Skip to content

Contingency Plan Test Plan

Contingency Plan Test Plan template: The plan for one contingency plan test or exercise, tabletop or functional, with objectives, scenario, participants and evaluation, based on the sample exercise documentation in NIST SP 800-84.

TypeProgram stageStatusTemplate versionNIST basis
PlanOperateDraft1.0.0SP 800-53 release 5.2.0

The plan for one contingency plan test or exercise, tabletop or functional, with objectives, scenario, participants and evaluation, based on the sample exercise documentation in NIST SP 800-84.

ControlTitle
CP-4Contingency Plan Testing
CP-4(1)Coordinate with Related Plans
CP-4(2)Alternate Processing Site
CP-3(1)Simulated Events
CP-9(2)Test Restoration Using Sampling
VariantReady to adoptAnnotated
All baselinesWord · MarkdownWord · Markdown
SystemTest typeTest dateTest leadPlan version tested
Fill in: system name and identifierFill in: tabletop or functionalFill in: dateFill in: name and titleFill in: version

The contingency plan is tested Fill in: frequency of testing the contingency plan for the system Typical: annually, using Fill in: tests for determining the effectiveness of the contingency plan Typical: a functional test that restores the system, or a representative part of it, from backup to determine its effectiveness and Fill in: tests for determining readiness to execute the contingency plan Typical: a tabletop exercise that walks the contingency team through the plan to determine readiness to execute it (CP-4a). This test is Fill in: which of those tests this is, and why it was chosen.

ItemDescription
In scopeFill in: components, sites, teams and plan sections tested
Out of scopeFill in: what is not tested
LocationFill in: where the test takes place, including the alternate processing site for High systems (CP-4(2))
SafeguardsFill in: how production is protected during a functional test, and who can stop the test
Related plansFill in: related plans and the teams responsible for them, involved in this test (CP-4(1))
ObjectiveHow it is measured
Fill in: for example the team activates the plan and notifies everyone within 1 hourFill in: measure
Fill in: for example the database is restored from backup within the RTO and to the RPO (CP-9(2))Fill in: measure
Fill in: for example personnel at the alternate site can reach the resources they need (CP-4(2))Fill in: measure
RoleNameTest role
Test lead or facilitatorFill in: nameRuns the test
Fill in: contingency roleFill in: namePlayer
Observer or evaluatorFill in: nameRecords what happens against the objectives
TimeActivity
Fill in: timeBriefing: objectives, rules and safeguards
Fill in: timeScenario and exercise
Fill in: timeDebrief (hotwash)

Scenario: Fill in: the event that triggers the plan, for example ransomware encrypts the primary database server at the start of the business day

Time or stepInject or actionExpected response
Fill in: time or stepFill in: new information given to players, or a recovery action to performFill in: what the plan says should happen
  • Fill in: for example what worked well
  • Fill in: for example where the plan was unclear or out of date
  • Fill in: for example what slowed recovery

The evaluators record, for each objective, whether it was met and what they observed. The results, findings and recommendations go in the after-action report, and corrective actions are tracked to completion (CP-4b, CP-4c).

NameTitleSignatureDate
Fill in: nameSystem ownerFill in: date

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.