NIST SP 800-53A

Special Publication 800-53A	Guide for Assessing the Security Controls in
	Federal Information Systems and Organizations

________________________________________________________________________________________________

FAMILY: CONTINGENCY PLANNING			CLASS: OPERATIONAL
		ASSESSMENT PROCEDURE
CP-2	CONTINGENCY PLAN
CP-2.1	ASSESSMENT OBJECTIVE:
	Determine if:
	(i)	the organization develops a contingency plan for the information system that:
		- identifies essential missions and business functions and associated contingency
		requirements;
		- provides recovery objectives, restoration priorities, and metrics;
		- addresses contingency roles, responsibilities, assigned individuals with contact
		information;
		- addresses maintaining essential missions and business functions despite an
		information system disruption, compromise, or failure; and
		- addresses eventual, full information system restoration without deterioration of
		the security measures originally planned and implemented; and
		- is reviewed and approved by designated officials within the organization;
	(ii)	the organization defines key contingency personnel (identified by name and/or by
		role) and organizational elements designated to receive copies of the contingency
		plan; and
	(iii)	the organization distributes copies of the contingency plan to organization-defined
		key contingency personnel and organizational elements.
	POTENTIAL ASSESSMENT METHODS AND OBJECTS:
	Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations
		for the information system; contingency plan; security plan; other relevant documents or
		records].
	Interview: [SELECT FROM: Organizational personnel with contingency planning and plan
		implementation responsibilities].
CP-2.2	ASSESSMENT OBJECTIVE:
	Determine if:
	(i)	the organization coordinates contingency planning activities with incident handling
		activities:
	(ii)	the organization defines the frequency of contingency plan reviews;
	(iii)	the organization reviews the contingency plan for the information system in
		accordance with the organization-defined frequency;
	(iv)	the organization revises the contingency plan to address changes to the
		organization, information system, or environment of operation and problems
		encountered during contingency plan implementation, execution or testing; and
	(v)	the organization communicates contingency plan changes to the key contingency
		personnel and organizational elements as identified in CP-2.1 (ii).

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations for the information system; contingency plan; security plan; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with incident handling responsibilities].

APPENDIX F-CP

PAGE F-111

Special Publication 800-53A	Guide for Assessing the Security Controls in
	Federal Information Systems and Organizations

________________________________________________________________________________________________

CP-2(1) CONTINGENCY PLAN

CP-2(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization coordinates the contingency plan development with other organizational elements responsible for related plans.

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations for the information system; contingency plan; other related plans; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities and responsibilities in related plan areas].

CP-2(2) CONTINGENCY PLAN

CP-2(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization conducts capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations for the information system; contingency plan; capacity planning documents; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities].

CP-2(3) CONTINGENCY PLAN

CP-2(3).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines the time period for planning the resumption of essential missions and business functions as a result of contingency plan activation; and

(ii)the organization plans for the resumption of essential missions and business function within organization-defined time period of contingency plan activation.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations for the information system; contingency plan; security plan; business impact assessment; other related plans; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities].

APPENDIX F-CP

PAGE F-112

Special Publication 800-53A	Guide for Assessing the Security Controls in
	Federal Information Systems and Organizations

________________________________________________________________________________________________

CP-2(4) CONTINGENCY PLAN

CP-2(4).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines the time period for planning the full resumption of affected missions and business functions as a result of contingency plan activation; and

(ii)the organization plans for the full resumption of affected missions and business functions within organization-defined time period of contingency plan activation.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations for the information system; contingency plan; security plan; business impact assessment; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities].

CP-2(5) CONTINGENCY PLAN

CP-2(5).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization plans for the continuance of essential missions and business functions with little or no loss of operational continuity; and

(ii)the organization sustains operational continuity until full information system restoration at primary processing and/or storage sites.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations for the information system; contingency plan; business impact assessment; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities].

CP-2(6) CONTINGENCY PLAN

CP-2(6).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization provides for the transfer of all essential missions and business functions to alternate processing and/or storage sites with little or no loss of operational continuity; and

(ii)the organization sustains operational continuity through restoration to primary processing and/or storage sites.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations for the information system; contingency plan; alternate processing site agreements; alternate storage site agreements; contingency plan testing and/or exercise documentation; contingency plan test results; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities].

