SC-47 Alternate communications paths: requirements and evidence

SC-47 alternate communications paths: what the requirement asks for

If SC-47 sits in your tailored control set or in an assessor's scope, the requirement asks you to define backup channels for operational command and control and to establish them so they remain usable when primary communications are compromised or unavailable. SP 800-53B does not assign SC-47 to any security or privacy baseline, so it appears in your scope only because your organization selected it through tailoring or an overlay, or because a higher authority or contract did. Confirm which of those applies before you spend effort on it, because the answer decides who must defend the decision to an assessor.

The underlying risk is simple to state and easy to underestimate. Operators lose the ability to issue commands, change configurations or coordinate response when the primary network is degraded, cut off or under an adversary's control. The control has one organization-defined parameter, which is the set of alternate paths and the conditions under which you use them, and no control enhancements. That structure means the organization carries nearly all of the definition work. SP 800-53A assesses SC-47 through a single determination statement, and the examine objects it names (system design documentation, configuration settings and audit records) show that an assessor will look for a written design, configured paths and proof that the paths were used or tested.

Evidence is hard to produce because "command and control" is not self-defining. Before you write the parameter, decide which functions count: for example, remote administration of hypervisors, firewall management, security monitoring consoles or emergency shutdown. Then map each function to a named primary path, a named alternate path, the owner of each and the trigger for switching. Confirm with your system owner and your contingency planning team (the CP family, including CP-2 and CP-8, is the related control set in the Release 5.2.0 catalog) whether those alternates overlap with contingency telecommunications, because a shared path can fail in the same event as the primary one.

Which systems and functions SC-47 covers once selected

SC-47 only creates work once an organization selects it, either through baseline tailoring or an overlay. The cards below cover the scoping decisions that determine how much of the system, its sites and its providers the control touches, and how related controls in the CP family shape the same evidence.

Operational command and control functions

Start by listing the functions that must keep running when primary communications fail, such as issuing operational commands, coordinating recovery teams, and directing failover of other systems. SC-47 asks for defined alternate paths for these organizational command and control functions, so a vague list of "critical operations" will not give an assessor anything to test. Record each function, its owner and the minimum acceptable delay before it is needed.

Systems and sites that depend on those functions

Map every system, facility and operator console that relies on the command and control functions identified above. Dependencies often sit in places teams do not expect, such as a management network used to reach a backup site or an out-of-hours on-call path. Each dependency should trace to a documented path in the system design documentation, because an assessor will examine it.

Primary and alternate carriers

Identify every third party that provides primary or alternate carriers, including internet transit, telecom circuits, satellite or radio services and cloud network connectivity. Two circuits from the same provider over the same conduit may not be independent, so confirm physical and provider diversity with each carrier. Ask each provider for its own service terms and restoration commitments in writing, and confirm them yourself rather than assuming them.

Tailoring and overlay decisions

SC-47 is not assigned to any SP 800-53B baseline, so it enters a system only when the organization selects it during tailoring or when an overlay includes it. Record that decision and its rationale in the system security and privacy plan, including the organization-defined parameter that sets the paths to be defined. Without that record, the control will look omitted rather than deliberately scoped.

Related contingency controls

SC-47 is related to CP-2 (contingency plan) and CP-8 (telecommunications services). The contingency plan should name the alternate communications paths, and the telecommunications controls should show how carriers and restoration priorities are managed. Reviewing these three controls together avoids a common gap where the path is documented in one place and the contingency test never exercises it.

FedRAMP Rev5 treatment

FedRAMP's Rev5 baselines at Class B, C and D do not require SC-47, so cloud service offerings at those classes will not normally carry it unless the agency or the provider adds it. Organizations that inherit a FedRAMP authorization should confirm whether any agency requirement adds SC-47 on top of the baseline. Check the provider's control implementation statement before assuming coverage.

How an assessor tests SC-47

This table maps the single SC-47 determination statement in SP 800-53A Release 5.2.0 to the examine, interview and test methods an assessor applies, with the evidence and common findings for each. Read it as a checklist of what to prepare before an assessor arrives, since the procedure depends on whether the alternate path is defined in documents and proven in practice.

