# Contingency Planning Policy

**Template version:** 1.0.0 · **Baseline:** Low · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/cp/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet CP-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the CP-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Contingency Planning, and who is accountable for meeting those requirements. (CP-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CP-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (CP-1a.1(a))
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (CP-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (CP-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (CP-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (CP-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CP-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (CP-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (CP-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (CP-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (CP-1a.1(a))

## Procedures

The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (CP-1a.2)

## Dissemination

- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the contingency planning policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (CP-1a)
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the contingency planning procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (CP-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Contingency plan (CP-2)

> **Guidance:** The contingency plan says how a system is kept going, or brought back, after a disruption, compromise or failure. Base it on a [business impact analysis](https://kston83.github.io/nist-guide/templates/reports/business-impact-analysis/), which sets the recovery objectives. The [Information System Contingency Plan template](https://kston83.github.io/nist-guide/templates/plans/contingency-plan/) follows NIST SP 800-34 Rev. 1 and covers each element of CP-2a.

- Each [System owner] shall develop a contingency plan for the system that identifies essential mission and business functions and the contingency requirements that go with them. (CP-2a.1)
- The contingency plan shall provide recovery objectives, restoration priorities and metrics. (CP-2a.2)
- The contingency plan shall set out contingency roles and responsibilities, and the assigned individuals with their contact information. (CP-2a.3)
- The contingency plan shall address maintaining essential mission and business functions despite a system disruption, compromise or failure. (CP-2a.4)
- The contingency plan shall address eventual, full system restoration without deterioration of the controls originally planned and implemented. (CP-2a.5)
- The contingency plan shall address the sharing of contingency information. (CP-2a.6)
- The contingency plan shall be reviewed by [Fill in: personnel or roles to review a contingency plan. Typical: the system owner and the system security officer] and approved by [Fill in: personnel or roles to approve a contingency plan. Typical: the authorizing official, or the business owner the authorizing official names]. (CP-2a.7)
- The [System owner] shall distribute copies of the contingency plan to [Fill in: key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed. Typical: the contingency team members, by role] and to [Fill in: key contingency organizational elements to which copies of the contingency plan are distributed. Typical: the operations, facilities and communications functions]. (CP-2b)
- The [System owner] shall coordinate contingency planning activities with incident handling activities. (CP-2c)
- The [System owner] shall review the contingency plan [Fill in: frequency of contingency plan review. Typical: annually]. (CP-2d)
- The [System owner] shall update the contingency plan to address changes to the organization, the system or its environment of operation, and problems found when the plan is carried out or tested. (CP-2e)
- The [System owner] shall communicate contingency plan changes to [Fill in: key contingency personnel (identified by name and/or by role) to communicate changes to. Typical: the contingency team members, by role] and to [Fill in: key contingency organizational elements to communicate changes to. Typical: the operations, facilities and communications functions]. (CP-2f)
- The [System owner] shall incorporate lessons learned from contingency plan testing, training and actual contingency activities into contingency testing and training. (CP-2g)
- The [System owner] shall protect the contingency plan from unauthorized disclosure and modification. (CP-2h)

### Contingency training (CP-3)

> **Guidance:** Contingency training teaches people with a role in the plan what they do and how: who declares a disruption, how to restore from backup, how to fail over to the alternate site. Users without a contingency role need only know where to get instructions, which literacy training (AT-2) can cover.

- The [System owner] shall provide contingency training, consistent with assigned roles and responsibilities, to system users within [Fill in: the time period within which to provide contingency training after assuming a contingency role or responsibility. Typical: 30 days] of their assuming a contingency role or responsibility. (CP-3a.1)
- The [System owner] shall provide that training when system changes require it. (CP-3a.2)
- The [System owner] shall provide that training [Fill in: frequency at which to provide training to system users with a contingency role or responsibility. Typical: annually] thereafter. (CP-3a.3)
- The [System owner] shall review and update contingency training content [Fill in: frequency at which to review and update contingency training content. Typical: annually] and following [Fill in: events necessitating review and update of contingency training. Typical: a change to the contingency plan, and lessons learned from a test or an actual contingency event]. (CP-3b)

### Contingency plan testing (CP-4)

> **Guidance:** A tabletop exercise checks that people know the plan; a functional test checks that recovery actually works. NIST SP 800-84 describes both. Plan each test with the [test plan template](https://kston83.github.io/nist-guide/templates/plans/contingency-plan-test-plan/), record the results in an [after-action report](https://kston83.github.io/nist-guide/templates/reports/contingency-plan-after-action-report/), and track corrective actions to closure.

- The [System owner] shall test the contingency plan [Fill in: frequency of testing the contingency plan for the system. Typical: annually], using [Fill in: tests for determining the effectiveness of the contingency plan. Typical: a functional test that restores the system, or a representative part of it, from backup] to determine the plan's effectiveness and [Fill in: tests for determining readiness to execute the contingency plan. Typical: a tabletop exercise that walks the contingency team through the plan] to determine readiness to execute it. (CP-4a)
- The [System owner] shall review the contingency plan test results. (CP-4b)
- The [System owner] shall initiate corrective actions where the results show they are needed, and track them in the plan of action and milestones. (CP-4c)

### System backup (CP-9)

> **Guidance:** Set backup frequencies from the recovery point objectives in the contingency plan: how much data the business can afford to lose. Keep at least one copy that ransomware on the production network cannot reach or change, such as an immutable or offline copy.

- The [System owner] shall ensure backups of user-level information in [Fill in: system components for which to conduct backups of user-level information. Typical: all servers and cloud storage that hold user data] are made [Fill in: frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives. Typical: daily incremental and weekly full, or more often where the recovery point objective requires it]. (CP-9a)
- The [System owner] shall ensure backups of system-level information are made [Fill in: frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives. Typical: daily incremental and weekly full, or more often where the recovery point objective requires it]. (CP-9b)
- The [System owner] shall ensure backups of system documentation, including security- and privacy-related documentation, are made [Fill in: frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives. Typical: on each change]. (CP-9c)
- The [System owner] shall protect the confidentiality, integrity and availability of backup information. (CP-9d)

### System recovery and reconstitution (CP-10)

> **Guidance:** Recovery brings the system back into operation; reconstitution returns it to its fully operational, secure state, with its controls working and checked. After a compromise, recover from backups known to be clean.

- The [System owner] shall provide for the recovery of the system to a known state within [Fill in: time period consistent with recovery time and recovery point objectives for the recovery of the system. Typical: the recovery time objective set in the contingency plan from the business impact analysis] after a disruption, compromise or failure. (CP-10)
- The [System owner] shall provide for the reconstitution of the system to a known state within [Fill in: time period consistent with recovery time and recovery point objectives for the reconstitution of the system. Typical: the reconstitution time set in the contingency plan] after a disruption, compromise or failure. (CP-10)

## Review and update

- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current contingency planning policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current contingency planning policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (CP-1c.1)
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current contingency planning procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (CP-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CP-1a.1(b))