Navigate

CCI-002833

CCI-002833 Definition

Defines the time period that contingency training is to be provided to system users consistent with assigned roles and responsibilities within assuming a contingency role or responsibility.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if contingency training is provided to system users consistent with assigned roles and responsibilities within [CP-03_ODP[01]; the time period within which to provide contingency training after assuming a contingency role or responsibility is defined] of assuming a contingency role or responsibility.

Validation Procedures

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency training; contingency plan; contingency training curriculum; contingency training material; contingency training records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, and training responsibilities; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for contingency training].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002833.

Control	Description
CP-3	a: Provide contingency training to system users consistent with assigned roles and responsibilities: 1: Within [the time period within which to provide contingency training after assuming a contingency role or responsibility is defined;] of assuming a contingency role or responsibility; 2: When required by system changes; and 3: [frequency at which to provide training to system users with a contingency role or responsibility is defined;] thereafter; and b: Review and update contingency training content [frequency at which to review and update contingency training content is defined;] and following [events necessitating review and update of contingency training are defined;].

Control

Description

CP-3

a: Provide contingency training to system users consistent with assigned roles and responsibilities:
- 1: Within [the time period within which to provide contingency training after assuming a contingency role or responsibility is defined;] of assuming a contingency role or responsibility;
- 2: When required by system changes; and
- 3: [frequency at which to provide training to system users with a contingency role or responsibility is defined;] thereafter; and

b: Review and update contingency training content [frequency at which to review and update contingency training content is defined;] and following [events necessitating review and update of contingency training are defined;].