Assessment element	What the assessor does	Evidence that passes or fails
Determination statement	Confirms the organization defined alternate communication paths for system operations organizational command and control, as the one determination statement requires	Passes when the defined paths are named in documentation tied to the system; fails when the organization cannot identify any alternate path
Examine: system design documentation	Reads the architecture and design material to see where the alternate path sits relative to the primary channel and which command and control functions it carries	Passes with diagrams and narrative that show the alternate path, its endpoints and its purpose; fails when the design is silent on fallback
Examine: configuration settings and associated documentation	Checks that the alternate path is configured as described, including routing, access settings and the conditions under which traffic moves to it	Passes when configuration matches the documented design; fails when settings drift from the documents or the path is documented but never configured
Examine: system audit records	Reviews logs for evidence that the alternate path has been used, exercised or switched during failover events or tests	Passes with records of test or real switchover events; fails when no records exist, which leaves the assessor unable to verify operation
Interview: system and network administrators	Asks how command and control moves to the alternate path, who can trigger it and how they would know the primary channel had failed	Passes when answers match the documents and the procedure is known to operators; fails when staff describe a different process
Interview: operations and continuity personnel	Confirms who holds authority to invoke the alternate path during an incident and how that decision links to contingency plans	Passes when roles and decision points are consistent across plans and staff; fails when no one is clearly accountable
Test: alternate path activation	Observes or witnesses a controlled switch from the primary channel to the alternate path and confirms that command and control functions still work	Passes when the switch completes and operators can issue commands over the alternate path; fails when the path is unreachable or lacks needed functions
Common finding: undefined path	Assessor finds that the organization relies on an informal backup, such as a phone bridge, without defining it in the system's documentation or boundary	Typically resolved by documenting the path, its scope and its owner in the system security plan and design records
Common finding: untested failover	The alternate path exists and is documented, but no test records show it was ever used, so its availability during an outage is unproven	Typically resolved by scheduling and recording periodic exercises with dated audit records and documented results

Implementing SC-47 in sequence

This sequence turns SC-47 from a policy statement into a defined set of alternate command and control channels that an assessor can trace from design to failover test. Each step names what the organization owns and the record that proves the step is complete.

Define command and control functions
The organization, usually through the system owner and operations lead, lists the operational command and control functions the system must keep running when primary communications fail. Examples include issuing configuration changes, halting or isolating services, and receiving status from remote sites. Record each function with its owner, the system components it depends on, and the consequence of losing it. The step is done when the list is approved and every function maps to a named component. Illustrative: a control room may need to halt a message queue even if its usual management network is down.
Set the organization-defined parameter
SC-47 has one organization-defined parameter, so the organization must state what it means by defined alternate communication paths for each function. The decision covers which paths qualify, who may use them, and the conditions that trigger their use. Write these values into the system security and privacy plan so the assessor can compare them with the implementation. The step closes when the parameter value is approved by the authorizing official or the designated risk owner and matches the plan text.
Select and document alternate channels
Choose the alternate paths, such as a separate out-of-band management network, a cellular or satellite link, or a dedicated console, based on the functions and threats identified earlier. Document each channel's endpoints, the components it reaches, its dependencies on the primary infrastructure, and any shared failure points. Common causes of hidden dependence include a shared DNS resolver or identity provider. The output is a channel register and an architecture diagram. Confirm the diagram with the infrastructure team, since a path that shares a single upstream provider may not be an independent alternative.
Configure and isolate the channels
Build the alternate paths in the organization's own environment, applying the separation rules that keep them independent of the primary network. Restrict access to named administrators, enforce authentication on each channel, and block traffic that is not needed for command and control. Store configuration as code or baseline files so changes are tracked. The step is complete when configuration exports, firewall or routing rules, and access lists are saved with dates and reviewed by a second engineer. Confirm with the boundary and identity owners that the channels do not bypass boundary protection controls unintentionally.
Test failover against CP-2 and CP-8
Run a controlled test in which the primary communications path is removed or degraded and the operations team uses each alternate channel to perform the functions listed in step one. Plan the test within the contingency plan (CP-2) and link it to the telecommunications arrangements that CP-8 addresses, so that the test shows whether the alternate path works in practice. Record start and end times, who performed each action, what succeeded, and what failed. The step is complete when failures have tickets in the plan of action and milestones and the contingency plan is updated with lessons learned.
Record the evidence for each step
Collect the artifacts that an assessor will examine: design documentation, configuration settings with their change history, audit records showing channel access and use, and the test report. Map each artifact to the SC-47 determination statement in SP 800-53A so the examiner can find it without interviews. Store the evidence in a controlled repository with retention rules. The step is done when an internal reviewer can trace one channel from the parameter value to a logged failover test without help from the author. Ask the independent assessor which artifact formats and sampling they expect before the test begins.
Reassess after changes
Whenever the primary network, identity provider, DNS or the alternate channels change, repeat the affected steps: confirm the functions still map to channels, update the parameter if the scope changed, retest failover, and refresh the evidence. Track these reviews through the configuration change process and the continuous monitoring plan. The step closes when the change record links to updated documentation and a dated test result. Confirm the review trigger list with the authorizing official so reassessment is not left to memory.

