Navigate

CCI-000521

CCI-000521 Definition

Provide controls at the alternate processing site that are equivalent to those at the primary site.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if controls provided at the alternate processing site are equivalent to those at the primary site.

Validation Procedures

Examine: [SELECT FROM: Contingency planning policy; procedures addressing alternate processing sites; contingency plan; alternate processing site agreements; primary processing site agreements; spare equipment and supplies inventory at alternate processing site; equipment and supply contracts; service-level agreements; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for contingency planning and/or alternate site arrangements; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for recovery at the alternate site; mechanisms supporting and/or implementing recovery at the alternate processing site].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000521.

Control	Description
CP-7	a: Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [system operations for essential mission and business functions are defined;] for essential mission and business functions within [time period consistent with recovery time and recovery point objectives is defined;] when the primary processing capabilities are unavailable; b: Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and c: Provide controls at the alternate processing site that are equivalent to those at the primary site.

Control

Description

CP-7

a: Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [system operations for essential mission and business functions are defined;] for essential mission and business functions within [time period consistent with recovery time and recovery point objectives is defined;] when the primary processing capabilities are unavailable;

b: Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and

c: Provide controls at the alternate processing site that are equivalent to those at the primary site.