CP-8 Telecommunications services: requirements and evidence

What CP-8 telecommunications services requires in NIST SP 800-53

CP-8 requires an organization to establish alternate telecommunications services, backed by the necessary agreements, so that defined essential operations can resume within a defined time when primary telecommunications are unavailable at the primary or alternate processing or storage sites. In practice, the control is about recovery, not about the systems themselves: a restored database or failed-over application cannot help a team if voice lines, data links to the alternate site and vendor support channels are down with the primary provider. Telecommunications outages can halt recovery even when every server is intact, so an assessor will look for evidence that the alternate path works, not just that a contract exists.

The hard part of CP-8 is that its two most important inputs are organizational decisions rather than technical settings. The defined recovery time for each essential function, and the provider agreements that make an alternate service available within it, must be set by the business and documented in the contingency plan that CP-2 requires. Your team should confirm which essential functions depend on telecommunications, which carriers and circuits serve each site, and whether the agreements actually commit the provider to restoration within the defined time. SP 800-53 Release 5.2.0 lists five enhancements, CP-8(1) through CP-8(5), covering priority of service, single points of failure, provider separation and provider contingency plans. The privacy baseline does not include CP-8.

SP 800-53B selects CP-8 for the moderate and high baselines only, and the enhancements vary by baseline. CP-8(1) and CP-8(2) apply at moderate and high, while CP-8(3) and CP-8(4) apply only at high. SP 800-53A assesses CP-8 with a single determination statement and examine, interview and test methods, so an assessor will read the agreements and the contingency plan, interview the people who hold telecommunications recovery roles, and test the mechanisms that support telecommunications. Confirm the baseline for each system with its impact categorization before you scope this control, and check the exact enhancement wording in the NIST CPRT entry for CP-08.

Which telecommunications paths and teams CP-8 applies to

CP-8 is selected in the moderate and high baselines, so the first decisions are which systems fall in those baselines and which telecommunications paths carry their essential functions. The cards below cover the decisions that determine what alternate services must exist, where they must land and who holds the agreements.

Systems in the moderate and high baselines

CP-8 applies only where the system's impact level selects the moderate or high baseline in SP 800-53B. Start with the security categorization for each system, then confirm which systems depend on telecommunications to deliver essential functions. A low-impact system without a defined recovery requirement may not need CP-8 at all, but confirm that categorization against the documented system boundary rather than assuming it. Record the decision in the contingency plan so an assessor can trace it.

Carrier circuits and internet transit

Leased circuits, dedicated internet access and transit contracts are the most common primary telecommunications paths that CP-8 addresses. For each circuit that carries an essential function, identify the provider, the service endpoints and the site it serves. Confirm whether an alternate path exists and what the agreement commits the provider to deliver if the primary path fails. Gaps here are usually found during tabletop exercises rather than in documentation reviews.

Voice, out-of-band management and SD-WAN links

Voice services used for incident coordination, out-of-band management networks used to reach devices when production paths fail, and SD-WAN overlays all carry essential functions in many environments. Teams often treat them as operational tools rather than telecommunications dependencies. List each one in the scoping inventory, state whether it is needed to resume defined operations, and check that its alternate path does not run over the same physical or logical route as the primary.

Primary and alternate site boundaries

CP-8 asks for alternate services that support resumption at the primary or alternate processing or storage site. Define which buildings, data centers, cloud regions and recovery sites count as primary and which count as alternate, using the same site list as CP-6 and CP-7. A telecommunications path that is redundant at one site but absent at the alternate site will not satisfy the control for the system as a whole.

Cloud interconnects and provider dependencies

Cloud interconnects, private connections into hosting providers and direct links to managed services are telecommunications paths that many inventories omit. Map each interconnect to the cloud region it serves and to the on-premises or colocation site at the other end. Ask whether the provider offers a separate alternate interconnect and whether the two paths share a carrier, a facility or a route, because shared dependencies often defeat the redundancy on paper.

Third parties holding the agreements

CP-8 requires that alternate telecommunications services are in place with the necessary agreements. The agreements are held by carriers, internet service providers, managed network operators and sometimes by a hosting or colocation provider acting as an intermediary. Assign an owner for each agreement, record its service levels for restoration and its contact path, and confirm that the agreement names the systems and sites in scope. Procurement and the network team usually own this inventory together, and the organization remains accountable for it even when a third party operates the service.

How an assessor tests CP-8

This table maps each SP 800-53A assessment method for CP-8 to the objects an assessor examines, interviews or tests, and to the findings that commonly appear. Read it as a checklist of what to have ready before the assessor arrives, since the single determination statement is tested through all three methods.

