CP-2 Contingency Plan

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	7 (5 in a baseline)

Related controls: CP-3, CP-4, CP-6, CP-7, CP-8, CP-9, CP-10, CP-11, CP-13, IR-4, IR-6, IR-8, IR-9, MA-6, MP-2, MP-4, MP-5, PL-2, PM-8, PM-11, SA-15, SA-20, SC-7, SC-23, SI-12

Control statement

• a. Develop a contingency plan for the system that:
  • 1. Identifies essential mission and business functions and associated contingency requirements;
  • 2. Provides recovery objectives, restoration priorities, and metrics;
  • 3. Addresses contingency roles, responsibilities, assigned individuals with contact information;
  • 4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
  • 5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;
  • 6. Addresses the sharing of contingency information; and
  • 7. Is reviewed and approved by [Assignment: organization-defined personnel or roles];
• b. Distribute copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
• c. Coordinate contingency planning activities with incident handling activities;
• d. Review the contingency plan for the system [Assignment: organization-defined frequency];
• e. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
• f. Communicate contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
• g. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and
• h. Protect the contingency plan from unauthorized disclosure and modification.

NIST discussion

Contingency planning for systems is part of an overall program for achieving continuity of operations for organizational mission and business functions. Contingency planning addresses system restoration and implementation of alternative mission or business processes when systems are compromised or breached. Contingency planning is considered throughout the system development life cycle and is a fundamental part of the system design. Systems can be designed for redundancy, to provide backup capabilities, and for resilience. Contingency plans reflect the degree of restoration required for organizational systems since not all systems need to fully recover to achieve the level of continuity of operations desired. System recovery objectives reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, organizational risk tolerance, and system impact level.

Actions addressed in contingency plans include orderly system degradation, system shutdown, fallback to a manual mode, alternate information flows, and operating in modes reserved for when systems are under attack. By coordinating contingency planning with incident handling activities, organizations ensure that the necessary planning activities are in place and activated in the event of an incident. Organizations consider whether continuity of operations during an incident conflicts with the capability to automatically disable the system, as specified in IR-4(5) . Incident response planning is part of contingency planning for organizations and is addressed in the IR (Incident Response) family.

Control enhancements

CP-2(1) Coordinate with Related Plans

Baselines: Moderate, High

Coordinate contingency plan development with organizational elements responsible for related plans.

Discussion and assessment objectives for CP-2(1)

Plans that are related to contingency plans include Business Continuity Plans, Disaster Recovery Plans, Critical Infrastructure Plans, Continuity of Operations Plans, Crisis Communications Plans, Insider Threat Implementation Plans, Data Breach Response Plans, Cyber Incident Response Plans, Breach Response Plans, and Occupant Emergency Plans.

Determine if contingency plan development is coordinated with organizational elements responsible for related plans.

Examine: Contingency planning policy; procedures addressing contingency operations for the system; contingency plan; business contingency plans; disaster recovery plans; continuity of operations plans; crisis communications plans; critical infrastructure plans; cyber incident response plan; insider threat implementation plans; occupant emergency plans; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with information security responsibilities; personnel with responsibility for related plans.

CP-2(2) Capacity Planning

Baselines: High

Conduct capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.

Discussion and assessment objectives for CP-2(2)

Capacity planning is needed because different threats can result in a reduction of the available processing, telecommunications, and support services intended to support essential mission and business functions. Organizations anticipate degraded operations during contingency operations and factor the degradation into capacity planning. For capacity planning, environmental support refers to any environmental factor for which the organization determines that it needs to provide support in a contingency situation, even if in a degraded state. Such determinations are based on an organizational assessment of risk, system categorization (impact level), and organizational risk tolerance.

Determine if:

• CP-02(02)[01] capacity planning is conducted so that the necessary capacity exists during contingency operations for information processing;
• CP-02(02)[02] capacity planning is conducted so that the necessary capacity exists during contingency operations for telecommunications;
• CP-02(02)[03] capacity planning is conducted so that the necessary capacity exists during contingency operations for environmental support.

Examine: Contingency planning policy; procedures addressing contingency operations for the system; contingency plan; capacity planning documents; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel responsible for capacity planning; organizational personnel with information security responsibilities.