Evidence that passes an SC-47 assessment

An SC-47 assessor looks for proof that alternate communication paths were designed, configured and exercised, not just named in a policy. The cards below cover the artifacts that connect those paths to operational command and control, and the upkeep that keeps them accurate between assessments. The organization owns this evidence, and an independent assessor decides whether it passes.

Design documentation naming the paths

The assessor first looks for design documentation that names each alternate communication path used for organizational command and control, along with the primary path it backs up and the conditions that trigger a switch. Check that the document states which operational functions each path carries, who can invoke it, and how it stays separate from the primary network so one compromise does not remove both. Each path should trace to the organization-defined parameter for SC-47 in the system security and privacy plan. A diagram alone rarely satisfies this on its own.

Configuration settings and their documentation

Assessors expect configuration evidence showing that each alternate path is actually provisioned, such as routing tables, failover rules, console or out-of-band management settings, and credentials stored in the approved location. Pair each setting export with a short document explaining what it does and who approves changes to it. Ask whether the configuration baseline records the alternate path so that drift from it is detected. Exports should be dated and taken from the running system, not reconstructed from memory.

Audit records of tests and activations

Audit records show that the alternate path works when it is needed. Keep logs of scheduled tests, unplanned activations and the operators who performed them, with timestamps taken from synchronized clocks so the sequence of events can be reconstructed. A test record should state the path tested, the result, the time to restore primary communications and any defects raised. Assessors look for evidence of a failed test followed by a corrective action, because a clean history with no findings can seem unlikely.

Test plans and exercise results

A test plan defines what the organization will prove about each alternate path, how often it will be exercised and which scenarios apply, such as loss of the primary carrier or a compromised management network. Results should record the pass or fail outcome against each stated objective. Ask whether the exercises involve the people who would use the path in a real incident, since an assessor may interview them to confirm they know the procedure. The contingency plan and exercise records should cross-reference each other.

Keeping evidence current between assessments

Evidence goes stale when a network changes after the design document is signed. Assign an owner to review the alternate path documentation whenever the primary network, carriers, identity providers or the system boundary change, and record each review date. Tie configuration exports and test records to change tickets so each modification has a documented reason and approval. Continuous monitoring is the natural place for this, and the plan of action and milestones should track any path that failed testing until it is closed.

Ownership and independent judgment

The organization owns SC-47 and every artifact that proves it. An implementation partner can help design the paths, configure them, prepare the test scripts and organize the records, but it does not decide whether the control is met. An independent assessor reviews the evidence, interviews staff and tests the paths, then reports findings. Confirm early which assessor the authorizing or contracting body accepts and what format it expects for evidence, since those requirements vary by program.