Assessment method	Objects the assessor uses	Evidence to prepare	Common findings
Examine	Contingency plan and primary and alternate telecommunications service agreements	Current contingency plan sections covering telecommunications, provider contracts or service level terms, and the defined time for resuming operations	Agreements do not state the restoration time the plan relies on, or the alternate service is not named in any contract
Interview	Organizational personnel with contingency plan telecommunications responsibilities	Named owners, escalation contacts with the carriers, and a record of who activates alternate service	Staff cannot describe the activation steps, or the owner has left and no one has been reassigned
Interview	Organizational personnel with system recovery responsibilities	Recovery runbooks showing when telecommunications is restored in the sequence of system recovery	Recovery staff assume primary links return first and have no step for switching to the alternate path
Test	Mechanisms supporting telecommunications, such as failover links, routing and alternate circuits	Records of failover exercises, timings achieved, and fixes applied after each exercise	Failover paths have never been exercised, or tests cover only the primary carrier and not the alternate
Examine (enhancement context)	Provider contingency plans and provider separation arrangements where CP-8(3) or CP-8(4) applies	Evidence that primary and alternate providers do not share a single route or facility, and the provider's own continuity plan	Both providers depend on the same physical path or upstream carrier, which the agreements do not disclose
Test (monitoring)	Telemetry from monitoring tools that show link state and failover events	Alert rules and dashboard captures showing detection of primary link loss and switch to the alternate path	Monitoring watches the primary link only, so a silent failure of the alternate goes unnoticed

Implementing CP-8 in six steps

This sequence turns CP-8 from a requirement into working alternate telecommunications paths, with agreed terms, tested failover and retained evidence that an assessor can examine, interview against and test.

Define essential functions and resume-within time
Start with the business owner of each essential function and agree which operations must continue during a telecommunications outage, the systems and sites they depend on, and the time within which they must resume. CP-8 requires alternate services to resume defined system operations within a defined time, so the output is a signed-off list of functions, the owner for each, and the resume-within value for each. Record these in the contingency plan drafted under CP-2 so the telecommunications requirements trace back to real business needs. The step is done when every essential function has a named owner and a documented resume-within value. Ask the owner to confirm the value in writing, because the assessor will test against it.
Inventory primary telecommunications paths per site
For each primary and alternate processing or storage site, list every telecommunications path the essential functions use: carriers, circuits, voice and data services, internet access, and any dependency on a shared provider or shared physical route. Note the provider, service type, contract reference and the functions each path supports. This inventory exposes single points of failure, such as two circuits that share one conduit or one carrier that serves both sites, which the CP-8 enhancements on single points of failure and provider separation address. The output is a per-site register that the engineering and procurement teams both sign. The step is done when every path is mapped to at least one essential function.
Select and contract alternate paths
Choose alternate telecommunications services that can carry the essential functions within the resume-within time, and document them in agreements with the providers. Evaluate whether the alternate provider is separate from the primary provider and whether the alternate route avoids the same physical infrastructure, since CP-8(3) and CP-8(4) address provider separation and provider contingency plans in the high baseline. Ask each provider to confirm priority of service provisions where the moderate or high baseline applies under CP-8(1). The output is a set of executed service agreements that state the service levels, activation method, and the conditions under which the alternate is used. Have counsel or procurement review the terms. The step is done when each essential function has an agreed alternate path on file.
Configure failover and monitoring
Engineering configures the alternate paths so that traffic, voice or remote access moves to them when the primary fails, and sets monitoring that detects the primary failure and confirms the alternate is up. Document the failover mechanism, its configuration keys or routing rules, and the monitoring thresholds. Open-source monitoring such as Prometheus, which collects metrics over HTTP and stores them as time series, and Grafana Alerting, which builds alert rules across data sources and alerts on metrics and logs together, can give the team one view of link health and alert routing. Confirm the tools fit your environment, since your network equipment and carriers may need separate integration. The output is a configured failover path, a monitoring dashboard, and alert rules tested against a simulated outage. The step is done when a simulated primary failure triggers the alert and the alternate path is confirmed active.
Assign roles and record them in the contingency plan
Name the people who activate the alternate services, contact the providers, make the decision to fail over and restore the primary, and keep the carrier contact list current. CP-8 assessments include interviews with personnel who hold contingency telecommunications responsibilities and with personnel who hold system recovery responsibilities, so the roles must be known and understood. Record each role, its backup, and the provider escalation contacts in the contingency plan and the related procedures. Train the role holders through the CP-3 contingency training program. The output is a role matrix and provider contact list attached to the plan. The step is done when every role has a primary holder and a backup, and each holder can describe the activation steps without consulting the plan.
Test failover and retain results
Test the alternate telecommunications at the frequency set in the contingency plan, using the defined test scenarios. Run a failover from the primary path to the alternate path, measure whether essential functions resume within the agreed resume-within time, and record the start and end times, the people involved, any deviations, and the corrective actions. Review the results with the function owners, correct the gaps, and retest the corrected items. Coordinate with the CP-4 contingency plan testing program so telecommunications results are recorded with the rest of the plan's test evidence. The output is a signed test report, a corrective action list tracked to closure, and retained evidence such as the agreements, the inventory, configuration exports, alert logs and the role matrix. The step is done when the test report and its evidence are stored where an independent assessor can examine them.

