tooling | No license fee for the software; support is optional | Recurring infrastructure and staff time only | Choice of self-hosted platforms such as Prometheus, Grafana, Bareos or restic instead of licensed products, and the staff time to run them |
| Auditor sampling and assessor time | Independent auditor or assessor | Recurring, at each assessment cycle | Number of sites in scope, sample sizes the assessor selects, and how quickly evidence can be produced |
How self-hosted open-source tools support CP-7 evidence
Open-source tools can produce useful evidence for CP-7, but none of them establishes an alternate processing site on its own. The organization must still own the agreements, equipment, supplies or contracts, and the equivalent controls that CP-7 asks for. What the tools do well is generate records that an assessor can examine: job histories, integrity checks and alert configurations that show the arrangements work in practice. Treat each tool as a source of artifacts that feed the examine and test methods in SP 800-53A, not as the control itself.
Bareos supports the restore side of the picture. The Bareos Director schedules and supervises backup, restore, verify and archive jobs, and its SQL catalog records what was backed up, so a restore can select files from the current backup or from a point before a given date and time. Run a documented restore of defined essential data into the alternate environment, and keep the job logs and catalog entries as evidence. Confirm with your own environment whether Bareos fits your storage, database and network design, and review the license: Bareos is AGPL-3.0-only, so confirm with counsel how that license applies to your deployment and any modifications you make.
restic check supports the claim that backup data at the alternate site is usable. The check command verifies the structural consistency of snapshots, trees and pack files, and with --read-data or --read-data-subset it reads pack files back to confirm the stored data is unmodified. Schedule these checks against the repository that the alternate site would restore from and retain the output. restic is BSD-2-Clause, which is generally permissive, but confirm the license terms against your own use. Prometheus (Apache-2.0) and Grafana Alerting (AGPL-3.0-only) can show readiness signals, such as replication lag or the availability of the standby environment, through metrics and alert rules. Confirm that the signals you choose reflect your recovery objectives, because a dashboard alone does not prove the site can take over.
Who owns CP-7 work and what a partner can take on
Your organization owns the decisions that make an alternate processing site real. Leadership sets the recovery objectives for essential functions, decides how long a disruption may last before failover, signs the agreements with the alternate site provider, and accepts the residual risk of running on a site that is not identical to production. Those decisions cannot be delegated to a partner, because the control asks whether the organization has committed to resuming operations within a defined time, not whether a vendor built something.
- Recovery objectives: Define which essential functions move to the alternate site and the time within which each must resume.
- Agreements: Own the contracts or agreements that transfer operations to the alternate site and the equipment or supply commitments behind them.
- Risk acceptance: Record who accepts any gap between the alternate site and the primary site and under which conditions.
- Failover authority: Name the role that decides to fail over, with the criteria and the escalation path written down.
- Plan ownership: Keep the contingency plan, its approvals and its review cycle under internal governance.
Before accepting any partner work, confirm that the objectives, agreements and risk acceptances exist in signed form and match the system's contingency plan.
An implementation partner prepares the systems and evidence that let your team meet CP-7 and let an assessor test it. For an open-source platform hosted in your own infrastructure, that work covers the alternate environment, its configuration baselines, the backup and restore tooling that moves data to the site, monitoring that shows whether the site is reachable and current, runbooks for failover and failback, and the evidence packs that record how each step was exercised. The partner executes this work under a written, fixed scope, but it does not decide the recovery objectives or sign for the organization.
- Alternate environment: Build or configure the alternate site with the same platform versions and security settings as primary, documented in configuration baselines.
- Restore tooling: Set up backup and restore jobs, for example with Bareos or restic, and verify that restored data can be read.
- Monitoring: Configure alerting on site health, replication lag and capacity, for example with Prometheus and Grafana.
- Runbooks and evidence packs: Write failover and failback procedures and collect the logs and records that show each exercise.
- Test support: Run the technical side of exercises and record results, but leave the sign-off of those results to your team.
Ask any partner to name the artifacts it will deliver and who will own each one after the engagement ends.
The independent auditor or assessor tests whether CP-7 is in place and issues the report or certificate. Its role is to examine the plan and agreements, interview the people with contingency and site responsibilities, and test the recovery at the alternate site using the procedures in SP 800-53A. The assessor forms its own conclusion from the evidence. It is not the party that designed the controls it tests, and it does not issue findings on work it prepared.