How alternate paths fit with contingency planning

SC-47 is the system-side control that says which alternate communication paths exist for operational command and control, while CP-2 contingency planning and CP-8 telecommunications services explain why those paths matter and how they are kept available. The contingency plan is the document that sets recovery objectives and roles, and it should name the command and control functions that must keep working when the primary channel is compromised or unavailable. The alternate path design then answers that requirement. Each path listed in the plan should map to a defined SC-47 path in the system design documentation, and the plan should state who uses it, what it carries and how operators switch to it. Assessors examine the design documentation, configuration settings and audit records for SC-47, so a path that appears in the design but not in the plan, or in the plan but not in the configuration, is a finding waiting to happen.

CP-8 covers the telecommunications services that support the alternate path, such as diverse carriers, separate physical routes or alternate service agreements. Those decisions belong in the design and in the contingency plan together. Before relying on a path, confirm with your telecommunications providers which services are actually diverse, whether they share a conduit or upstream provider, and what the restoration commitments are in your contracts. Those facts are owned by your providers and your procurement team, so ask for them in writing rather than assuming separation from a diagram. Traceability works best when each alternate path has a single record that links the SC-47 design element, the CP-2 plan section, the CP-8 service agreement and the most recent test result. An implementation partner can help build and maintain that trace, but the organization owns the decision on which paths are sufficient for its mission.

What meeting SC-47 costs in money and effort

This table breaks down the cost and effort components of establishing and evidencing alternate communications paths under SC-47, showing who is paid, whether each cost is one-time or recurring, and what drives it. Use it to build a written scope and to ask each bidder for the same line items. No figures are given because none are supplied for this control, so every number should come from a quote against your own requirements.

Cost component	One-time or recurring	What drives it up or down	What to ask for in a quote
Carrier, radio or satellite service contracts	Recurring	Number of sites and endpoints, bandwidth needed for command traffic, contract term and whether service is dedicated or shared	Monthly service line items per path, termination terms, and the provider's stated restoration behavior
Hardware for the alternate path	One-time, with refresh cycles	Radio or satellite terminal count, ruggedization for the operating environment, spares held on site	Bill of materials, lifecycle and replacement terms, and whether equipment is owned or leased
Engineering to define and isolate the path	One-time	Number of command and control functions covered, how far the path must stay independent of the primary network, and existing network segmentation	Written design covering routing, isolation from the primary path, and the parameter values the organization must define
Test exercises of the alternate path	Recurring (per exercise cycle)	How often the organization tests, whether tests include live activation of the path, and how much coordination with operations staff is needed	Test plan, exercise scope, success criteria, and the reporting format delivered after each test
Evidence upkeep	Recurring	Frequency of configuration changes to the path, number of sites, and how much evidence is collected automatically from system logs and configuration records	Evidence list mapped to examine objects such as design documentation, configuration settings and audit records, plus the update schedule
Assessor sampling and assessment support	Recurring (per assessment cycle)	Assessor scope, number of sampled sites or exercises, and whether the assessor needs walkthroughs of the alternate path	Assessor's stated sampling approach and the organization's own estimate of staff time for interviews and evidence requests
Scope definition and tailoring decision	One-time, revisited on change	SC-47 is not in any SP 800-53B baseline, so cost depends on whether the organization or its authorizing body selects it	Written justification for selecting SC-47 and the systems it covers, with the related CP-2 and CP-8 contingency work identified

Where organizations fall short on SC-47

SC-47 asks for defined alternate paths that keep operational command and control working when the primary channel fails. Most shortfalls come from paths that were never specified, exercised or written into the contingency plan, so the cards below pair each gap with the check that closes it.

Command and control functions never defined

Many organizations say they have a backup channel without listing which command and control functions must survive. SC-47 requires the paths to be defined for system operations, so start with an inventory of the functions operators must perform during an outage, such as shutting down services, isolating segments, revoking access and restoring configuration. For each function, record the path that carries it, the operator who uses it and the systems it reaches. An assessor will ask for this list first.

Alternate path shares the primary failure point

A second link that runs through the same firewall, identity provider, DNS service or management network as the primary will fail with it. This is the most common weakness in practice. Map each alternate path to the components it depends on and compare that list with the primary's dependencies. Where they overlap, choose a path that uses a separate carrier, network segment or authentication source, and document the shared components that remain.