APPENDIX F-CP

PAGE F-113

Special Publication 800-53A	Guide for Assessing the Security Controls in
	Federal Information Systems and Organizations

________________________________________________________________________________________________

FAMILY: CONTINGENCY PLANNING			CLASS: OPERATIONAL
		ASSESSMENT PROCEDURE
CP-3	CONTINGENCY TRAINING
CP-3.1	ASSESSMENT OBJECTIVE:
	Determine if:
	(i)	the organization provides initial contingency training to personnel with contingency
		roles and responsibilities with respect to the information system;
	(ii)	the organization defines the frequency of refresher contingency training; and
	(iii)	the organization provides refresher training in accordance with organization-
		defined frequency.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing contingency training; contingency training curriculum; contingency training material; security plan; contingency training records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, and training responsibilities].

CP-3(1) CONTINGENCY TRAINING

CP-3(1).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization incorporates simulated events into contingency training; and

(ii)the incorporation of simulated events into contingency training facilitates effective response by personnel in crisis situations.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing contingency training; contingency training curriculum; contingency training material; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, and training responsibilities].

CP-3(2) CONTINGENCY TRAINING

CP-3(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms that provide a more thorough and realistic contingency training environment.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing contingency training; automated mechanisms supporting contingency training; contingency training curriculum; contingency training material; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, and training responsibilities].

APPENDIX F-CP

PAGE F-114

Special Publication 800-53A	Guide for Assessing the Security Controls in
	Federal Information Systems and Organizations

________________________________________________________________________________________________

FAMILY: CONTINGENCY PLANNING			CLASS: OPERATIONAL
		ASSESSMENT PROCEDURE
CP-4	CONTINGENCY PLAN TESTING AND EXERCISES
CP-4.1	ASSESSMENT OBJECTIVE:
	Determine if:
	(i)	the organization defines the contingency plan tests and/or exercises to be conducted;
	(ii)	the organization defines the frequency of contingency plan tests and/or exercises;
	(iii)	the organization tests/exercises the contingency plan using organization-defined
		tests/exercises in accordance with organization-defined frequency; and
	(iv)	the organization reviews the contingency plan test/exercise results and takes
		corrective actions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan, procedures addressing contingency plan testing and exercises; security plan; contingency plan testing and/or exercise documentation; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with responsibilities for reviewing or responding to contingency plan tests/exercises].

CP-4(1) CONTINGENCY PLAN TESTING AND EXERCISES

CP-4(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization coordinates contingency plan testing and/or exercises with organizational elements responsible for related plans.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing contingency plan testing and exercises; contingency plan testing and/or exercise documentation; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, and testing responsibilities; organizational personnel with responsibilities for related plans].

CP-4(2) CONTINGENCY PLAN TESTING AND EXERCISES

CP-4(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization conducts contingency plan testing/exercises at the alternate processing site to familiarize contingency personnel with the facility and available resources and to evaluate the site’s capabilities to support contingency operations.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan, procedures addressing contingency plan testing and exercises; contingency plan testing and/or exercise documentation; contingency plan test results; other relevant documents or records].

APPENDIX F-CP

PAGE F-115

Special Publication 800-53A	Guide for Assessing the Security Controls in
	Federal Information Systems and Organizations

________________________________________________________________________________________________

CP-4(3) CONTINGENCY PLAN TESTING AND EXERCISES

CP-4(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to more thoroughly and effectively test/exercise the contingency plan by providing more complete coverage of contingency issues, selecting more realistic test/exercise scenarios and environments, and more effectively stressing the information system and supported missions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing contingency plan testing and exercises; automated mechanisms supporting contingency plan testing/exercises; contingency plan testing and/or exercise documentation; other relevant documents or records].

CP-4(4) CONTINGENCY PLAN TESTING AND EXERCISES

CP-4(4).1 ASSESSMENT OBJECTIVE:

Determine if the organization includes a full recovery and reconstitution of the information system to a known state as part of contingency plan testing.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing information system recovery and reconstitution; contingency plan testing and/or exercise documentation; contingency plan test results; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system recovery and reconstitution responsibilities; organizational personnel with contingency plan testing and/or exercise responsibilities].

