Navigate

CCI-000444

CCI-000444 Definition

Develop a contingency plan for the system that identifies essential business functions.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed must clearly and accurately document essential business functions for its information system(s). Impact of loss of essential business functions must be defined using CNSSI 1253.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it clearly and accurately documents essential business functions for its information system(s).

Compelling Evidence

1.) Signed and dated contingency plan, referencing essential business functions section

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000444.

Control	Description
CP-2	The organization: a: Develops a contingency plan for the information system that: 1: Identifies essential missions and business functions and associated contingency requirements; 2: Provides recovery objectives, restoration priorities, and metrics; 3: Addresses contingency roles, responsibilities, assigned individuals with contact information; 4: Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure; 5: Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and 6: Is reviewed and approved by [organization-defined personnel or roles]; b: Distributes copies of the contingency plan to [organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; c: Coordinates contingency planning activities with incident handling activities; d: Reviews the contingency plan for the information system [organization-defined frequency]; e: Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f: Communicates contingency plan changes to [organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and g: Protects the contingency plan from unauthorized disclosure and modification.

Control

Description

CP-2

The organization:

a: Develops a contingency plan for the information system that:
- 1: Identifies essential missions and business functions and associated contingency requirements;
- 2: Provides recovery objectives, restoration priorities, and metrics;
- 3: Addresses contingency roles, responsibilities, assigned individuals with contact information;
- 4: Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;
- 5: Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and
- 6: Is reviewed and approved by [organization-defined personnel or roles];

b: Distributes copies of the contingency plan to [organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];

c: Coordinates contingency planning activities with incident handling activities;

d: Reviews the contingency plan for the information system [organization-defined frequency];

e: Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;

f: Communicates contingency plan changes to [organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and

g: Protects the contingency plan from unauthorized disclosure and modification.