Navigate

CCI-004013

CCI-004013 Definition

Defines the events for which the contingency training content will be reviewed and updated.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - the contingency plan training content is reviewed and updated [CP-03_ODP[03]; frequency at which to review and update contingency training content is defined]. - the contingency plan training content is reviewed and updated following [CP-03_ODP[04]; events necessitating review and update of contingency training are defined].

Validation Procedures

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency training; contingency plan; contingency training curriculum; contingency training material; contingency training records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, and training responsibilities; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for contingency training].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004013.

Control	Description
CP-3	a: Provide contingency training to system users consistent with assigned roles and responsibilities: 1: Within [the time period within which to provide contingency training after assuming a contingency role or responsibility is defined;] of assuming a contingency role or responsibility; 2: When required by system changes; and 3: [frequency at which to provide training to system users with a contingency role or responsibility is defined;] thereafter; and b: Review and update contingency training content [frequency at which to review and update contingency training content is defined;] and following [events necessitating review and update of contingency training are defined;].

Control

Description

CP-3

a: Provide contingency training to system users consistent with assigned roles and responsibilities:
- 1: Within [the time period within which to provide contingency training after assuming a contingency role or responsibility is defined;] of assuming a contingency role or responsibility;
- 2: When required by system changes; and
- 3: [frequency at which to provide training to system users with a contingency role or responsibility is defined;] thereafter; and

b: Review and update contingency training content [frequency at which to review and update contingency training content is defined;] and following [events necessitating review and update of contingency training are defined;].