Paths never exercised

A channel that has not been used for operations is unlikely to work when needed. Credentials may have expired, certificates may be missing from the backup jump host, or the operator may not remember the procedure. Schedule periodic exercises where operators actually connect over the alternate path and issue the defined commands, then record the result, the time taken and any failure. Exercise results give the assessor concrete evidence that the path works, not just that it exists.

Missing configuration records

Alternate paths often live in a runbook, a personal note or an administrator's memory rather than in controlled configuration. Without records of the routing, accounts, hardware tokens, firewall rules and endpoint software for each path, nobody can prove what was configured or detect drift. Keep configuration settings and their documentation under change control, and retain audit records showing who changed them. Assessors test SC-47 partly by examining these settings and records.

Contingency plan does not reference the paths

If the contingency plan and incident response procedures describe recovery without naming the alternate channel, operators will improvise during a real event. Check that the plan identifies each alternate path, its owner, the activation criteria and the order in which operators switch channels. Related controls in the CP family cover telecommunications and contingency testing, so the paths should appear in the same test scenarios and the same after-action records.

Authority to use paths not assigned

During an incident, the person who needs an alternate path may not be the person who administers it. Unclear ownership delays activation and leaves credentials unmanaged. Assign each path a named owner, define who may authorize its use, and state how access is granted and revoked after the event. Confirm with your own assessor which roles and approvals they expect to see recorded, since SC-47 does not prescribe them.

Who does what for SC-47

The organization owns SC-47 and every decision that makes it real. SC-47 asks for defined alternate communication paths for organizational command and control of system operations, and SP 800-53 leaves the definition to the organization. Because SP 800-53B does not assign SC-47 to any baseline, the organization must first decide whether the control is selected at all, through tailoring or an overlay, and record that decision in its security plan.

Parameter definition: Set the organization-defined parameter, which names the alternate paths, the operations they support and the conditions that trigger their use.
Carrier selection: Choose the alternate carriers, such as a separate network, a satellite or cellular link, or an out-of-band console, and accept the risk each one carries.
Authority and procedure: Name who may invoke an alternate path and document the switchover steps in the contingency and incident procedures.
Acceptance of residual risk: Sign off on what the alternate path does not cover, since no path is immune to the same disruption.
Ongoing ownership: Review the carriers when the network or the threat picture changes.

Before any outside party begins work, confirm that the organization can state which paths it has chosen and who approved them.

SC-47 questions buyers ask before hiring help

How much does meeting SC-47 cost and what drives the price?

No supplied figure exists for SC-47 work, so no price applies here. The cost is driven by how many communication paths the organization must define, how many systems depend on them, and how much of the design already exists. The organization pays for its own staff time to define mission-critical command and control traffic, test failover, and keep records. A partner, if used, is paid for the scoped engineering and documentation work, which is quoted from a written scope. Ask any provider to break the quote into design, build, testing and evidence preparation, and to state which items recur each year, such as failover tests and record reviews. Assessor fees are separate and come from the independent assessor, not from the implementation partner.

How long does SC-47 implementation take?

No supplied duration exists for this control, so confirm timing against your own environment. The schedule depends on whether alternate paths already exist, how many operational functions need them, and whether the paths must be built from scratch or documented on top of existing carriers. Dependencies include agreement on which command and control functions are critical, access to network and telecommunications teams, change approval for new links, and time to run a test that proves the alternate path works. Fixed-scope engagements agree deliverables and timelines in writing before work starts, so ask for the schedule to be tied to those milestones.

What does SC-47 require from our internal team?

The internal team must make decisions that only the organization can make. These include naming the operational command and control functions that must survive a compromise or outage, approving which alternate channels are acceptable, and setting who may activate them. Network, telecommunications and operations staff need to confirm how each path is physically and logically separate from the primary channel. Security staff must own the policy and the records that show the paths were tested. Engineers will need access to configuration settings and design documentation, because an assessor examines those artifacts directly.

Can we implement SC-47 ourselves without outside help?

