Navigate

CP-6 (1)

CP-6 (1): Separation From Primary Site

The organization identifies an alternate storage site that is separated from the primary storage site to reduce susceptibility to the same threats.

Supplemental

Threats that affect alternate storage sites are typically defined in organizational assessments of risk and include, for example, natural disasters, structural failures, hostile cyber attacks, and errors of omission/commission. Organizations determine what is considered a sufficient degree of separation between primary and alternate storage sites based on the types of threats that are of concern. For one particular type of threat (i.e., hostile cyber attack), the degree of separation between sites is less relevant.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	moderate

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to CP-6 (1).

Control	Description
RA-3	The organization: RA-3a.: Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits; RA-3b.: Documents risk assessment results in [Selection: security plan; risk assessment report; [Assignment: organization-defined document]]; RA-3c.: Reviews risk assessment results [Assignment: organization-defined frequency]; RA-3d.: Disseminates risk assessment results to [Assignment: organization-defined personnel or roles]; and RA-3e.: Updates the risk assessment [Assignment: organization-defined frequency] or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.

Control

Description

RA-3

The organization:

RA-3a.: Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits;

RA-3b.: Documents risk assessment results in [Selection: security plan; risk assessment report; [Assignment: organization-defined document]];

RA-3c.: Reviews risk assessment results [Assignment: organization-defined frequency];

RA-3d.: Disseminates risk assessment results to [Assignment: organization-defined personnel or roles]; and

RA-3e.: Updates the risk assessment [Assignment: organization-defined frequency] or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.

Enhancements

The controls below (if any) add on to the requirements of CP-6 (1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CP-6 (1).

CCI	Definition
CCI-000507	The organization identifies an alternate storage site that is separated from the primary storage site to reduce susceptibility to the same threats.