How CP-8 enhancements change the work at moderate and high

At the moderate baseline, the CP-8 work is the base requirement plus two enhancements: CP-8(1), priority of service provisions, and CP-8(2), single points of failure. SP 800-53B Release 5.2.0 selects both for moderate and high. CP-8(1) asks you to confirm in writing that your carrier gives your essential circuits priority restoration during an outage, which means the priority of service provisions must be in the contract, not just in a sales deck. Ask the carrier for the specific priority program they enroll you in, the restoration commitments it carries, and whether it applies to both access and backhaul circuits. CP-8(2) asks you to find where a single failure could take out your alternate path. Routing work is the core of it: confirm that primary and alternate circuits do not share a conduit, a building entrance, a cross-connect or an upstream carrier hub. Document each path on the network diagram and the contingency plan so the assessor can trace it.

At the high baseline, two more enhancements apply. CP-8(3) requires separation of primary and alternate providers, so the alternate cannot simply be a second circuit from the same carrier. This drives carrier work: you need a second provider, a different physical route, and a contract that names both. CP-8(4) adds a provider contingency plan, meaning each telecommunications provider must have a documented plan for its own disruption that you have reviewed. Ask each provider for its plan, its restoration targets and its notification process, and confirm that your contingency plan references them. Confirm with your authorizing official whether any of these enhancements are tailored out for your system before you build the evidence set.

CP-8(5) appears in the SP 800-53 Release 5.2.0 catalog with 5 enhancements in total, but the SP 800-53B baselines named in the facts do not select it. Do not assume it is out of scope. Confirm its tailoring status with your authorizing official and record the decision and rationale in the security plan. The evidence for each selected enhancement is the carrier agreement with the priority or separation terms, the route diagram, the provider contingency plans and a test record showing the alternate path actually carries traffic. Your implementation partner can build the diagrams and collect the records, but the organization owns the contracts and the decisions.

Evidence that passes a CP-8 assessment

CP-8 assessors look for proof that alternate telecommunications exist, are contracted, are physically separated and have been exercised. The cards below are parallel artifacts that an assessor can examine, interview against and test, and each one should agree with the others.

Signed telecommunications service agreements

The examine object for CP-8 is the primary and alternate telecommunications service agreements. Collect a signed agreement for each path, confirm that the alternate agreement is in force and covers the service levels the contingency plan depends on, and check that the provider named matches the provider in the network diagram. An agreement that exists only as a quote or an unsigned draft will not satisfy the assessor.

Contingency plan telecommunications section

The contingency plan should name the essential functions that depend on telecommunications and the defined time within which they must resume. Assessors compare that time with the restoration commitments in the carrier agreements. A plan that states a recovery time the contracts cannot meet is a finding even when both documents look complete on their own.

Carrier path separation diagrams

Diagrams should show the primary and alternate circuits, the carriers that supply them, and the physical routes into the primary and alternate sites. Assessors use them to check the single point of failure and provider separation enhancements. Confirm with each carrier that the circuits do not share a conduit, exchange point or upstream provider, and date the diagram so it can be matched to the agreements.

Failover test records with timestamps

Test records show that the alternate path actually carried traffic. Each record should list the trigger, the time the primary failed, the time the alternate took over, the systems verified and any gaps found. Timestamps from the monitoring platform are stronger than manually typed times, so retain the raw alert and metric data behind each entry.

Role assignments and training links

Assessors interview the people named in the contingency plan who hold telecommunications responsibilities and system recovery responsibilities. Keep a current roster that names the carrier contacts, the staff who can order or switch circuits, and their training records. A role that appears in the plan but has no trained holder is the kind of gap interviews tend to expose.

