Navigate

CP-11

CP-11: Alternate Communications Protocols

Provide the capability to employ [alternative communications protocols in support of maintaining continuity of operations are defined;] in support of maintaining continuity of operations.

Supplemental

Contingency plans and the contingency training or testing associated with those plans incorporate an alternate communications protocol capability as part of establishing resilience in organizational systems. Switching communications protocols may affect software applications and operational aspects of systems. Organizations assess the potential side effects of introducing alternate communications protocols prior to implementation.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
DAF Baseline, NC3

CSF Categories
ID.BE-5, PR.PT-5

Related Controls

The controls below (if any) were marked by NIST as being related to CP-11.

Control	Description
CP-2	a: Develop a contingency plan for the system that: 1: Identifies essential mission and business functions and associated contingency requirements; 2: Provides recovery objectives, restoration priorities, and metrics; 3: Addresses contingency roles, responsibilities, assigned individuals with contact information; 4: Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5: Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6: Addresses the sharing of contingency information; and 7: Is reviewed and approved by [one of ]; b: Distribute copies of the contingency plan to [one of ]; c: Coordinate contingency planning activities with incident handling activities; d: Review the contingency plan for the system [frequency of contingency plan review is defined;]; e: Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f: Communicate contingency plan changes to [one of ]; g: Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and h: Protect the contingency plan from unauthorized disclosure and modification.
CP-8	Establish alternate telecommunications services, including necessary agreements to permit the resumption of [system operations to be resumed for essential mission and business functions are defined;] for essential mission and business functions within [time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined;] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CP-13	Employ [alternative or supplemental security mechanisms are defined;] for satisfying [security functions are defined;] when the primary means of implementing the security function is unavailable or compromised.

Enhancements

The controls below (if any) add on to the requirements of CP-11.

Control	Description
No controls

Related CCIs

The CCIs below are tied to CP-11.

CCI	Definition
CCI-002853	Provide the capability to employ organization-defined alternative communications protocols in support of maintaining continuity of operations.
CCI-002854	Defines the alternative communications protocols the system must be capable of providing in support of maintaining continuity of operations.