CP-2(3) Resume Mission and Business Functions

Baselines: Moderate, High

Plan for the resumption of [Selection: all; essential] mission and business functions within [Assignment: organization-defined time period] of contingency plan activation.

Discussion and assessment objectives for CP-2(3)

Organizations may choose to conduct contingency planning activities to resume mission and business functions as part of business continuity planning or as part of business impact analyses. Organizations prioritize the resumption of mission and business functions. The time period for resuming mission and business functions may be dependent on the severity and extent of the disruptions to the system and its supporting infrastructure.

Determine if the resumption of [Selection: all; essential] mission and business functions are planned for within [Assignment: organization-defined time period] of contingency plan activation.

Examine: Contingency planning policy; procedures addressing contingency operations for the system; contingency plan; business impact assessment; system security plan; privacy plan; other related plans; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with information security and privacy responsibilities; organizational personnel with knowledge of requirements for mission and business functions.

Test: Organizational processes for resumption of missions and business functions.

CP-2(5) Continue Mission and Business Functions

Baselines: High

Plan for the continuance of [Selection: all; essential] mission and business functions with minimal or no loss of operational continuity and sustains that continuity until full system restoration at primary processing and/or storage sites.

Discussion and assessment objectives for CP-2(5)

Organizations may choose to conduct the contingency planning activities to continue mission and business functions as part of business continuity planning or business impact analyses. Primary processing and/or storage sites defined by organizations as part of contingency planning may change depending on the circumstances associated with the contingency.

Determine if:

• CP-02(05)[01] the continuance of [Selection: all; essential] mission and business functions with minimal or no loss of operational continuity is planned for;
• CP-02(05)[02] continuity is sustained until full system restoration at primary processing and/or storage sites.

Examine: Contingency planning policy; procedures addressing contingency operations for the system; contingency plan; business impact assessment; primary processing site agreements; primary storage site agreements; alternate processing site agreements; alternate storage site agreements; contingency plan test documentation; contingency plan test results; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with knowledge of requirements for mission and business functions; organizational personnel with information security responsibilities.

Test: Organizational processes for continuing missions and business functions.

CP-2(6) Alternate Processing and Storage Sites

Baselines: Not in a baseline

Plan for the transfer of [Selection: all; essential] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that continuity through system restoration to primary processing and/or storage sites.

Discussion and assessment objectives for CP-2(6)

Organizations may choose to conduct contingency planning activities for alternate processing and storage sites as part of business continuity planning or business impact analyses. Primary processing and/or storage sites defined by organizations as part of contingency planning may change depending on the circumstances associated with the contingency.

Determine if:

• CP-02(06)[01] the transfer of [Selection: all; essential] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity is planned for;
• CP-02(06)[02] operational continuity is sustained until full system restoration at primary processing and/or storage sites.

Examine: Contingency planning policy; procedures addressing contingency operations for the system; contingency plan; business impact assessment; alternate processing site agreements; alternate storage site agreements; contingency plan testing documentation; contingency plan test results; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with knowledge of requirements for mission and business functions; organizational personnel with information security responsibilities.

Test: Organizational processes for transfer of essential mission and business functions to alternate processing/storage sites.

CP-2(7) Coordinate with External Service Providers

Baselines: Not in a baseline

Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.

Discussion and assessment objectives for CP-2(7)

When the capability of an organization to carry out its mission and business functions is dependent on external service providers, developing a comprehensive and timely contingency plan may become more challenging. When mission and business functions are dependent on external service providers, organizations coordinate contingency planning activities with the external entities to ensure that the individual plans reflect the overall contingency needs of the organization.

Determine if the contingency plan is coordinated with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.

Examine: Contingency planning policy; procedures addressing contingency operations for the system; contingency plan; contingency plans of external; service providers; service level agreements; contingency plan requirements; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning and plan implementation responsibilities; external service providers; organizational personnel with information security responsibilities.

CP-2(8) Identify Critical Assets

Baselines: Moderate, High

Identify critical system assets supporting [Selection: all; essential] mission and business functions.