Change records for agreement reviews

When circuits, carriers, sites or routing change, the agreements and diagrams should change with them. Change tickets should show the date the topology changed, the date the agreements and diagrams were reviewed, and who signed off. Missing review records after a topology change are a common reason an otherwise sound alternate path fails an assessment.

What CP-8 costs in money and effort

This table separates the cost components of meeting CP-8, who is paid for each, whether it is one-time or recurring, and what moves it up or down. Circuit and carrier costs depend on carrier quotes, so ask for written quotes for each option before sizing the budget.

Cost component	Who is paid	One-time or recurring	What drives it
Alternate circuit or service contracts	Telecommunications carriers or service providers	Recurring	Number of sites, carrier diversity, bandwidth, and the defined time to resume operations. Obtain carrier quotes; no fixed price applies.
Engineering for design and failover configuration	Internal staff or an implementation partner	One-time, with later changes	Number of essential functions, routing and DNS failover complexity, and whether alternate services are tested in the design phase.
Provider separation and single point of failure review	Internal architects or an implementation partner	One-time, then periodic	Number of providers, shared last-mile paths, and the enhancements selected for the moderate or high baseline.
Monitoring and evidence upkeep	Internal operations or an implementation partner	Recurring	Number of circuits monitored, alert tuning, and how often agreements, contact lists and failover results are refreshed.
External testing or independent review	Independent testers or assessors	Optional, one-time or periodic	Scope of failover tests, whether live circuits are cut over, and whether an outside party reviews the plan. Confirm scope in writing.
Auditor sampling and assessment effort	Independent auditor or assessor, set by the auditor	Periodic	Number of samples the assessor selects, how many services are in scope, and how quickly evidence can be produced.

Open-source monitoring that supports CP-8 evidence

Telecommunications continuity is hard to evidence after the fact because link failures and failovers are often brief and unrecorded. A self-hosted metrics and alerting stack can capture the state of primary and alternate circuits over time, giving assessors dated records to test against the defined recovery time.

Collecting link metrics with Prometheus

Prometheus scrapes metrics from instrumented jobs over HTTP on a pull model and stores them as time series identified by metric name and labels. For CP-8, the useful inputs are link state, latency, packet loss and router or gateway health for both primary and alternate providers. Check that each probe runs from a location independent of the link it measures, and confirm that the retention on the local storage covers the period an assessor will sample.

Querying failover history with PromQL

PromQL lets a team query time series to show when a primary link went down, when traffic moved to the alternate provider and how long recovery took. Saved queries that compute outage duration for each circuit turn raw samples into the statement an assessor reads. Document each query, its owner and the period it covers, so the same calculation can be rerun during testing under CP-4.

Building alert rules in Grafana

Grafana Alerting builds rules from queries and expressions across multiple data sources, so a rule can combine metrics from the monitoring stack with log entries from routers or carrier portals. Set rules for loss of the primary circuit, failed switchover and alternate link degradation. Record the thresholds in the contingency plan so the alerts match the recovery time the organization has defined.

Keeping alert history as evidence

Alert history shows when a rule fired, who was notified and when the condition cleared. Export or retain that history for each test and real event, and tie it to the incident ticket. Ask whether your Grafana version and database retain alert state long enough for the review cycle, and confirm the export format with your assessor before relying on it.

Monitoring does not provide carrier diversity

Monitoring shows that a failure happened and how the failover behaved, but it does not make a second provider exist. CP-8 also depends on provider separation, priority of service arrangements and agreements with carriers. Treat the monitoring stack as the verification layer for those arrangements, and keep the contracts, diverse routing records and provider contingency plans in the evidence set alongside it.

Reviewing AGPL-3.0 obligations for Grafana

Grafana is licensed under AGPL-3.0-only. If the organization modifies Grafana and lets users interact with it over a network, the license may require offering those users the modified source. Ask counsel to review the deployment before any internal changes or custom plugins are offered to outside parties, such as managed service customers or partners. Prometheus is Apache-2.0 and carries different obligations.

Who does what for CP-8

The organization owns CP-8 in full. Telecommunications carriers are contracted by the organization, so the agreements that promise alternate service, and the obligation to keep them current, sit with it. The organization also decides which essential functions need alternate communications, what restoration time it will accept, and whether any residual gap is acceptable as a documented risk decision. Those decisions belong in the contingency plan and the system security and privacy plan, and the people named in them must be the ones who can act during an outage.

