Navigate

CP-8

CP-8: Telecommunications Services

Establish alternate telecommunications services, including necessary agreements to permit the resumption of [system operations to be resumed for essential mission and business functions are defined;] for essential mission and business functions within [time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined;] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

Supplemental

Telecommunications services (for data and voice) for primary and alternate processing and storage sites are in scope for [CP-8](#cp-8) . Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential mission and business functions despite the loss of primary telecommunications services. Organizations may specify different time periods for primary or alternate sites. Alternate telecommunications services include additional organizational or commercial ground-based circuits or lines, network-based approaches to telecommunications, or the use of satellites. Organizations consider factors such as availability, quality of service, and access when entering into alternate telecommunications agreements.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	moderate

Overlays
DAF Baseline

CSF Categories
ID.BE-4, PR.PT-4, PR.PT-5

Related Controls

The controls below (if any) were marked by NIST as being related to CP-8.

Control	Description
CP-2	a: Develop a contingency plan for the system that: 1: Identifies essential mission and business functions and associated contingency requirements; 2: Provides recovery objectives, restoration priorities, and metrics; 3: Addresses contingency roles, responsibilities, assigned individuals with contact information; 4: Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5: Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6: Addresses the sharing of contingency information; and 7: Is reviewed and approved by [one of ]; b: Distribute copies of the contingency plan to [one of ]; c: Coordinate contingency planning activities with incident handling activities; d: Review the contingency plan for the system [frequency of contingency plan review is defined;]; e: Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f: Communicate contingency plan changes to [one of ]; g: Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and h: Protect the contingency plan from unauthorized disclosure and modification.
CP-6	a: Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and b: Ensure that the alternate storage site provides controls equivalent to that of the primary site.
CP-7	a: Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [system operations for essential mission and business functions are defined;] for essential mission and business functions within [time period consistent with recovery time and recovery point objectives is defined;] when the primary processing capabilities are unavailable; b: Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and c: Provide controls at the alternate processing site that are equivalent to those at the primary site.
CP-11	Provide the capability to employ [alternative communications protocols in support of maintaining continuity of operations are defined;] in support of maintaining continuity of operations.
SC-7	a: Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b: Implement subnetworks for publicly accessible system components that are [one of "physically"/"logically"] separated from internal organizational networks; and c: Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Enhancements

The controls below (if any) add on to the requirements of CP-8.

Control	Description
CP-8(1)	(a): Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and (b): Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.
CP-8(2)	Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.
CP-8(3)	Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.
CP-8(4)	(a): Require primary and alternate telecommunications service providers to have contingency plans; (b): Review provider contingency plans to ensure that the plans meet organizational contingency requirements; and (c): Obtain evidence of contingency testing and training by providers [one of ].
CP-8(5)	Test alternate telecommunication services [frequency at which alternate telecommunications services are tested is defined;].

Related CCIs

The CCIs below are tied to CP-8.

CCI	Definition
CCI-000522	Defines the time-period within which to permit the resumption of organization-defined system operations for essential mission functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-000523	Defines the time-period within which to permit the resumption of organization-defined system operations for essential business functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-000524	Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential mission functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-000525	Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential business functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-002840	Defines the system operations to be resumed for essential mission functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-002841	Defines the system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.