Discussion and assessment objectives for CP-2(8)

Organizations may choose to identify critical assets as part of criticality analysis, business continuity planning, or business impact analyses. Organizations identify critical system assets so that additional controls can be employed (beyond the controls routinely implemented) to help ensure that organizational mission and business functions can continue to be conducted during contingency operations. The identification of critical information assets also facilitates the prioritization of organizational resources. Critical system assets include technical and operational aspects. Technical aspects include system components, information technology services, information technology products, and mechanisms. Operational aspects include procedures (i.e., manually executed operations) and personnel (i.e., individuals operating technical controls and/or executing manual procedures). Organizational program protection plans can assist in identifying critical assets. If critical assets are resident within or supported by external service providers, organizations consider implementing CP-2(7) as a control enhancement.

Determine if critical system assets supporting [Selection: all; essential] mission and business functions are identified.

Examine: Contingency planning policy; procedures addressing contingency operations for the system; contingency plan; business impact assessment; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with knowledge of requirements for mission and business functions; organizational personnel with information security responsibilities.

Withdrawn enhancements: CP-2(4).

Assessment objectives (SP 800-53A)

Objectives and methods for CP-2

Determine if:

• CP-02a.
  • CP-02a.01 a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements;
  • CP-02a.02
    • CP-02a.02[01] a contingency plan for the system is developed that provides recovery objectives;
    • CP-02a.02[02] a contingency plan for the system is developed that provides restoration priorities;
    • CP-02a.02[03] a contingency plan for the system is developed that provides metrics;
  • CP-02a.03
    • CP-02a.03[01] a contingency plan for the system is developed that addresses contingency roles;
    • CP-02a.03[02] a contingency plan for the system is developed that addresses contingency responsibilities;
    • CP-02a.03[03] a contingency plan for the system is developed that addresses assigned individuals with contact information;
  • CP-02a.04 a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
  • CP-02a.05 a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented;
  • CP-02a.06 a contingency plan for the system is developed that addresses the sharing of contingency information;
  • CP-02a.07
    • CP-02a.07[01] a contingency plan for the system is developed that is reviewed by [Assignment: organization-defined personnel or roles];
    • CP-02a.07[02] a contingency plan for the system is developed that is approved by [Assignment: organization-defined personnel or roles];
• CP-02b.
  • CP-02b.[01] copies of the contingency plan are distributed to [Assignment: organization-defined key contingency personnel];
  • CP-02b.[02] copies of the contingency plan are distributed to [Assignment: organization-defined organizational elements];
• CP-02c. contingency planning activities are coordinated with incident handling activities;
• CP-02d. the contingency plan for the system is reviewed [Assignment: organization-defined frequency];
• CP-02e.
  • CP-02e.[01] the contingency plan is updated to address changes to the organization, system, or environment of operation;
  • CP-02e.[02] the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing;
• CP-02f.
  • CP-02f.[01] contingency plan changes are communicated to [Assignment: organization-defined key contingency personnel];
  • CP-02f.[02] contingency plan changes are communicated to [Assignment: organization-defined organizational elements];
• CP-02g.
  • CP-02g.[01] lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing;
  • CP-02g.[02] lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training;
• CP-02h.
  • CP-02h.[01] the contingency plan is protected from unauthorized disclosure;
  • CP-02h.[02] the contingency plan is protected from unauthorized modification.

Examine: Contingency planning policy; procedures addressing contingency operations for the system; contingency plan; evidence of contingency plan reviews and updates; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with incident handling responsibilities; organizational personnel with knowledge of requirements for mission and business functions; organizational personnel with information security responsibilities.

Test: Organizational processes for contingency plan development, review, update, and protection; mechanisms for developing, reviewing, updating, and/or protecting the contingency plan.