Carrier agreements: Hold the primary and alternate telecommunications service agreements, confirm they describe restoration commitments, and track renewal dates.
Contingency plan content: Define the essential operations that depend on telecommunications and the time within which they must resume.
Roles and contacts: Name the personnel with telecommunications responsibilities and keep their contact details current.
Risk acceptance: Record who approves any single point of failure or unmet enhancement, and on what basis.
Testing decisions: Schedule exercises that exercise the alternate path and act on the findings.

Before any engagement, confirm which of these artifacts already exist and who signs them off.

Common CP-8 gaps and how to close them

Most CP-8 findings are not about whether an organization has a backup carrier. They come from paths that share a failure point, agreements that do not say what restoration means, and evidence that exists but cannot be produced on request. Each card names one gap, why an assessor will notice it, and the closing action that addresses it.

Primary and alternate paths share a conduit

An alternate circuit that leaves the same building through the same duct, or terminates on the same carrier exchange, fails with the primary during a cut or a facility outage. CP-8 asks for alternate services that resume essential operations, so the test is whether the second path survives the event that takes out the first. Ask carriers for route diagrams and physical diversity confirmations, then compare them against the sites named in the contingency plan. Close it by documenting separate entry points, separate conduits and separate exchanges for each path.

Agreements silent on restoration time

Service agreements often describe availability in general terms but do not commit the provider to restore service within the window the organization set for essential functions. Without that commitment, the alternate service may exist on paper while the recovery time the plan assumes cannot be met. Check each primary and alternate agreement for restoration commitments, escalation paths and priority handling, and confirm they match the defined time in the plan. Close it by writing the restoration window into each agreement and matching it to the plan.

Failover never tested end to end

Teams often confirm that a backup circuit lights up but never move live traffic, DNS, voice routing or remote access onto it while the application is running. A test that stops at link status does not show whether essential operations resume. Plan an end-to-end failover that covers the applications, identity access and monitoring that depend on the connection, and record the time it takes. Close it by running a documented failover test and keeping the results with the plan.

Contingency plan does not name telecom roles

The contingency plan may describe recovery in general but leave out who contacts carriers, who approves a switch to the alternate path and who holds the account credentials and support numbers. During an outage, that gap causes delay before any restoration work starts. Review the plan for named telecommunications responsibilities, backup contacts and carrier escalation steps, and verify that the people named are trained for their roles. Close it by naming telecommunications roles and backups in the contingency plan.

Out-of-band management on the same path

Administrators often reach firewalls, routers and hypervisors through the same network they are trying to recover. When that network fails, the team cannot reconfigure the alternate path. Confirm that out-of-band management uses a separate provider or medium, and test that administrators can log in and act through it during a simulated primary outage. Close it by provisioning out-of-band access through a separate provider and testing it.

Telecom evidence scattered across portals

Circuit inventories, contract terms, outage notices and test records often sit in separate carrier portals and mailboxes. An assessor who asks for proof of the alternate service then waits while the team gathers it, and the evidence may not match the plan's current version. Keep a single register of circuits, providers, agreement references, test dates and results, and store exported copies alongside the plan in a system the organization controls. Close it by maintaining one evidence register for telecommunications services that the organization hosts.

CP-8 questions buyers ask before hiring help

How much effort does CP-8 telecommunications services take to implement?

The effort depends on how many systems and sites depend on telecommunications, and how many of those dependencies are already documented. CP-8 asks the organization to put alternate telecommunications services in place, with the agreements that make them usable, so that essential operations can resume within a defined time. Most of the work is discovery and contracting rather than engineering: identifying which carriers, circuits and links carry essential functions, confirming where the primary and alternate processing or storage sites depend on them, and then obtaining and reviewing the alternate service agreements. The moderate baseline adds the priority of service and single point of failure enhancements, and the high baseline adds provider separation and provider contingency plan enhancements, so a high-impact system typically takes more analysis than a moderate one. Ask any partner to size the work from your architecture diagrams and provider list, not from a generic template.

Can an in-house team implement CP-8 without outside help?

Yes, an in-house team can implement CP-8 if it has people who understand the network path, the carrier contracts and the recovery plan. The control is owned by the organization, so the people who own telecommunications, contracts and contingency planning have to be involved regardless of who does the technical work. Outside help is most useful where the team lacks time or has not mapped dependencies before, or where a single assessment needs an independent view of whether the design matches the plan. Be clear with yourself about what you need: a documented dependency map, alternate service agreements, a tested failover path and evidence of testing are all things your own staff can produce. An implementation partner can prepare systems and evidence, but it does not issue an assessment result. Only an independent assessor can do that.

