Contingency Planning Policy

Contingency Planning Policy template: Ready-to-adopt Contingency Planning policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High).

Type	Program stage	Status	Template version	NIST basis
Policy	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Contingency Planning policy states what the organization requires for contingency planning and who is accountable for it. It meets CP-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. CP-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
CP-1	Policy and Procedures	Yes	Yes	Yes
CP-2	Contingency Plan	Yes	Yes	Yes
CP-2(1)	Coordinate with Related Plans		Yes	Yes
CP-2(2)	Capacity Planning			Yes
CP-2(3)	Resume Mission and Business Functions		Yes	Yes
CP-2(5)	Continue Mission and Business Functions			Yes
CP-2(8)	Identify Critical Assets		Yes	Yes
CP-3	Contingency Training	Yes	Yes	Yes
CP-3(1)	Simulated Events			Yes
CP-4	Contingency Plan Testing	Yes	Yes	Yes
CP-4(1)	Coordinate with Related Plans		Yes	Yes
CP-4(2)	Alternate Processing Site			Yes
CP-6	Alternate Storage Site		Yes	Yes
CP-6(1)	Separation from Primary Site		Yes	Yes
CP-6(2)	Recovery Time and Recovery Point Objectives			Yes
CP-6(3)	Accessibility		Yes	Yes
CP-7	Alternate Processing Site		Yes	Yes
CP-7(1)	Separation from Primary Site		Yes	Yes
CP-7(2)	Accessibility		Yes	Yes
CP-7(3)	Priority of Service		Yes	Yes
CP-7(4)	Preparation for Use			Yes
CP-8	Telecommunications Services		Yes	Yes
CP-8(1)	Priority of Service Provisions		Yes	Yes
CP-8(2)	Single Points of Failure		Yes	Yes
CP-8(3)	Separation of Primary and Alternate Providers			Yes
CP-8(4)	Provider Contingency Plan			Yes
CP-9	System Backup	Yes	Yes	Yes
CP-9(1)	Testing for Reliability and Integrity		Yes	Yes
CP-9(2)	Test Restoration Using Sampling			Yes
CP-9(3)	Separate Storage for Critical Information			Yes
CP-9(5)	Transfer to Alternate Storage Site			Yes
CP-9(8)	Cryptographic Protection		Yes	Yes
CP-10	System Recovery and Reconstitution	Yes	Yes	Yes
CP-10(2)	Transaction Recovery		Yes	Yes
CP-10(4)	Restore Within Time Period			Yes

Decisions to make first

The policy has 45 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Who sets each system’s recovery time and recovery point objectives, and from what?	CP-2, CP-10	The system owner, from a business impact analysis agreed with the business owner; the authorizing official approves them with the contingency plan.	System owner
Where are the alternate storage and processing sites for each system?	CP-6, CP-7	A second region or availability zone of the same cloud provider for cloud systems; a second data center or a recovery service for on-premises systems.	Chief Information Security Officer
How are backups protected against ransomware and deliberate deletion?	CP-9	At least one immutable or offline copy, separate backup credentials, and encryption.	Chief Information Security Officer
What kind of contingency plan test does each baseline need?	CP-4	A tabletop exercise each year for Low systems; a functional recovery test each year for Moderate and High systems, at the alternate site for High.	Chief Information Security Officer

Record your values in the Contingency Planning decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown

Everything for this family in one file: CP pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet CP-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the CP-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Contingency Planning, and who is accountable for meeting those requirements. (CP-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CP-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (CP-1a.1(a))
• The Fill in: an official to manage the contingency planning policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (CP-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (CP-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (CP-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (CP-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CP-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (CP-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (CP-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (CP-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (CP-1a.1(a))

Procedures

The Fill in: an official to manage the contingency planning policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (CP-1a.2)

Dissemination

• The Fill in: an official to manage the contingency planning policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the contingency planning policy is to be disseminated Typical: everyone within its scope, through the policy library. (CP-1a)
• The Fill in: an official to manage the contingency planning policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the contingency planning procedures are to be disseminated Typical: the people who carry them out, and the system owners. (CP-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Contingency plan (CP-2)

Guidance

The contingency plan says how a system is kept going, or brought back, after a disruption, compromise or failure. Base it on a business impact analysis, which sets the recovery objectives. The Information System Contingency Plan template follows NIST SP 800-34 Rev. 1 and covers each element of CP-2a.