Yes, an organization can implement SC-47 with its own staff, because the control is about defining and proving alternate paths, not about buying a specific product. Internal teams are well placed when they already run the operational systems and understand their dependencies. Outside help is most useful when the team lacks time, when the paths cross many systems, or when evidence must be assembled in a consistent form for an assessor. The organization remains accountable for its controls either way. Any partner prepares systems and evidence, while only an independent assessor issues a report.

Is SC-47 required for our system?

SC-47 is not in any SP 800-53B baseline, so it is required only when your organization selects it through tailoring or an overlay. Appendix C of SP 800-53 Rev. 5 lists it as implemented by the organization and the system. FedRAMP's Rev5 baselines do not require it at Class B, C or D. Whether it applies depends on your authorizing official's decisions, your contract language, and the mission risk of losing command and control. Check the system's security plan and tailoring decisions before assuming it applies, and confirm with the authorizing body if a framework or customer requires it.

What does DeployOpen do for SC-47 and what does the assessor do?

DeployOpen plans, implements and documents systems inside your own infrastructure, and prepares the configurations, design records and test evidence that support SC-47 under a written scope. The organization owns the control, its decisions about which paths are alternate and which functions they serve, and its risk acceptance. An independent auditor, assessor or certification body is the only party that tests the control and issues a report or certificate. DeployOpen does not issue audit reports, attestations or certifications, and it does not assess controls on the organization's behalf.

What evidence will an assessor ask to see for SC-47?

The assessment procedure for SC-47 has one determination statement and uses examine, interview and test methods. Examine objects include system design documentation, system configuration settings with their documentation, and system audit records. In practice, that means a design record showing each defined alternate path, configuration exports for the channels, and audit records or test logs showing the paths were used or exercised. Interviews check whether operators know how to activate them. Keep these artifacts current, because an assessor compares them with the system as it runs today.

What are the main risks if SC-47 is done poorly?

The main risk is a backup channel that shares the same failure point as the primary one, such as a common carrier, network segment or administrative account. Other risks include paths that were never tested, activation procedures that operators do not know, and configuration drift that leaves an alternate channel disabled or misrouted. An assessor will look for evidence that paths work as designed, so untested paths often produce open findings. Ask any provider how they will test failover, record results, and handle changes to the primary channel that could affect the alternate.

How DeployOpen prepares SC-47 evidence

DeployOpen plans, builds and documents self-hosted open-source platforms inside the client's own infrastructure, including the backup command and control channels that SC-47 asks an organization to define. The organization owns the control and its risk decisions, DeployOpen prepares the systems and evidence, and an independent assessor reaches the conclusion.

How we scope

Confirm with the organization whether SC-47 is selected through tailoring or an overlay, since no SP 800-53B baseline includes it.
Agree in writing which operational command and control functions need an alternate path and which primary channels they depend on.
Record the scope, deliverables and timelines in a fixed-scope written agreement before any work starts.
Identify the related contingency planning controls CP-2 and CP-8 so the alternate path matches recovery plans.

How we build

Design the alternate communications path in the client's own environment, documenting which systems it covers and how it is activated.
Configure and harden the self-hosted platforms that carry the alternate channel, including access restrictions and logging.
Test failover from the primary channel to the alternate path and record the results against the defined parameter values.
Integrate the alternate path with the organization's existing monitoring so that its availability and use are visible.

How we hand over

Document the system design, configuration settings and their rationale, the artifacts an SP 800-53A examination reviews for SC-47.
Export audit records and test records that show the alternate path works and that its use is traceable.
Provide runbooks for activating and deactivating the alternate path, with named roles agreed with the organization.
Deliver the evidence package to the organization, which decides whether it meets its own requirements and passes it to its independent assessor.

How we support

Offer ongoing support, upgrades and testing of the alternate path as a retainer, scoped separately from the original project.
Repeat failover tests after significant changes to the primary channel, the platforms or the contingency plan.
Update configuration documentation and evidence when NIST releases changes to SP 800-53 or SP 800-53A.
Confirm with the organization which assessment cycle, reviewers and retention periods apply to its SC-47 evidence.