What does CP-8 require from our own team before a partner starts?

Before any partner starts, your team needs to provide access to information that only your organization holds. The most important inputs are the list of essential functions, the systems that support them, and the sites where those systems run. You also need the current primary telecommunications service agreements, any existing alternate arrangements, and the contact details of the people who manage carriers and recovery. Expect to name an accountable owner who can approve design decisions and sign off on agreements. If the system contingency plan is out of date, the telecommunications section will be out of date too, so it is worth reviewing it first. Missing or vague inputs are the most common reason fixed-scope work takes longer than planned, so confirm the input list in writing before the scope is signed.

How long does CP-8 implementation take?

NIST does not set a duration for CP-8, and SP 800-53 does not set one for any control. The time required is driven by scope: the number of essential functions, the number of carriers and circuits involved, whether alternate services already exist, how long carrier contracting takes, and whether the high baseline enhancements apply. A single system with one primary carrier and an existing alternate link is a very different project from a multi-site system with several providers and no documented failover. Ask a partner to break the timeline into discovery, design, contracting, testing and evidence collection, and to name which of those steps depend on third parties whose schedules the partner does not control. Carrier lead times are often the longest item and are rarely within the implementer's control.

Can an implementation partner issue the CP-8 assessment?

No. An implementation partner can plan the telecommunications design, help draft agreements and checklists, and collect evidence that shows the control is in place. Only an independent auditor, assessor or certification body can issue a formal assessment result or report. Under the FISMA context NIST references, assessment is performed by independent parties, and the organization's own authorizing official makes the risk decision. Your assessor will test the control against the SP 800-53A procedure, which for CP-8 includes examining the contingency plan and the telecommunications agreements, interviewing the personnel with telecommunications and recovery responsibilities, and testing the mechanisms that support telecommunications. Choose a partner that will prepare you for that examination and be clear about which parts are preparation and which are formal assessment.

Which parts of CP-8 should we outsource and which should we keep?

Keep the decisions and the accountability in-house. The organization must own its risk acceptance, the essential functions it chooses to protect, the recovery time it defines, and the signed agreements with providers. These are not tasks to hand off. Outsourcing makes more sense for work that needs specialist hands: designing and documenting the alternate telecommunications path, building or testing failover mechanisms, configuring monitoring so that a primary link failure is detected quickly, and preparing the evidence package for the assessor. DeployOpen, as an implementation partner, can plan, implement, document and test self-hosted open-source platforms inside your own infrastructure, and can support monitoring with tools such as Prometheus, which collects metrics on a pull model and stores them as time series, and Grafana Alerting, which builds alert rules across data sources. Confirm with any partner that the monitoring coverage matches the telecommunications paths you actually depend on.

How DeployOpen prepares CP-8 for assessment

DeployOpen's part in CP-8 starts with a written scope. Before work begins, we agree which essential functions are in scope, which primary and alternate sites and telecommunications paths the work covers, which provider agreements we will review, and which monitoring and evidence deliverables we will produce. Scope, deliverables and timelines are fixed in writing, so the organization knows what is being prepared and what is not. Any quote follows from that scope. The organization decides which alternate services to buy, which providers to contract with, what the defined time for resumption is, and whether a given residual risk is acceptable. Those decisions stay with the organization.

In the client's own environment, we can configure self-hosted monitoring that shows the state of primary and alternate connectivity. Prometheus can scrape metrics from exporters or instrumented jobs on the links and devices involved, and Grafana Alerting can raise alerts from those metrics alongside log-based signals. Teams that want this evidence to support CP-8 should confirm which link states, latency and failover events their assessor expects to see, and that the alert history is retained. We also prepare failover test evidence: test plans that reflect the defined resumption time, records of each switch-over from primary to alternate service, timestamps, outcomes, and corrective actions. The assessor will examine the provider agreements and the contingency plan, interview the people with telecommunications and recovery responsibilities, and test the mechanisms, so the documentation must match what actually happens.

We support the client's team through the assessment preparation, including walking through the examine, interview and test objects with the people who hold those responsibilities. DeployOpen does not issue audit reports, attestations or certifications. Only an independent assessor or authorizing body can reach those conclusions. The organization owns its contingency plan, its telecommunications agreements, its risk decisions and its evidence. Ask any partner to show, in writing, which artifacts they will prepare and which remain the client's responsibility before the engagement starts.