Navigate

CP-7

CP-7: Alternate Processing Site

The organization:

CP-7a.: Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable;

CP-7b.: Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and

CP-7c.: Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.

Supplemental

Alternate processing sites are sites that are geographically distinct from primary processing sites. An alternate processing site provides processing capability in the event that the primary processing site is not available. Items covered by alternate processing site agreements include, for example, environmental conditions at alternate sites, access rules, physical and environmental protection requirements, and coordination for the transfer/assignment of personnel. Requirements are specifically allocated to alternate processing sites that reflect the requirements in contingency plans to maintain essential missions/business functions despite disruption, compromise, or failure in organizational information systems.

CIA Levels
Confidentiality	moderate
Integrity	moderate
Availability	moderate

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to CP-7.

Control	Description
CP-2	The organization: CP-2a.: Develops a contingency plan for the information system that: CP-2a.1.: Identifies essential missions and business functions and associated contingency requirements; CP-2a.2.: Provides recovery objectives, restoration priorities, and metrics; CP-2a.3.: Addresses contingency roles, responsibilities, assigned individuals with contact information; CP-2a.4.: Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure; CP-2a.5.: Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and CP-2a.6.: Is reviewed and approved by [Assignment: organization-defined personnel or roles]; CP-2b.: Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; CP-2c.: Coordinates contingency planning activities with incident handling activities; CP-2d.: Reviews the contingency plan for the information system [Assignment: organization-defined frequency]; CP-2e.: Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; CP-2f.: Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and CP-2g.: Protects the contingency plan from unauthorized disclosure and modification.
CP-6	The organization: CP-6a.: Establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information; and CP-6b.: Ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.
CP-8	The organization establishes alternate telecommunications services including necessary agreements to permit the resumption of [Assignment: organization-defined information system operations] for essential missions and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CP-9	The organization: CP-9a.: Conducts backups of user-level information contained in the information system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; CP-9b.: Conducts backups of system-level information contained in the information system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; CP-9c.: Conducts backups of information system documentation including security-related documentation [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; and CP-9d.: Protects the confidentiality, integrity, and availability of backup information at storage locations.
CP-10	The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.
MA-6	The organization obtains maintenance support and/or spare parts for [Assignment: organization-defined information system components] within [Assignment: organization-defined time period] of failure.

Enhancements

The controls below (if any) add on to the requirements of CP-7.

Control	Description
CP-7 (1)	The organization identifies an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats.
CP-7 (2)	The organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
CP-7 (3)	The organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with organizational availability requirements (including recovery time objectives).
CP-7 (4)	The organization prepares the alternate processing site so that the site is ready to be used as the operational site supporting essential missions and business functions.
CP-7 (5)	[Withdrawn: Incorporated into CP-7].
CP-7 (6)	The organization plans and prepares for circumstances that preclude returning to the primary processing site.

Related CCIs

The CCIs below are tied to CP-7.

CCI	Definition
CCI-000510	The organization defines the time period consistent with recovery time and recovery point objectives for essential missions/business functions to permit the transfer and resumption of organization-defined information system operations at an alternate processing site when the primary processing capabilities are unavailable.
CCI-000513	The organization establishes an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined information system operations for essential missions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.
CCI-000514	The organization establishes an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined information system operations for essential business functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.
CCI-000515	The organization ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption.
CCI-000521	The organization ensures that the alternate processing site provides information security safeguards equivalent to that of the primary site.
CCI-002839	The organization defines information system operations that are permitted to transfer and resume at an alternate processing site for essential missions/business functions when the primary processing capabilities are unavailable.