APPENDIX F-CP

PAGE F-116

Special Publication 800-53A	Guide for Assessing the Security Controls in
	Federal Information Systems and Organizations

________________________________________________________________________________________________

FAMILY: CONTINGENCY PLANNING		CLASS: OPERATIONAL
	ASSESSMENT PROCEDURE
CP-5	CONTINGENCY PLAN UPDATE
	[Withdrawn: Incorporated into CP-2].
CP-5.1	ASSESSMENT OBJECTIVE:
	[Withdrawn: Incorporated into CP-2].
	POTENTIAL ASSESSMENT METHODS AND OBJECTS:
	[Withdrawn: Incorporated into CP-2].
CP-5.2	ASSESSMENT OBJECTIVE:
	[Withdrawn: Incorporated into CP-2].
	POTENTIAL ASSESSMENT METHODS AND OBJECTS:
	[Withdrawn: Incorporated into CP-2].

APPENDIX F-CP

PAGE F-117

Special Publication 800-53A	Guide for Assessing the Security Controls in
	Federal Information Systems and Organizations

________________________________________________________________________________________________

FAMILY: CONTINGENCY PLANNING			CLASS: OPERATIONAL
		ASSESSMENT PROCEDURE
CP-6	ALTERNATE STORAGE SITE
CP-6.1	ASSESSMENT OBJECTIVE:
	Determine if :
	(i)	the organization establishes an alternate storage site; and
	(ii)	the organization initiates necessary alternate storage site agreements to permit the
		storage and recovery of information system backup information.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing alternate storage sites; alternate storage site agreements; other relevant documents or records].

CP-6(1) ALTERNATE STORAGE SITE

CP-6(1).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the contingency plan identifies the primary storage site hazards; and

(ii)the alternate storage site is separated from the primary storage site so as not to be susceptible to the same hazards identified at the primary site.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing alternate storage sites; alternate storage site; other relevant documents or records].

CP-6(2) ALTERNATE STORAGE SITE

CP-6(2).1 ASSESSMENT OBJECTIVE:

Determine if the alternate storage site is configured to facilitate recovery operations in accordance with recovery time objectives and recovery point objectives.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing alternate storage sites; alternate storage site agreements; alternate storage site; other relevant documents or records].

APPENDIX F-CP

PAGE F-118

Special Publication 800-53A	Guide for Assessing the Security Controls in
	Federal Information Systems and Organizations

________________________________________________________________________________________________

CP-6(3)	ALTERNATE STORAGE SITE
CP-6(3).1	ASSESSMENT OBJECTIVE:
	Determine if:
	(i)	the organization identifies potential accessibility problems to the alternate storage
		site in the event of an area-wide disruption or disaster; and
	(ii)	the organization outlines explicit mitigation actions for organization identified
		accessibility problems to the alternate storage site in the event of an area-wide
		disruption or disaster.
	POTENTIAL ASSESSMENT METHODS AND OBJECTS:
	Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing
		alternate storage sites; alternate storage site; mitigation actions for accessibility problems to
		the alternate storage site; other relevant documents or records].

APPENDIX F-CP

PAGE F-119

Special Publication 800-53A	Guide for Assessing the Security Controls in
	Federal Information Systems and Organizations

________________________________________________________________________________________________

FAMILY: CONTINGENCY PLANNING			CLASS: OPERATIONAL
		ASSESSMENT PROCEDURE
CP-7	ALTERNATE PROCESSING SITE
CP-7.1	ASSESSMENT OBJECTIVE:
	Determine if:
	(i)	the organization establishes an alternate processing site;
	(ii)	the organization defines the time period for achieving the recovery time objectives
		within which processing must be resumed at the alternate processing site;
	(iii)	the organization includes necessary alternate processing site agreements to permit
		the resumption of information system operations for essential missions and business
		functions within organization-defined time period; and
	(iv)	the equipment and supplies required to resume operations are available at the
		alternate site or contracts are in place to support delivery to the site in time to
		support the organization-defined time period for resumption.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing alternate processing sites; alternate processing site agreements; security plan; spare equipment and supplies at alternate processing site; equipment and supply contracts; service level agreements; other relevant documents or records].

CP-7(1) ALTERNATE PROCESSING SITE

CP-7(1).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the contingency plan identifies the primary processing site hazards; and

(ii)the alternate processing site is separated from the primary processing site so as not to be susceptible to the same hazards identified at the primary site.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing alternate processing sites; alternate processing site; other relevant documents or records].

CP-7(2) ALTERNATE PROCESSING SITE

CP-7(2).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster; and

(ii)the organization outlines explicit mitigation actions for organization identified accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing alternate processing sites; alternate processing site; other relevant documents or records].

APPENDIX F-CP

PAGE F-120