# Contingency Planning Policy

**Template version:** 1.0.0 · **Baseline:** Moderate · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/cp/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Contingency Planning, and who is accountable for meeting those requirements. (CP-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CP-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (CP-1a.1(a))
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (CP-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (CP-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (CP-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (CP-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CP-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (CP-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (CP-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (CP-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (CP-1a.1(a))

## Procedures

The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (CP-1a.2)

## Dissemination

- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the contingency planning policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (CP-1a)
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the contingency planning procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (CP-1a)

## Policy statements

### Contingency plan (CP-2)

- Each [System owner] shall develop a contingency plan for the system that identifies essential mission and business functions and the contingency requirements that go with them. (CP-2a.1)
- The contingency plan shall provide recovery objectives, restoration priorities and metrics. (CP-2a.2)
- The contingency plan shall set out contingency roles and responsibilities, and the assigned individuals with their contact information. (CP-2a.3)
- The contingency plan shall address maintaining essential mission and business functions despite a system disruption, compromise or failure. (CP-2a.4)
- The contingency plan shall address eventual, full system restoration without deterioration of the controls originally planned and implemented. (CP-2a.5)
- The contingency plan shall address the sharing of contingency information. (CP-2a.6)
- The contingency plan shall be reviewed by [Fill in: personnel or roles to review a contingency plan. Typical: the system owner and the system security officer] and approved by [Fill in: personnel or roles to approve a contingency plan. Typical: the authorizing official, or the business owner the authorizing official names]. (CP-2a.7)
- The [System owner] shall distribute copies of the contingency plan to [Fill in: key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed. Typical: the contingency team members, by role] and to [Fill in: key contingency organizational elements to which copies of the contingency plan are distributed. Typical: the operations, facilities and communications functions]. (CP-2b)
- The [System owner] shall coordinate contingency planning activities with incident handling activities. (CP-2c)
- The [System owner] shall review the contingency plan [Fill in: frequency of contingency plan review. Typical: annually]. (CP-2d)
- The [System owner] shall update the contingency plan to address changes to the organization, the system or its environment of operation, and problems found when the plan is carried out or tested. (CP-2e)
- The [System owner] shall communicate contingency plan changes to [Fill in: key contingency personnel (identified by name and/or by role) to communicate changes to. Typical: the contingency team members, by role] and to [Fill in: key contingency organizational elements to communicate changes to. Typical: the operations, facilities and communications functions]. (CP-2f)
- The [System owner] shall incorporate lessons learned from contingency plan testing, training and actual contingency activities into contingency testing and training. (CP-2g)
- The [System owner] shall protect the contingency plan from unauthorized disclosure and modification. (CP-2h)

### Coordinate with related plans (CP-2(1))

- The [System owner] shall coordinate contingency plan development with the organizational elements responsible for related plans. (CP-2(1))

### Resume mission and business functions (CP-2(3))

- The [System owner] shall plan for the resumption of [Select one: all; essential. Typical: essential] mission and business functions within [Fill in: the contingency plan activation time period within which to resume mission and business functions. Typical: the recovery time objective set in the contingency plan from the business impact analysis] of contingency plan activation. (CP-2(3))

### Identify critical assets (CP-2(8))

- The [System owner] shall identify the critical system assets that support [Select one: all; essential. Typical: essential] mission and business functions. (CP-2(8))

### Contingency training (CP-3)

- The [System owner] shall provide contingency training, consistent with assigned roles and responsibilities, to system users within [Fill in: the time period within which to provide contingency training after assuming a contingency role or responsibility. Typical: 30 days] of their assuming a contingency role or responsibility. (CP-3a.1)
- The [System owner] shall provide that training when system changes require it. (CP-3a.2)
- The [System owner] shall provide that training [Fill in: frequency at which to provide training to system users with a contingency role or responsibility. Typical: annually] thereafter. (CP-3a.3)
- The [System owner] shall review and update contingency training content [Fill in: frequency at which to review and update contingency training content. Typical: annually] and following [Fill in: events necessitating review and update of contingency training. Typical: a change to the contingency plan, and lessons learned from a test or an actual contingency event]. (CP-3b)

### Contingency plan testing (CP-4)

- The [System owner] shall test the contingency plan [Fill in: frequency of testing the contingency plan for the system. Typical: annually], using [Fill in: tests for determining the effectiveness of the contingency plan. Typical: a functional test that restores the system, or a representative part of it, from backup] to determine the plan's effectiveness and [Fill in: tests for determining readiness to execute the contingency plan. Typical: a tabletop exercise that walks the contingency team through the plan] to determine readiness to execute it. (CP-4a)
- The [System owner] shall review the contingency plan test results. (CP-4b)
- The [System owner] shall initiate corrective actions where the results show they are needed, and track them in the plan of action and milestones. (CP-4c)

### Coordinate with related plans (CP-4(1))

- The [System owner] shall coordinate contingency plan testing with the organizational elements responsible for related plans. (CP-4(1))

### Alternate storage site (CP-6)

- The [System owner] shall establish an alternate storage site, including the agreements needed to permit the storage and retrieval of system backup information. (CP-6a)
- The [System owner] shall ensure the alternate storage site provides controls equivalent to those of the primary site. (CP-6b)

### Separation from primary site (CP-6(1))

- The [System owner] shall identify an alternate storage site sufficiently separated from the primary storage site to reduce susceptibility to the same threats. (CP-6(1))

### Accessibility (CP-6(3))

- The [System owner] shall identify potential problems with access to the alternate storage site in an area-wide disruption or disaster, and set out explicit mitigation actions. (CP-6(3))

