Navigate

CP-9(6)

CP-9(6): Redundant Secondary System

The organization accomplishes information system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations.

Supplemental

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to CP-9(6).

Control	Description
CP-7	The organization: a: Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [organization-defined information system operations] for essential missions/business functions within [organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable; b: Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and c: Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.
CP-10	The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

Control

Description

CP-7

The organization:

a: Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [organization-defined information system operations] for essential missions/business functions within [organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable;

b: Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and

c: Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.

CP-10

The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

Enhancements

The controls below (if any) add on to the requirements of CP-9(6).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CP-9(6).

CCI	Definition
CCI-000549	Maintain a redundant secondary system that is not collocated with the primary system.
CCI-001609	Activate the redundant secondary system that is not collocated with the primary system without loss of information or disruption to operations.