CP-3 Contingency Training

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	2 (1 in a baseline)

Related controls: AT-2, AT-3, AT-4, CP-2, CP-4, CP-8, IR-2, IR-4, IR-9

Control statement

• a. Provide contingency training to system users consistent with assigned roles and responsibilities:
  • 1. Within [Assignment: organization-defined time period] of assuming a contingency role or responsibility;
  • 2. When required by system changes; and
  • 3. [Assignment: organization-defined frequency] thereafter; and
• b. Review and update contingency training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

NIST discussion

Contingency training provided by organizations is linked to the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail is included in such training. For example, some individuals may only need to know when and where to report for duty during contingency operations and if normal duties are affected; system administrators may require additional training on how to establish systems at alternate processing and storage sites; and organizational officials may receive more specific training on how to conduct mission-essential functions in designated off-site locations and how to establish communications with other governmental entities for purposes of coordination on contingency-related activities. Training for contingency roles or responsibilities reflects the specific continuity requirements in the contingency plan. Events that may precipitate an update to contingency training content include, but are not limited to, contingency plan testing or an actual contingency (lessons learned), assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. At the discretion of the organization, participation in a contingency plan test or exercise, including lessons learned sessions subsequent to the test or exercise, may satisfy contingency plan training requirements.

Control enhancements

CP-3(1) Simulated Events

Baselines: High

Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.

Discussion and assessment objectives for CP-3(1)

The use of simulated events creates an environment for personnel to experience actual threat events, including cyber-attacks that disable websites, ransomware attacks that encrypt organizational data on servers, hurricanes that damage or destroy organizational facilities, or hardware or software failures.

Determine if simulated events are incorporated into contingency training to facilitate effective response by personnel in crisis situations.

Examine: Contingency planning policy; procedures addressing contingency training; contingency plan; contingency training curriculum; contingency training material; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning, plan implementation, and training responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for contingency training; mechanisms for simulating contingency events.

CP-3(2) Mechanisms Used in Training Environments

Baselines: Not in a baseline

Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment.

Discussion and assessment objectives for CP-3(2)

Operational mechanisms refer to processes that have been established to accomplish an organizational goal or a system that supports a particular organizational mission or business objective. Actual mission and business processes, systems, and/or facilities may be used to generate simulated events and enhance the realism of simulated events during contingency training.

Determine if mechanisms used in operations are employed to provide a more thorough and realistic contingency training environment.

Examine: Contingency planning policy; procedures addressing contingency training; contingency plan; contingency training curriculum; contingency training material; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning, plan implementation, and training responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for contingency training; mechanisms for providing contingency training environments.

Assessment objectives (SP 800-53A)

Objectives and methods for CP-3

Determine if:

• CP-03a.
  • CP-03a.01 contingency training is provided to system users consistent with assigned roles and responsibilities within [Assignment: organization-defined time period] of assuming a contingency role or responsibility;
  • CP-03a.02 contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes;
  • CP-03a.03 contingency training is provided to system users consistent with assigned roles and responsibilities [Assignment: organization-defined frequency] thereafter;
• CP-03b.
  • CP-03b.[01] the contingency plan training content is reviewed and updated [Assignment: organization-defined frequency];
  • CP-03b.[02] the contingency plan training content is reviewed and updated following [Assignment: organization-defined events].

Examine: Contingency planning policy; procedures addressing contingency training; contingency plan; contingency training curriculum; contingency training material; contingency training records; system security plan; other relevant documents or records.

Interview: Organizational personnel with contingency planning, plan implementation, and training responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for contingency training.

Policy statement

• The System owner shall provide contingency training, consistent with assigned roles and responsibilities, to system users within Fill in: the time period within which to provide contingency training after assuming a contingency role or responsibility Typical: 30 days of their assuming a contingency role or responsibility. (CP-3a.1)
• The System owner shall provide that training when system changes require it. (CP-3a.2)
• The System owner shall provide that training Fill in: frequency at which to provide training to system users with a contingency role or responsibility Typical: annually thereafter. (CP-3a.3)
• The System owner shall review and update contingency training content Fill in: frequency at which to review and update contingency training content Typical: annually and following Fill in: events necessitating review and update of contingency training Typical: a change to the contingency plan, and lessons learned from a test or an actual contingency event. (CP-3b)

CP-3(1) Simulated events

• The System owner shall incorporate simulated events into contingency training so personnel practice an effective response to crisis situations. (CP-3(1))

From the Contingency Planning Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

CP-3 asks you to train the people with a role in the contingency plan for that role: when they take it on, when system changes require it, and at a set interval after that. You also review and update the training content on a schedule and after set events. NIST’s CP-3 discussion scales the content to the role. Some people only need to know when and where to report during contingency operations. System administrators need to know how to set up systems at the alternate sites, and officials how to carry out essential functions from another location. CP-3 is in the Low, Moderate and High baselines.