- Examine: Review the contingency plan, site agreements, equipment inventories and contracts against the determination statements.
- Interview: Speak with personnel responsible for contingency planning and alternate site arrangements.
- Test: Observe or review a recovery at the alternate site and check the results against the defined objectives.
- Independence line: The partner must not sign the test results it prepared, and the assessor must not design the controls it tests.
- Report: The assessor, not DeployOpen or your team, issues the assessment report or any certificate.
Confirm with the assessor, before work starts, which evidence it will accept and whether it will review the partner's runbooks and records as inputs.
Where CP-7 alternate processing site programs usually fall short
Most CP-7 gaps are not missing sites. They are undefined recovery targets, agreements that exist on paper only, and an alternate site that no longer matches production. Each card names one gap, what it breaks in an assessment and what to check before the assessor arrives.
Recovery time never defined
CP-7 asks for resumption of defined system operations for essential functions within a defined time. Many plans name a site but leave that time blank, so the assessor has nothing to test against. Ask the system owner to set a recovery time for each essential function, record it in the contingency plan, and confirm that the business accepts it. The same figure should appear in the site agreement and in the test results.
Alternate site with no signed agreement
A site that is only *planned* is not an alternate processing site under CP-7. The assessor will look for the written agreement to transfer and resume operations, along with the primary site agreement it depends on. Check that both documents name the systems in scope, the people who can invoke the site, and the conditions that trigger it. Store signed copies where the contingency team can find them during an outage.
Alternate equipment drifted from production
CP-7 requires controls at the alternate site equivalent to the primary site. Over time, patches, firewall rules, certificates and software versions change at production and stay unchanged at the alternate location. Compare configurations on a fixed schedule, using the same baseline and change records as production. Record each difference and the reason it exists, because an unexplained gap will be treated as a control failure.
Supply contracts that lapsed
The spare equipment and supplies that CP-7 relies on are often held under contracts that expire, renew automatically or change owners. A lapsed power, hardware or colocation contract can leave an alternate site that exists in the plan but cannot run workloads. Keep an inventory of each supply contract with its end date, renewal owner and notice period. Review it at each contingency plan update.
No test at the alternate site
A plan that has never been run at the alternate site is untested in the way that matters. CP-7 assessment looks for organizational processes for recovery at the alternate site, and a tabletop exercise alone rarely shows that data, DNS and access actually move. Schedule at least one recovery exercise that brings essential functions up at the alternate site, measure the elapsed time against the defined recovery time, and log the problems found for correction.
Crosswalk treated as the assessment
NIST's OLIR crosswalk maps CP-7 to CSF 2.0 subcategory PR.IR-04, but NIST marks the crosswalk as not comprehensive. It helps teams find related language. It does not show that the agreements, equipment, contracts and test results exist and work. Use the SP 800-53A determination statements and examine, interview and test objects as the checklist, and treat the crosswalk only as a navigation aid.
CP-7 alternate processing site questions buyers ask
How much does CP-7 cost to implement?
NIST does not estimate compliance costs, so no public figure applies to CP-7 in general. The cost is driven by the alternate site model you choose, the system's recovery objectives and how many of the five current enhancements the selected baseline requires. Major cost components are the site itself (leased capacity, hardware, network links, power and cooling), spare equipment and supplies held at the site, contracts with the site provider, and labor to build, document and exercise the arrangement. Some items are one-time, such as build-out and initial testing, while leases, circuits, hardware refresh and recurring tests are ongoing. Ask any partner for a quote that separates one-time and recurring costs, lists each component and names which items are the client's own contracts. For federal systems, OMB Circular A-130 governs implementation timing and cost decisions.
How long does it take to set up an alternate processing site?
NIST does not set implementation timelines for CP-7, and the duration depends on the site model, the existing infrastructure and the contracting process. A site built on existing capacity in another facility you already operate usually takes less time than one that needs new leases, hardware procurement and network circuits. The critical path often sits outside engineering: negotiating the site agreement, procuring equipment and confirming that the provider can meet the defined time to resume operations. Ask for a written schedule with milestones for agreements, equipment delivery, data replication setup, a first failover exercise and documentation sign-off. For federal systems, OMB Circular A-130 is the reference point for implementation timing.
