SC-47 Alternate Communications Paths

Guidance: nonePolicy clause: noneWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	None

Related controls: CP-2, CP-8

Control statement

Establish [Assignment: organization-defined alternate communication paths] for system operations organizational command and control.

NIST discussion

An incident, whether adversarial- or nonadversarial-based, can disrupt established communications paths used for system operations and organizational command and control. Alternate communications paths reduce the risk of all communications paths being affected by the same incident. To compound the problem, the inability of organizational officials to obtain timely information about disruptions or to provide timely direction to operational elements after a communications path incident, can impact the ability of the organization to respond to such incidents in a timely manner. Establishing alternate communications paths for command and control purposes, including designating alternative decision makers if primary decision makers are unavailable and establishing the extent and limitations of their actions, can greatly facilitate the organization’s ability to continue to operate and take appropriate actions during an incident.

Assessment objectives (SP 800-53A)

Objectives and methods for SC-47

Determine if [Assignment: organization-defined alternate communication paths] are established for system operations and operational command and control.

Examine: System and communications protection policy; procedures addressing communication paths; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.

Test: Mechanisms supporting and/or implementing alternate communication paths for system operations.