# Contingency Planning Policy

**Template version:** 1.0.0 · **Baseline:** High · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/cp/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet CP-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the CP-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Contingency Planning, and who is accountable for meeting those requirements. (CP-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CP-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (CP-1a.1(a))
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (CP-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (CP-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (CP-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (CP-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CP-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (CP-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (CP-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (CP-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (CP-1a.1(a))

## Procedures

The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (CP-1a.2)

## Dissemination

- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the contingency planning policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (CP-1a)
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the contingency planning procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (CP-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Contingency plan (CP-2)

> **Guidance:** The contingency plan says how a system is kept going, or brought back, after a disruption, compromise or failure. Base it on a [business impact analysis](https://kston83.github.io/nist-guide/templates/reports/business-impact-analysis/), which sets the recovery objectives. The [Information System Contingency Plan template](https://kston83.github.io/nist-guide/templates/plans/contingency-plan/) follows NIST SP 800-34 Rev. 1 and covers each element of CP-2a.

- Each [System owner] shall develop a contingency plan for the system that identifies essential mission and business functions and the contingency requirements that go with them. (CP-2a.1)
- The contingency plan shall provide recovery objectives, restoration priorities and metrics. (CP-2a.2)
- The contingency plan shall set out contingency roles and responsibilities, and the assigned individuals with their contact information. (CP-2a.3)
- The contingency plan shall address maintaining essential mission and business functions despite a system disruption, compromise or failure. (CP-2a.4)
- The contingency plan shall address eventual, full system restoration without deterioration of the controls originally planned and implemented. (CP-2a.5)
- The contingency plan shall address the sharing of contingency information. (CP-2a.6)
- The contingency plan shall be reviewed by [Fill in: personnel or roles to review a contingency plan. Typical: the system owner and the system security officer] and approved by [Fill in: personnel or roles to approve a contingency plan. Typical: the authorizing official, or the business owner the authorizing official names]. (CP-2a.7)
- The [System owner] shall distribute copies of the contingency plan to [Fill in: key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed. Typical: the contingency team members, by role] and to [Fill in: key contingency organizational elements to which copies of the contingency plan are distributed. Typical: the operations, facilities and communications functions]. (CP-2b)
- The [System owner] shall coordinate contingency planning activities with incident handling activities. (CP-2c)
- The [System owner] shall review the contingency plan [Fill in: frequency of contingency plan review. Typical: annually]. (CP-2d)
- The [System owner] shall update the contingency plan to address changes to the organization, the system or its environment of operation, and problems found when the plan is carried out or tested. (CP-2e)
- The [System owner] shall communicate contingency plan changes to [Fill in: key contingency personnel (identified by name and/or by role) to communicate changes to. Typical: the contingency team members, by role] and to [Fill in: key contingency organizational elements to communicate changes to. Typical: the operations, facilities and communications functions]. (CP-2f)
- The [System owner] shall incorporate lessons learned from contingency plan testing, training and actual contingency activities into contingency testing and training. (CP-2g)
- The [System owner] shall protect the contingency plan from unauthorized disclosure and modification. (CP-2h)

### Coordinate with related plans (CP-2(1))

> **Guidance:** Related plans include the business continuity plan, the continuity of operations plan, the disaster recovery plan, the incident response plan and the crisis communications plan. Coordination means the plans agree on priorities, recovery times, contacts and who declares what.

- The [System owner] shall coordinate contingency plan development with the organizational elements responsible for related plans. (CP-2(1))

### Capacity planning (CP-2(2))

- The [System owner] shall conduct capacity planning so that the processing, telecommunications and environmental support capacity needed during contingency operations exists. (CP-2(2))

### Resume mission and business functions (CP-2(3))

- The [System owner] shall plan for the resumption of [Select one: all; essential. Typical: essential] mission and business functions within [Fill in: the contingency plan activation time period within which to resume mission and business functions. Typical: the recovery time objective set in the contingency plan from the business impact analysis] of contingency plan activation. (CP-2(3))

### Continue mission and business functions (CP-2(5))

- The [System owner] shall plan for the continuance of [Select one: all; essential. Typical: essential] mission and business functions with minimal or no loss of operational continuity, sustained until full system restoration at the primary processing or storage sites. (CP-2(5))

### Identify critical assets (CP-2(8))

> **Guidance:** Critical assets are the components, services and people the functions cannot run without. The criticality analysis (RA-9) and the business impact analysis are the usual sources.