What does the client team need to provide for CP-7?
The client team owns the control, so it must supply the decisions and inputs an implementation partner cannot make alone. These include the essential functions the alternate site must resume, the time within which each function must resume, the system's recovery priorities, and the rules for what the alternate site must match in security. The team also signs or negotiates the agreements with the alternate site provider and approves the equipment and supply contracts. Internal staff must be named for contingency roles and available for the failover exercise. Expect the partner to request access to architecture diagrams, current backup and replication design, network topology and the existing contingency plan, which links to CP-2 and CP-4.
Can our own team implement CP-7 in-house?
Yes, an internal team can implement CP-7 if it has the infrastructure skills, the contracting authority and the time to run an exercise. Many organizations keep ownership of the control while using a partner for specific work. The control requires an alternate site with agreements, equipment or contracts that support the defined resumption time, and controls equivalent to the primary site. Your team should check whether it can run replication, build the site, document it, and test failover without disrupting production. Partners are usually engaged for architecture review, build of the open-source platform components at the alternate site, runbooks and test support. Decide the split in writing before work starts, because the organization remains accountable for the control either way.
Can an implementation partner issue the CP-7 assessment?
No. An implementation partner prepares systems, configurations and evidence for CP-7, but only an independent assessor, auditor or authorizing body issues an assessment result or authorization. For federal systems, an assessor tests CP-7 using the procedures in SP 800-53A, which include examining the contingency plan and site agreements, interviewing personnel with alternate site responsibilities, and testing recovery at the alternate site. The implementation partner's role is to make those artifacts exist and be current, such as the signed site agreement, spare equipment inventory, equipment and supply contracts, and a recorded recovery test. Agree with the partner in writing which evidence it will prepare and which evidence the independent assessor must review.
What evidence will an assessor expect for CP-7?
Assessors check the artifacts that SP 800-53A lists for CP-7. Expect requests for the contingency plan, the alternate processing site agreement, the primary site agreement, an inventory of spare equipment and supplies at the alternate site, and the equipment and supply contracts. They will also interview the people responsible for contingency planning and alternate site arrangements, and review records from tests of recovery at the alternate site. Keep dated test results, the decisions taken after each test, and proof that the site still meets the stated resumption time. Evidence that is months old or describes a different architecture is a common finding. Use the NIST CPRT CP-07 entry to confirm the current control text and related controls.
Which CP-7 enhancements apply to my system?
Enhancement selection depends on the baseline your system is assigned. SP 800-53B selects CP-7 for the moderate and high baselines, not for the privacy baseline. In the moderate and high baselines, CP-7(1) on separation from the primary site, CP-7(2) on accessibility and CP-7(3) on priority of service apply. CP-7(4) on preparation for use applies only in the high baseline. CP-7(5) is withdrawn in Release 5.2.0, so five enhancements remain. Confirm your baseline and any tailoring decisions with your authorizing official or contract owner before scoping the work, because the separation and accessibility choices materially change site design and cost. Engineers should check the OSCAL baseline profiles to verify the selections for their impact level.
How DeployOpen prepares CP-7 site arrangements and evidence
DeployOpen plans, builds and documents the self-hosted platforms that an alternate processing site would run, inside the client's own infrastructure. We prepare the systems, arrangements and evidence that an independent assessor reviews for CP-7, while the organization keeps ownership of its controls and the assessor alone issues findings.
How we scope
- Written scope names the essential functions, the primary and alternate sites and the platforms covered by CP-7.
- Scope defines which agreements, spare equipment and supply contracts the client must hold before work starts.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before any build begins.
How we build
- We deploy the self-hosted platforms at the alternate site with configuration matched to the primary environment.
- We set up backup replication and monitoring so the alternate site can be checked against its recovery objectives.
- We run recovery exercises at the alternate site and record results, gaps and corrective actions for review.
How we hand over
- Handover includes architecture diagrams, runbooks, site configuration records and recovery test reports.
- We map each delivered artifact to the CP-7 determination statements so the assessor can trace evidence quickly.
- The client receives documentation it can maintain, and the independent auditor or assessor decides whether the control is met.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Retainers can cover periodic alternate site recovery exercises and refreshed evidence before each assessment cycle.
- Confirm with DeployOpen in the written scope which support levels and response arrangements apply to your site.
