# Contingency Planning Policy

**Template version:** 1.0.0 · **Baseline:** Low · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/cp/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Contingency Planning, and who is accountable for meeting those requirements. (CP-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CP-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (CP-1a.1(a))
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (CP-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (CP-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (CP-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (CP-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CP-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (CP-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (CP-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (CP-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (CP-1a.1(a))

## Procedures

The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (CP-1a.2)

## Dissemination

- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the contingency planning policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (CP-1a)
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the contingency planning procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (CP-1a)

## Policy statements

### Contingency plan (CP-2)

- Each [System owner] shall develop a contingency plan for the system that identifies essential mission and business functions and the contingency requirements that go with them. (CP-2a.1)
- The contingency plan shall provide recovery objectives, restoration priorities and metrics. (CP-2a.2)
- The contingency plan shall set out contingency roles and responsibilities, and the assigned individuals with their contact information. (CP-2a.3)
- The contingency plan shall address maintaining essential mission and business functions despite a system disruption, compromise or failure. (CP-2a.4)
- The contingency plan shall address eventual, full system restoration without deterioration of the controls originally planned and implemented. (CP-2a.5)
- The contingency plan shall address the sharing of contingency information. (CP-2a.6)
- The contingency plan shall be reviewed by [Fill in: personnel or roles to review a contingency plan. Typical: the system owner and the system security officer] and approved by [Fill in: personnel or roles to approve a contingency plan. Typical: the authorizing official, or the business owner the authorizing official names]. (CP-2a.7)
- The [System owner] shall distribute copies of the contingency plan to [Fill in: key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed. Typical: the contingency team members, by role] and to [Fill in: key contingency organizational elements to which copies of the contingency plan are distributed. Typical: the operations, facilities and communications functions]. (CP-2b)
- The [System owner] shall coordinate contingency planning activities with incident handling activities. (CP-2c)
- The [System owner] shall review the contingency plan [Fill in: frequency of contingency plan review. Typical: annually]. (CP-2d)
- The [System owner] shall update the contingency plan to address changes to the organization, the system or its environment of operation, and problems found when the plan is carried out or tested. (CP-2e)
- The [System owner] shall communicate contingency plan changes to [Fill in: key contingency personnel (identified by name and/or by role) to communicate changes to. Typical: the contingency team members, by role] and to [Fill in: key contingency organizational elements to communicate changes to. Typical: the operations, facilities and communications functions]. (CP-2f)
- The [System owner] shall incorporate lessons learned from contingency plan testing, training and actual contingency activities into contingency testing and training. (CP-2g)
- The [System owner] shall protect the contingency plan from unauthorized disclosure and modification. (CP-2h)

### Contingency training (CP-3)

- The [System owner] shall provide contingency training, consistent with assigned roles and responsibilities, to system users within [Fill in: the time period within which to provide contingency training after assuming a contingency role or responsibility. Typical: 30 days] of their assuming a contingency role or responsibility. (CP-3a.1)
- The [System owner] shall provide that training when system changes require it. (CP-3a.2)
- The [System owner] shall provide that training [Fill in: frequency at which to provide training to system users with a contingency role or responsibility. Typical: annually] thereafter. (CP-3a.3)
- The [System owner] shall review and update contingency training content [Fill in: frequency at which to review and update contingency training content. Typical: annually] and following [Fill in: events necessitating review and update of contingency training. Typical: a change to the contingency plan, and lessons learned from a test or an actual contingency event]. (CP-3b)

### Contingency plan testing (CP-4)

- The [System owner] shall test the contingency plan [Fill in: frequency of testing the contingency plan for the system. Typical: annually], using [Fill in: tests for determining the effectiveness of the contingency plan. Typical: a functional test that restores the system, or a representative part of it, from backup] to determine the plan's effectiveness and [Fill in: tests for determining readiness to execute the contingency plan. Typical: a tabletop exercise that walks the contingency team through the plan] to determine readiness to execute it. (CP-4a)
- The [System owner] shall review the contingency plan test results. (CP-4b)
- The [System owner] shall initiate corrective actions where the results show they are needed, and track them in the plan of action and milestones. (CP-4c)

### System backup (CP-9)

- The [System owner] shall ensure backups of user-level information in [Fill in: system components for which to conduct backups of user-level information. Typical: all servers and cloud storage that hold user data] are made [Fill in: frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives. Typical: daily incremental and weekly full, or more often where the recovery point objective requires it]. (CP-9a)
- The [System owner] shall ensure backups of system-level information are made [Fill in: frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives. Typical: daily incremental and weekly full, or more often where the recovery point objective requires it]. (CP-9b)
- The [System owner] shall ensure backups of system documentation, including security- and privacy-related documentation, are made [Fill in: frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives. Typical: on each change]. (CP-9c)
- The [System owner] shall protect the confidentiality, integrity and availability of backup information. (CP-9d)

### System recovery and reconstitution (CP-10)

- The [System owner] shall provide for the recovery of the system to a known state within [Fill in: time period consistent with recovery time and recovery point objectives for the recovery of the system. Typical: the recovery time objective set in the contingency plan from the business impact analysis] after a disruption, compromise or failure. (CP-10)
- The [System owner] shall provide for the reconstitution of the system to a known state within [Fill in: time period consistent with recovery time and recovery point objectives for the reconstitution of the system. Typical: the reconstitution time set in the contingency plan] after a disruption, compromise or failure. (CP-10)

## Review and update

- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current contingency planning policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current contingency planning policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (CP-1c.1)
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current contingency planning procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (CP-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CP-1a.1(b))