Policy statement

• Each System owner shall develop a contingency plan for the system that identifies essential mission and business functions and the contingency requirements that go with them. (CP-2a.1)
• The contingency plan shall provide recovery objectives, restoration priorities and metrics. (CP-2a.2)
• The contingency plan shall set out contingency roles and responsibilities, and the assigned individuals with their contact information. (CP-2a.3)
• The contingency plan shall address maintaining essential mission and business functions despite a system disruption, compromise or failure. (CP-2a.4)
• The contingency plan shall address eventual, full system restoration without deterioration of the controls originally planned and implemented. (CP-2a.5)
• The contingency plan shall address the sharing of contingency information. (CP-2a.6)
• The contingency plan shall be reviewed by Fill in: personnel or roles to review a contingency plan Typical: the system owner and the system security officer and approved by Fill in: personnel or roles to approve a contingency plan Typical: the authorizing official, or the business owner the authorizing official names. (CP-2a.7)
• The System owner shall distribute copies of the contingency plan to Fill in: key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed Typical: the contingency team members, by role and to Fill in: key contingency organizational elements to which copies of the contingency plan are distributed Typical: the operations, facilities and communications functions. (CP-2b)
• The System owner shall coordinate contingency planning activities with incident handling activities. (CP-2c)
• The System owner shall review the contingency plan Fill in: frequency of contingency plan review Typical: annually. (CP-2d)
• The System owner shall update the contingency plan to address changes to the organization, the system or its environment of operation, and problems found when the plan is carried out or tested. (CP-2e)
• The System owner shall communicate contingency plan changes to Fill in: key contingency personnel (identified by name and/or by role) to communicate changes to Typical: the contingency team members, by role and to Fill in: key contingency organizational elements to communicate changes to Typical: the operations, facilities and communications functions. (CP-2f)
• The System owner shall incorporate lessons learned from contingency plan testing, training and actual contingency activities into contingency testing and training. (CP-2g)
• The System owner shall protect the contingency plan from unauthorized disclosure and modification. (CP-2h)

CP-2(1) Coordinate with related plans

• The System owner shall coordinate contingency plan development with the organizational elements responsible for related plans. (CP-2(1))

CP-2(2) Capacity planning

• The System owner shall conduct capacity planning so that the processing, telecommunications and environmental support capacity needed during contingency operations exists. (CP-2(2))

CP-2(3) Resume mission and business functions

• The System owner shall plan for the resumption of Select one: all; essential Typical: essential mission and business functions within Fill in: the contingency plan activation time period within which to resume mission and business functions Typical: the recovery time objective set in the contingency plan from the business impact analysis of contingency plan activation. (CP-2(3))

CP-2(5) Continue mission and business functions

• The System owner shall plan for the continuance of Select one: all; essential Typical: essential mission and business functions with minimal or no loss of operational continuity, sustained until full system restoration at the primary processing or storage sites. (CP-2(5))

CP-2(8) Identify critical assets

• The System owner shall identify the critical system assets that support Select one: all; essential Typical: essential mission and business functions. (CP-2(8))

From the Contingency Planning Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

The contingency plan says how the system’s essential functions continue, and how the system is restored, after a disruption. NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems, describes the plan’s structure and the business impact analysis that sets recovery objectives.

Common implementations. A business impact analysis that sets recovery time and recovery point objectives. A plan with activation criteria, roles and contacts, recovery procedures and a restoration order. Coordination with incident response (CP-2c) and with related plans such as continuity of operations (CP-2(1)). The plan is tested (CP-4), and lessons learned update it (CP-2g).

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Plan reviewers and approvers (a.7)	The system owner, with approval by the authorizing official or business owner
Distribution and change communication (b, f)	The contingency team members, by role, and the operations, facilities and communications functions
Review frequency (d)	Annually

Evidence assessors ask for.

• The approved contingency plan and business impact analysis
• Records of plan distribution and of the last review
• Test results and the changes made from them

Inheritance. Data center and cloud provider resilience is often inherited; the system owns its plan and recovery objectives.

Common findings.

• Recovery objectives with no business impact analysis behind them.
• Contact lists out of date.
• Plans never tested, or tested without recording the results.

Enhancements in the Moderate baseline. CP-2(1) coordinate with related plans, CP-2(3) resume mission and business functions and CP-2(8) identify critical assets. High adds CP-2(2) and CP-2(5).

Artifacts

• Business Impact Analysis
• Contingency Plan After-Action Report
• Contingency Planning Decision Worksheet
• Contingency Planning Policy
• Information System Contingency Plan