NIST SP 800-34 Rev. 1 (May 2010, updated November 11, 2010; current as of October 2026), section 3.5.2, says training should be provided at least annually, and soon after someone is newly appointed to a plan role. Its goal is that recovery personnel can do their jobs without the plan in hand, because the plan may be unavailable in the first hours of a disruption. It lists what to cover: the plan’s purpose, cross-team coordination and communication, reporting procedures, security requirements, team-specific processes, and individual responsibilities in each of the three phases (activation and notification, recovery, reconstitution).

Common implementations. A short briefing for each plan role, given by the contingency plan coordinator when someone joins the contingency team and repeated each year. It walks through the contingency plan: the roles table in section 2.3, the activation criteria and notification steps in section 3, and the person’s own recovery procedures in Appendix C or D. Administrators also practice their recovery steps, for example restoring a server or database from backup. List the course in section 5 (role-based training) of the Security and Privacy Training Plan, and record completions in the learning management system or the training record log.

NIST’s discussion lets the organization count taking part in a contingency plan test or exercise, including its lessons-learned session, as training. Many programs schedule the annual training just before the annual test (CP-4), so people learn their role and then practice it. Users with no contingency role need only know where to get instructions, which literacy training (AT-2) can cover.

Organization-defined parameters. Typical values, from the Contingency Planning policy, which your organization may set differently:

Parameter	Typical value
Time to train after assuming a contingency role (a.1)	30 days
Refresher frequency (a.3)	Annually
Content review frequency (b)	Annually
Events that trigger a content review (b)	A change to the contingency plan, and lessons learned from a test or an actual contingency event

The trigger events follow NIST’s discussion, which names contingency plan testing and actual contingencies. In the policy, the system owner provides the training. The values match the incident response training in IR-2 (30 days, then annually), so one training cycle can cover both where the same people hold both roles.

Evidence assessors ask for.

• The training material for each contingency role, with the date it was last reviewed and what changed
• The list of people with contingency roles, from the plan’s roles table and contact list, with their training dates
• Records showing new members were trained within 30 days of joining the contingency team
• Records of the annual refresher, or of exercise participation where the organization counts it as training
• Evidence that content was updated after a plan change or after the lessons learned from a test

Inheritance. CP-3 is usually system-specific, because the training follows each system’s plan and roles. An organization can provide a common course on the contingency program, and each system adds its own role briefings. Where a cloud provider runs recovery, the provider trains its own staff, and the system trains only the roles it keeps. Record the split in the system security plan.

Common findings.

• No training records for the people named in the contingency plan, or names in the plan who have left.
• Training that covers the plan in general but not each person’s own recovery steps.
• Content never updated after the plan changed, for example after a move to a new backup service or alternate site.
• Exercise participation counted as training, but no attendance list to show who took part.

Enhancements in the Moderate baseline. None. High adds CP-3(1) simulated events: training that puts people through realistic events, which NIST’s discussion illustrates with cyber-attacks that disable websites, ransomware that encrypts data on servers, hurricanes that damage facilities, and hardware or software failures. CP-3(2) mechanisms used in training environments is in no baseline.

Federal systems (as of October 2026). FEMA’s Federal Continuity Directive: Federal Executive Branch Continuity Program Management Requirements (August 2024), section 7.1.3, requires annual training on roles and responsibilities for all continuity personnel assigned to activate, support or sustain essential function operations. That training must include the use of continuity capabilities such as alternate sites and access to backup records, and the communications and IT system planning that supports continuity operations. Where a system supports the agency’s essential functions, align its contingency training with the agency’s continuity training so the two do not conflict.

Artifacts

• Contingency Plan Test Plan (CP-3(1))
• Contingency Planning Decision Worksheet
• Contingency Planning Policy