### Alternate processing site (CP-7)

- The [System owner] shall establish an alternate processing site, including the agreements needed to permit the transfer and resumption of [Fill in: system operations for essential mission and business functions. Typical: the system operations that support essential mission and business functions] for essential mission and business functions within [Fill in: time period consistent with recovery time and recovery point objectives. Typical: the recovery time objective set in the contingency plan from the business impact analysis] when the primary processing capabilities are unavailable. (CP-7a)
- The [System owner] shall make available at the alternate processing site the equipment and supplies needed to transfer and resume operations, or put contracts in place to deliver them to the site within that time period. (CP-7b)
- The [System owner] shall provide controls at the alternate processing site equivalent to those at the primary site. (CP-7c)

### Separation from primary site (CP-7(1))

- The [System owner] shall identify an alternate processing site sufficiently separated from the primary processing site to reduce susceptibility to the same threats. (CP-7(1))

### Accessibility (CP-7(2))

- The [System owner] shall identify potential problems with access to the alternate processing site in an area-wide disruption or disaster, and set out explicit mitigation actions. (CP-7(2))

### Priority of service (CP-7(3))

- The [System owner] shall ensure alternate processing site agreements contain priority-of-service provisions in accordance with the system's availability requirements, including recovery time objectives. (CP-7(3))

### Telecommunications services (CP-8)

- The [System owner] shall establish alternate telecommunications services, including the agreements needed to permit the resumption of [Fill in: system operations to be resumed for essential mission and business functions. Typical: the system operations that support essential mission and business functions] for essential mission and business functions within [Fill in: time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable. Typical: the recovery time objective set in the contingency plan from the business impact analysis] when the primary telecommunications capabilities are unavailable at the primary or alternate processing or storage sites. (CP-8)

### Priority of service provisions (CP-8(1))

- The [System owner] shall ensure primary and alternate telecommunications service agreements contain priority-of-service provisions in accordance with the system's availability requirements, including recovery time objectives. (CP-8(1)(a))
- Where the primary or alternate telecommunications services are provided by a common carrier, the [System owner] shall request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness. (CP-8(1)(b))

#### Federal systems

[Telecommunications Service Priority](https://www.cisa.gov/resources-tools/services/telecommunications-service-priority-tsp) is an FCC program, managed by CISA, which requires service providers to prioritize provisioning and restoration of voice and data circuits for organizations with national security and emergency preparedness missions (checked September 2026). CISA's priority services are open to all levels of government and to organizations in the critical infrastructure sectors.

- The [System owner] shall register the system's national security and emergency preparedness circuits in the Telecommunications Service Priority program. (CP-8(1)(b))

### Single points of failure (CP-8(2))

- The [System owner] shall obtain alternate telecommunications services that reduce the likelihood of sharing a single point of failure with the primary telecommunications services. (CP-8(2))

### System backup (CP-9)

- The [System owner] shall ensure backups of user-level information in [Fill in: system components for which to conduct backups of user-level information. Typical: all servers and cloud storage that hold user data] are made [Fill in: frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives. Typical: daily incremental and weekly full, or more often where the recovery point objective requires it]. (CP-9a)
- The [System owner] shall ensure backups of system-level information are made [Fill in: frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives. Typical: daily incremental and weekly full, or more often where the recovery point objective requires it]. (CP-9b)
- The [System owner] shall ensure backups of system documentation, including security- and privacy-related documentation, are made [Fill in: frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives. Typical: on each change]. (CP-9c)
- The [System owner] shall protect the confidentiality, integrity and availability of backup information. (CP-9d)

### Testing for reliability and integrity (CP-9(1))

- The [System owner] shall test backup information [Fill in: frequency at which to test backup information for media reliability. Typical: quarterly] to verify media reliability. (CP-9(1))
- The [System owner] shall test backup information [Fill in: frequency at which to test backup information for information integrity. Typical: quarterly] to verify information integrity. (CP-9(1))

### Cryptographic protection (CP-9(8))

- The [System owner] shall implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Fill in: backup information to protect against unauthorized disclosure and modification. Typical: all backup information]. (CP-9(8))

#### Federal systems

Federal systems use cryptographic modules validated by the NIST Cryptographic Module Validation Program, as SC-13 requires. The CMVP's [FIPS 140-3 transition page](https://csrc.nist.gov/projects/fips-140-3-transition-effort) sets the schedule for moving FIPS 140-2 validations to the Historical List in September 2026, and says that modules on the Historical List remain supported for existing systems (as of September 2026).

- The [System owner] shall encrypt backup information with CMVP-validated cryptographic modules. (CP-9(8))

### System recovery and reconstitution (CP-10)

- The [System owner] shall provide for the recovery of the system to a known state within [Fill in: time period consistent with recovery time and recovery point objectives for the recovery of the system. Typical: the recovery time objective set in the contingency plan from the business impact analysis] after a disruption, compromise or failure. (CP-10)
- The [System owner] shall provide for the reconstitution of the system to a known state within [Fill in: time period consistent with recovery time and recovery point objectives for the reconstitution of the system. Typical: the reconstitution time set in the contingency plan] after a disruption, compromise or failure. (CP-10)

### Transaction recovery (CP-10(2))

- The [System owner] shall implement transaction recovery for a transaction-based system. (CP-10(2))

## Review and update

- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current contingency planning policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current contingency planning policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (CP-1c.1)
- The [Fill in: an official to manage the contingency planning policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current contingency planning procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (CP-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CP-1a.1(b))