- The [System owner] shall identify the critical system assets that support [Select one: all; essential. Typical: essential] mission and business functions. (CP-2(8))

### Contingency training (CP-3)

> **Guidance:** Contingency training teaches people with a role in the plan what they do and how: who declares a disruption, how to restore from backup, how to fail over to the alternate site. Users without a contingency role need only know where to get instructions, which literacy training (AT-2) can cover.

- The [System owner] shall provide contingency training, consistent with assigned roles and responsibilities, to system users within [Fill in: the time period within which to provide contingency training after assuming a contingency role or responsibility. Typical: 30 days] of their assuming a contingency role or responsibility. (CP-3a.1)
- The [System owner] shall provide that training when system changes require it. (CP-3a.2)
- The [System owner] shall provide that training [Fill in: frequency at which to provide training to system users with a contingency role or responsibility. Typical: annually] thereafter. (CP-3a.3)
- The [System owner] shall review and update contingency training content [Fill in: frequency at which to review and update contingency training content. Typical: annually] and following [Fill in: events necessitating review and update of contingency training. Typical: a change to the contingency plan, and lessons learned from a test or an actual contingency event]. (CP-3b)

### Simulated events (CP-3(1))

- The [System owner] shall incorporate simulated events into contingency training so personnel practice an effective response to crisis situations. (CP-3(1))

### Contingency plan testing (CP-4)

> **Guidance:** A tabletop exercise checks that people know the plan; a functional test checks that recovery actually works. NIST SP 800-84 describes both. Plan each test with the [test plan template](https://kston83.github.io/nist-guide/templates/plans/contingency-plan-test-plan/), record the results in an [after-action report](https://kston83.github.io/nist-guide/templates/reports/contingency-plan-after-action-report/), and track corrective actions to closure.

- The [System owner] shall test the contingency plan [Fill in: frequency of testing the contingency plan for the system. Typical: annually], using [Fill in: tests for determining the effectiveness of the contingency plan. Typical: a functional test that restores the system, or a representative part of it, from backup] to determine the plan's effectiveness and [Fill in: tests for determining readiness to execute the contingency plan. Typical: a tabletop exercise that walks the contingency team through the plan] to determine readiness to execute it. (CP-4a)
- The [System owner] shall review the contingency plan test results. (CP-4b)
- The [System owner] shall initiate corrective actions where the results show they are needed, and track them in the plan of action and milestones. (CP-4c)

### Coordinate with related plans (CP-4(1))

- The [System owner] shall coordinate contingency plan testing with the organizational elements responsible for related plans. (CP-4(1))

### Alternate processing site (CP-4(2))

- The [System owner] shall test the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and its resources. (CP-4(2)(a))
- The [System owner] shall test the contingency plan at the alternate processing site to evaluate the site's capability to support contingency operations. (CP-4(2)(b))

### Alternate storage site (CP-6)

> **Guidance:** The alternate storage site holds the backups needed to recover the system. For a system in the cloud, a separate region or availability zone from the same provider can serve as the alternate site, if it meets the separation and control requirements below and the provider agreement supports it.

- The [System owner] shall establish an alternate storage site, including the agreements needed to permit the storage and retrieval of system backup information. (CP-6a)
- The [System owner] shall ensure the alternate storage site provides controls equivalent to those of the primary site. (CP-6b)

### Separation from primary site (CP-6(1))

- The [System owner] shall identify an alternate storage site sufficiently separated from the primary storage site to reduce susceptibility to the same threats. (CP-6(1))

### Recovery time and recovery point objectives (CP-6(2))

- The [System owner] shall configure the alternate storage site to support recovery operations in accordance with the recovery time and recovery point objectives. (CP-6(2))

### Accessibility (CP-6(3))

- The [System owner] shall identify potential problems with access to the alternate storage site in an area-wide disruption or disaster, and set out explicit mitigation actions. (CP-6(3))

### Alternate processing site (CP-7)

> **Guidance:** The alternate processing site is where the system runs when the primary site cannot. For a system in the cloud, a separate region or availability zone from the same provider can serve as the alternate site, if it meets the separation and control requirements below and the provider agreement supports it.

