CCI-000494

Test the contingency plan for the system in accordance with organization-defined frequency using organization-defined tests to determine the effectiveness of the plan and the organizational readiness to execute the plan.

Implementation Guidance

Determine if: - the contingency plan for the system is tested [CP-04_ODP[01]; frequency of testing the contingency plan for the system is defined]. - [CP-04_ODP[02]; tests for determining the effectiveness of the contingency plan are defined] are used to determine the effectiveness of the plan. - [CP-04_ODP[03]; tests for determining readiness to execute the contingency plan are defined] are used to determine the readiness to execute the plan.

Validation Procedures

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency plan testing; contingency plan; contingency plan test documentation; contingency plan test results; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for contingency plan testing, reviewing, or responding to contingency plan tests; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for contingency plan testing; mechanisms supporting the contingency plan and/or contingency plan testing].

The controls below (if any) were marked by NIST as being related to CCI-000494.