Navigate

CP-2

CP-2: Contingency Plan

The organization:

CP-2a.: Develops a contingency plan for the information system that:
- CP-2a.1.: Identifies essential missions and business functions and associated contingency requirements;
- CP-2a.2.: Provides recovery objectives, restoration priorities, and metrics;
- CP-2a.3.: Addresses contingency roles, responsibilities, assigned individuals with contact information;
- CP-2a.4.: Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;
- CP-2a.5.: Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and
- CP-2a.6.: Is reviewed and approved by [Assignment: organization-defined personnel or roles];

CP-2b.: Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];

CP-2c.: Coordinates contingency planning activities with incident handling activities;

CP-2d.: Reviews the contingency plan for the information system [Assignment: organization-defined frequency];

CP-2e.: Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;

CP-2f.: Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and

CP-2g.: Protects the contingency plan from unauthorized disclosure and modification.

Supplemental

Contingency planning for information systems is part of an overall organizational program for achieving continuity of operations for mission/business functions. Contingency planning addresses both information system restoration and implementation of alternative mission/business processes when systems are compromised. The effectiveness of contingency planning is maximized by considering such planning throughout the phases of the system development life cycle. Performing contingency planning on hardware, software, and firmware development can be an effective means of achieving information system resiliency. Contingency plans reflect the degree of restoration required for organizational information systems since not all systems may need to fully recover to achieve the level of continuity of operations desired. Information system recovery objectives reflect applicable laws, Executive Orders, directives, policies, standards, regulations, and guidelines. In addition to information system availability, contingency plans also address other security-related events resulting in a reduction in mission and/or business effectiveness, such as malicious attacks compromising the confidentiality or integrity of information systems. Actions addressed in contingency plans include, for example, orderly/graceful degradation, information system shutdown, fallback to a manual mode, alternate information flows, and operating in modes reserved for when systems are under attack. By closely coordinating contingency planning with incident handling activities, organizations can ensure that the necessary contingency planning activities are in place and activated in the event of a security incident.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	low

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to CP-2.

Control	Description
AC-14	The organization: AC-14a.: Identifies [Assignment: organization-defined user actions] that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; and AC-14b.: Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.
CP-6	The organization: CP-6a.: Establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information; and CP-6b.: Ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.
CP-7	The organization: CP-7a.: Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable; CP-7b.: Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and CP-7c.: Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.
CP-8	The organization establishes alternate telecommunications services including necessary agreements to permit the resumption of [Assignment: organization-defined information system operations] for essential missions and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CP-9	The organization: CP-9a.: Conducts backups of user-level information contained in the information system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; CP-9b.: Conducts backups of system-level information contained in the information system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; CP-9c.: Conducts backups of information system documentation including security-related documentation [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; and CP-9d.: Protects the confidentiality, integrity, and availability of backup information at storage locations.
CP-10	The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.
IR-4	The organization: IR-4a.: Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery; IR-4b.: Coordinates incident handling activities with contingency planning activities; and IR-4c.: Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.
IR-8	The organization: IR-8a.: Develops an incident response plan that: IR-8a.1.: Provides the organization with a roadmap for implementing its incident response capability; IR-8a.2.: Describes the structure and organization of the incident response capability; IR-8a.3.: Provides a high-level approach for how the incident response capability fits into the overall organization; IR-8a.4.: Meets the unique requirements of the organization, which relate to mission, size, structure, and functions; IR-8a.5.: Defines reportable incidents; IR-8a.6.: Provides metrics for measuring the incident response capability within the organization; IR-8a.7.: Defines the resources and management support needed to effectively maintain and mature an incident response capability; and IR-8a.8.: Is reviewed and approved by [Assignment: organization-defined personnel or roles]; IR-8b.: Distributes copies of the incident response plan to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements]; IR-8c.: Reviews the incident response plan [Assignment: organization-defined frequency]; IR-8d.: Updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing; IR-8e.: Communicates incident response plan changes to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements]; and IR-8f.: Protects the incident response plan from unauthorized disclosure and modification.
MP-2	The organization restricts access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].
MP-4	The organization: MP-4a.: Physically controls and securely stores [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas]; and MP-4b.: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
MP-5	The organization: MP-5a.: Protects and controls [Assignment: organization-defined types of information system media] during transport outside of controlled areas using [Assignment: organization-defined security safeguards]; MP-5b.: Maintains accountability for information system media during transport outside of controlled areas; MP-5c.: Documents activities associated with the transport of information system media; and MP-5d.: Restricts the activities associated with the transport of information system media to authorized personnel.
PM-8	The organization addresses information security issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.
PM-11	The organization: PM-11a.: Defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and PM-11b.: Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until achievable protection needs are obtained.