- The [System owner] shall establish an alternate processing site, including the agreements needed to permit the transfer and resumption of [Fill in: system operations for essential mission and business functions. Typical: the system operations that support essential mission and business functions] for essential mission and business functions within [Fill in: time period consistent with recovery time and recovery point objectives. Typical: the recovery time objective set in the contingency plan from the business impact analysis] when the primary processing capabilities are unavailable. (CP-7a)
- The [System owner] shall make available at the alternate processing site the equipment and supplies needed to transfer and resume operations, or put contracts in place to deliver them to the site within that time period. (CP-7b)
- The [System owner] shall provide controls at the alternate processing site equivalent to those at the primary site. (CP-7c)

### Separation from primary site (CP-7(1))

- The [System owner] shall identify an alternate processing site sufficiently separated from the primary processing site to reduce susceptibility to the same threats. (CP-7(1))

### Accessibility (CP-7(2))

- The [System owner] shall identify potential problems with access to the alternate processing site in an area-wide disruption or disaster, and set out explicit mitigation actions. (CP-7(2))

### Priority of service (CP-7(3))

- The [System owner] shall ensure alternate processing site agreements contain priority-of-service provisions in accordance with the system's availability requirements, including recovery time objectives. (CP-7(3))

### Preparation for use (CP-7(4))

- The [System owner] shall prepare the alternate processing site so that it can serve as the operational site supporting essential mission and business functions. (CP-7(4))

### Telecommunications services (CP-8)

> **Guidance:** Alternate telecommunications keep the system reachable when the primary network or internet service fails, at the primary site or at the alternate sites: for example a second internet provider, a wireless backup link, or a provider-managed network with diverse paths.

- The [System owner] shall establish alternate telecommunications services, including the agreements needed to permit the resumption of [Fill in: system operations to be resumed for essential mission and business functions. Typical: the system operations that support essential mission and business functions] for essential mission and business functions within [Fill in: time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable. Typical: the recovery time objective set in the contingency plan from the business impact analysis] when the primary telecommunications capabilities are unavailable at the primary or alternate processing or storage sites. (CP-8)

### Priority of service provisions (CP-8(1))

- The [System owner] shall ensure primary and alternate telecommunications service agreements contain priority-of-service provisions in accordance with the system's availability requirements, including recovery time objectives. (CP-8(1)(a))
- Where the primary or alternate telecommunications services are provided by a common carrier, the [System owner] shall request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness. (CP-8(1)(b))

#### Federal systems

[Telecommunications Service Priority](https://www.cisa.gov/resources-tools/services/telecommunications-service-priority-tsp) is an FCC program, managed by CISA, which requires service providers to prioritize provisioning and restoration of voice and data circuits for organizations with national security and emergency preparedness missions (checked September 2026). CISA's priority services are open to all levels of government and to organizations in the critical infrastructure sectors.

- The [System owner] shall register the system's national security and emergency preparedness circuits in the Telecommunications Service Priority program. (CP-8(1)(b))

### Single points of failure (CP-8(2))

- The [System owner] shall obtain alternate telecommunications services that reduce the likelihood of sharing a single point of failure with the primary telecommunications services. (CP-8(2))

### Separation of primary and alternate providers (CP-8(3))

- The [System owner] shall obtain alternate telecommunications services from providers separated from the primary service providers, to reduce susceptibility to the same threats. (CP-8(3))

### Provider contingency plan (CP-8(4))

- The [System owner] shall require primary and alternate telecommunications service providers to have contingency plans. (CP-8(4)(a))
- The [System owner] shall review provider contingency plans to ensure they meet the organization's contingency requirements. (CP-8(4)(b))
- The [System owner] shall obtain evidence of contingency testing by providers [Fill in: frequency at which to obtain evidence of contingency testing by providers. Typical: annually], and of contingency training by providers [Fill in: frequency at which to obtain evidence of contingency training by providers. Typical: annually]. (CP-8(4)(c))

### System backup (CP-9)

> **Guidance:** Set backup frequencies from the recovery point objectives in the contingency plan: how much data the business can afford to lose. Keep at least one copy that ransomware on the production network cannot reach or change, such as an immutable or offline copy.

