Navigate

CP-7(2)

CP-7(2): Accessibility

Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.

Supplemental

Area-wide disruptions refer to those types of disruptions that are broad in geographic scope with such determinations made by organizations based on organizational assessments of risk.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	moderate

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to CP-7(2).

Control	Description
RA-3	a: Conduct a risk assessment, including: 1: Identifying threats to and vulnerabilities in the system; 2: Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and 3: Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information; b: Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments; c: Document risk assessment results in [one of "security and privacy plans"/"risk assessment report"/"{{ insert: param, ra-03_odp.02 }} "]; d: Review risk assessment results [the frequency to review risk assessment results is defined;]; e: Disseminate risk assessment results to [personnel or roles to whom risk assessment results are to be disseminated is/are defined;] ; and f: Update the risk assessment [the frequency to update the risk assessment is defined;] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

Control

Description

RA-3

a: Conduct a risk assessment, including:
- 1: Identifying threats to and vulnerabilities in the system;
- 2: Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and
- 3: Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;

b: Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;

c: Document risk assessment results in [one of "security and privacy plans"/"risk assessment report"/"{{ insert: param, ra-03_odp.02 }} "];

d: Review risk assessment results [the frequency to review risk assessment results is defined;];

e: Disseminate risk assessment results to [personnel or roles to whom risk assessment results are to be disseminated is/are defined;] ; and

f: Update the risk assessment [the frequency to update the risk assessment is defined;] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

Enhancements

The controls below (if any) add on to the requirements of CP-7(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CP-7(2).

CCI	Definition
CCI-000517	Identify potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.
CCI-001606	Identify potential accessibility problems to outline explicit mitigation actions.