Navigate

CP-3

CP-3: Contingency Training

The organization provides contingency training to information system users consistent with assigned roles and responsibilities:

CP-3a.: Within [Assignment: organization-defined time period] of assuming a contingency role or responsibility;

CP-3b.: When required by information system changes; and

CP-3c.: [Assignment: organization-defined frequency] thereafter.

Supplemental

Contingency training provided by organizations is linked to the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail is included in such training. For example, regular users may only need to know when and where to report for duty during contingency operations and if normal duties are affected; system administrators may require additional training on how to set up information systems at alternate processing and storage sites; and managers/senior leaders may receive more specific training on how to conduct mission-essential functions in designated off-site locations and how to establish communications with other governmental entities for purposes of coordination on contingency-related activities. Training for contingency roles/responsibilities reflects the specific continuity requirements in the contingency plan.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	low

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to CP-3.

Control	Description
AT-2	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): AT-2a.: As part of initial training for new users; AT-2b.: When required by information system changes; and AT-2c.: [Assignment: organization-defined frequency] thereafter.
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: AT-3a.: Before authorizing access to the information system or performing assigned duties; AT-3b.: When required by information system changes; and AT-3c.: [Assignment: organization-defined frequency] thereafter.
CP-2	The organization: CP-2a.: Develops a contingency plan for the information system that: CP-2a.1.: Identifies essential missions and business functions and associated contingency requirements; CP-2a.2.: Provides recovery objectives, restoration priorities, and metrics; CP-2a.3.: Addresses contingency roles, responsibilities, assigned individuals with contact information; CP-2a.4.: Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure; CP-2a.5.: Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and CP-2a.6.: Is reviewed and approved by [Assignment: organization-defined personnel or roles]; CP-2b.: Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; CP-2c.: Coordinates contingency planning activities with incident handling activities; CP-2d.: Reviews the contingency plan for the information system [Assignment: organization-defined frequency]; CP-2e.: Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; CP-2f.: Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and CP-2g.: Protects the contingency plan from unauthorized disclosure and modification.
IR-2	The organization provides incident response training to information system users consistent with assigned roles and responsibilities: IR-2a.: Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility; IR-2b.: When required by information system changes; and IR-2c.: [Assignment: organization-defined frequency] thereafter.

Enhancements

The controls below (if any) add on to the requirements of CP-3.

Control	Description
CP-3 (1)	The organization incorporates simulated events into contingency training to facilitate effective response by personnel in crisis situations.
CP-3 (2)	The organization employs automated mechanisms to provide a more thorough and realistic contingency training environment.

Related CCIs

The CCIs below are tied to CP-3.

CCI	Definition
CCI-000485	The organization defines the frequency of refresher contingency training to information system users.
CCI-000486	The organization provides contingency training to information system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming a contingency role or responsibility.
CCI-000487	The organization provides refresher contingency training to information system users consistent with assigned roles and responsibilities in accordance with organization-defined frequency.
CCI-002833	The organization defines the time period that contingency training is to be provided to information system users consistent with assigned roles and responsibilities within assuming a contingency role or responsibility.
CCI-002834	The organization provides contingency training to information system users consistent with assigned roles and responsibilities when required by information system changes.