Navigate

CCI-000485

CCI-000485 Definition

Defines the frequency of contingency training to system users.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if contingency training is provided to system users consistent with assigned roles and responsibilities [CP-03_ODP[02]; frequency at which to provide training to system users with a contingency role or responsibility is defined] thereafter.

Validation Procedures

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency training; contingency plan; contingency training curriculum; contingency training material; contingency training records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, and training responsibilities; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for contingency training].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000485.

Control	Description
CP-3	a: Provide contingency training to system users consistent with assigned roles and responsibilities: 1: Within [the time period within which to provide contingency training after assuming a contingency role or responsibility is defined;] of assuming a contingency role or responsibility; 2: When required by system changes; and 3: [frequency at which to provide training to system users with a contingency role or responsibility is defined;] thereafter; and b: Review and update contingency training content [frequency at which to review and update contingency training content is defined;] and following [events necessitating review and update of contingency training are defined;].

Control

Description

CP-3

a: Provide contingency training to system users consistent with assigned roles and responsibilities:
- 1: Within [the time period within which to provide contingency training after assuming a contingency role or responsibility is defined;] of assuming a contingency role or responsibility;
- 2: When required by system changes; and
- 3: [frequency at which to provide training to system users with a contingency role or responsibility is defined;] thereafter; and

b: Review and update contingency training content [frequency at which to review and update contingency training content is defined;] and following [events necessitating review and update of contingency training are defined;].