Enhancements

The controls below (if any) add on to the requirements of CP-2.

Control	Description
CP-2 (1)	The organization coordinates contingency plan development with organizational elements responsible for related plans.
CP-2 (2)	The organization conducts capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.
CP-2 (3)	The organization plans for the resumption of essential missions and business functions within [Assignment: organization-defined time period] of contingency plan activation.
CP-2 (4)	The organization plans for the resumption of all missions and business functions within [Assignment: organization-defined time period] of contingency plan activation.
CP-2 (5)	The organization plans for the continuance of essential missions and business functions with little or no loss of operational continuity and sustains that continuity until full information system restoration at primary processing and/or storage sites.
CP-2 (6)	The organization plans for the transfer of essential missions and business functions to alternate processing and/or storage sites with little or no loss of operational continuity and sustains that continuity through information system restoration to primary processing and/or storage sites.
CP-2 (7)	The organization coordinates its contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.
CP-2 (8)	The organization identifies critical information system assets supporting essential missions and business functions.

Related CCIs

The CCIs below are tied to CP-2.

CCI	Definition
CCI-000443	The organization develops a contingency plan for the information system that identifies essential missions.
CCI-000444	The organization develops a contingency plan for the information system that identifies essential business functions.
CCI-000445	The organization develops a contingency plan for the information system that identifies associated contingency requirements.
CCI-000446	The organization develops a contingency plan for the information system that provides recovery objectives.
CCI-000447	The organization develops a contingency plan for the information system that provides restoration priorities.
CCI-000448	The organization develops a contingency plan for the information system that provides metrics.
CCI-000449	The organization develops a contingency plan for the information system that addresses contingency roles, responsibilities, assigned individuals with contact information.
CCI-000450	The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system disruption.
CCI-000451	The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system disruption.
CCI-000452	The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system compromise.
CCI-000453	The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system compromise.
CCI-000454	The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system failure.
CCI-000455	The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system failure.
CCI-000456	The organization develops a contingency plan for the information system that addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented.
CCI-000457	The organization develops a contingency plan for the information system that is reviewed and approved by organization-defined personnel or roles.
CCI-000458	The organization defines a list of key contingency personnel (identified by name and/or by role) and organizational elements designated to receive copies of the contingency plan.
CCI-000459	The organization distributes copies of the contingency plan to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.
CCI-000460	The organization coordinates contingency planning activities with incident handling activities.
CCI-000461	The organization defines the frequency with which to review the contingency plan for the information system.
CCI-000462	The organization reviews the contingency plan for the information system in accordance with organization-defined frequency.
CCI-000463	The organization updates the contingency plan to address changes to the organization.
CCI-000464	The organization updates the contingency plan to address changes to the information system.
CCI-000465	The organization updates the contingency plan to address changes to the environment of operation.
CCI-000466	The organization updates the contingency plan to address problems encountered during contingency plan implementation, execution, or testing.
CCI-000468	The organization communicates contingency plan changes to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.
CCI-002830	The organization defines the personnel or roles who review and approve the contingency plan for the information system.
CCI-002831	The organization defines a list of key contingency personnel (identified by name and/or by role) and organizational elements to whom contingency plan changes are to be communicated.
CCI-002832	The organization protects the contingency plan from unauthorized disclosure and modification.