- The [System owner] shall ensure backups of user-level information in [Fill in: system components for which to conduct backups of user-level information. Typical: all servers and cloud storage that hold user data] are made [Fill in: frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives. Typical: daily incremental and weekly full, or more often where the recovery point objective requires it]. (CP-9a)
- The [System owner] shall ensure backups of system-level information are made [Fill in: frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives. Typical: daily incremental and weekly full, or more often where the recovery point objective requires it]. (CP-9b)
- The [System owner] shall ensure backups of system documentation, including security- and privacy-related documentation, are made [Fill in: frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives. Typical: on each change]. (CP-9c)
- The [System owner] shall protect the confidentiality, integrity and availability of backup information. (CP-9d)

### Testing for reliability and integrity (CP-9(1))

- The [System owner] shall test backup information [Fill in: frequency at which to test backup information for media reliability. Typical: quarterly] to verify media reliability. (CP-9(1))
- The [System owner] shall test backup information [Fill in: frequency at which to test backup information for information integrity. Typical: quarterly] to verify information integrity. (CP-9(1))

### Test restoration using sampling (CP-9(2))

- The [System owner] shall use a sample of backup information to restore selected system functions as part of contingency plan testing. (CP-9(2))

### Separate storage for critical information (CP-9(3))

- The [System owner] shall store backup copies of [Fill in: critical system software and other security-related information backups to be stored in a separate facility. Typical: system software, configuration baselines, and security-related information such as cryptographic key backups] in a separate facility, or in a fire-rated container not collocated with the operational system. (CP-9(3))

### Transfer to alternate storage site (CP-9(5))

- The [System owner] shall transfer system backup information to the alternate storage site [Fill in: time period consistent with recovery time and recovery point objectives. Typical: daily], at [Fill in: transfer rate consistent with recovery time and recovery point objectives. Typical: a rate that keeps the alternate copy within the recovery point objective]. (CP-9(5))

### Cryptographic protection (CP-9(8))

> **Guidance:** Encrypt backups with the cryptography the organization approves under SC-13, and keep the keys where a loss of the primary site does not take them too.

- The [System owner] shall implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Fill in: backup information to protect against unauthorized disclosure and modification. Typical: all backup information]. (CP-9(8))

#### Federal systems

Federal systems use cryptographic modules validated by the NIST Cryptographic Module Validation Program, as SC-13 requires. The CMVP's [FIPS 140-3 transition page](https://csrc.nist.gov/projects/fips-140-3-transition-effort) sets the schedule for moving FIPS 140-2 validations to the Historical List in September 2026, and says that modules on the Historical List remain supported for existing systems (as of September 2026).

- The [System owner] shall encrypt backup information with CMVP-validated cryptographic modules. (CP-9(8))

### System recovery and reconstitution (CP-10)

> **Guidance:** Recovery brings the system back into operation; reconstitution returns it to its fully operational, secure state, with its controls working and checked. After a compromise, recover from backups known to be clean.

- The [System owner] shall provide for the recovery of the system to a known state within [Fill in: time period consistent with recovery time and recovery point objectives for the recovery of the system. Typical: the recovery time objective set in the contingency plan from the business impact analysis] after a disruption, compromise or failure. (CP-10)
- The [System owner] shall provide for the reconstitution of the system to a known state within [Fill in: time period consistent with recovery time and recovery point objectives for the reconstitution of the system. Typical: the reconstitution time set in the contingency plan] after a disruption, compromise or failure. (CP-10)

### Transaction recovery (CP-10(2))

- The [System owner] shall implement transaction recovery for a transaction-based system. (CP-10(2))

### Restore within time period (CP-10(4))

- The [System owner] shall provide the capability to restore system components within [Fill in: restoration time period within which to restore system components to a known, operational state. Typical: the recovery time objective set for each component in the contingency plan] from configuration-controlled and integrity-protected information representing a known, operational state for the components. (CP-10(4))

## Review and update

- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current contingency planning policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current contingency planning policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (CP-1c.1)
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current contingency planning procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (CP-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CP-1a.1(b))