• Each System owner shall develop a contingency plan for the system that identifies essential mission and business functions and the contingency requirements that go with them. (CP-2a.1)
• The contingency plan shall provide recovery objectives, restoration priorities and metrics. (CP-2a.2)
• The contingency plan shall set out contingency roles and responsibilities, and the assigned individuals with their contact information. (CP-2a.3)
• The contingency plan shall address maintaining essential mission and business functions despite a system disruption, compromise or failure. (CP-2a.4)
• The contingency plan shall address eventual, full system restoration without deterioration of the controls originally planned and implemented. (CP-2a.5)
• The contingency plan shall address the sharing of contingency information. (CP-2a.6)
• The contingency plan shall be reviewed by Fill in: personnel or roles to review a contingency plan Typical: the system owner and the system security officer and approved by Fill in: personnel or roles to approve a contingency plan Typical: the authorizing official, or the business owner the authorizing official names. (CP-2a.7)
• The System owner shall distribute copies of the contingency plan to Fill in: key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed Typical: the contingency team members, by role and to Fill in: key contingency organizational elements to which copies of the contingency plan are distributed Typical: the operations, facilities and communications functions. (CP-2b)
• The System owner shall coordinate contingency planning activities with incident handling activities. (CP-2c)
• The System owner shall review the contingency plan Fill in: frequency of contingency plan review Typical: annually. (CP-2d)
• The System owner shall update the contingency plan to address changes to the organization, the system or its environment of operation, and problems found when the plan is carried out or tested. (CP-2e)
• The System owner shall communicate contingency plan changes to Fill in: key contingency personnel (identified by name and/or by role) to communicate changes to Typical: the contingency team members, by role and to Fill in: key contingency organizational elements to communicate changes to Typical: the operations, facilities and communications functions. (CP-2f)
• The System owner shall incorporate lessons learned from contingency plan testing, training and actual contingency activities into contingency testing and training. (CP-2g)
• The System owner shall protect the contingency plan from unauthorized disclosure and modification. (CP-2h)

Coordinate with related plans (CP-2(1))

Guidance

Related plans include the business continuity plan, the continuity of operations plan, the disaster recovery plan, the incident response plan and the crisis communications plan. Coordination means the plans agree on priorities, recovery times, contacts and who declares what.

• The System owner shall coordinate contingency plan development with the organizational elements responsible for related plans. (CP-2(1))

Resume mission and business functions (CP-2(3))

• The System owner shall plan for the resumption of Select one: all; essential Typical: essential mission and business functions within Fill in: the contingency plan activation time period within which to resume mission and business functions Typical: the recovery time objective set in the contingency plan from the business impact analysis of contingency plan activation. (CP-2(3))

Identify critical assets (CP-2(8))

Guidance

Critical assets are the components, services and people the functions cannot run without. The criticality analysis (RA-9) and the business impact analysis are the usual sources.

• The System owner shall identify the critical system assets that support Select one: all; essential Typical: essential mission and business functions. (CP-2(8))

Contingency training (CP-3)

Guidance

Contingency training teaches people with a role in the plan what they do and how: who declares a disruption, how to restore from backup, how to fail over to the alternate site. Users without a contingency role need only know where to get instructions, which literacy training (AT-2) can cover.

• The System owner shall provide contingency training, consistent with assigned roles and responsibilities, to system users within Fill in: the time period within which to provide contingency training after assuming a contingency role or responsibility Typical: 30 days of their assuming a contingency role or responsibility. (CP-3a.1)
• The System owner shall provide that training when system changes require it. (CP-3a.2)
• The System owner shall provide that training Fill in: frequency at which to provide training to system users with a contingency role or responsibility Typical: annually thereafter. (CP-3a.3)
• The System owner shall review and update contingency training content Fill in: frequency at which to review and update contingency training content Typical: annually and following Fill in: events necessitating review and update of contingency training Typical: a change to the contingency plan, and lessons learned from a test or an actual contingency event. (CP-3b)

Contingency plan testing (CP-4)

Guidance

A tabletop exercise checks that people know the plan; a functional test checks that recovery actually works. NIST SP 800-84 describes both. Plan each test with the test plan template, record the results in an after-action report, and track corrective actions to closure.

• The System owner shall test the contingency plan Fill in: frequency of testing the contingency plan for the system Typical: annually, using Fill in: tests for determining the effectiveness of the contingency plan Typical: a functional test that restores the system, or a representative part of it, from backup to determine the plan’s effectiveness and Fill in: tests for determining readiness to execute the contingency plan Typical: a tabletop exercise that walks the contingency team through the plan to determine readiness to execute it. (CP-4a)
• The System owner shall review the contingency plan test results. (CP-4b)
• The System owner shall initiate corrective actions where the results show they are needed, and track them in the plan of action and milestones. (CP-4c)

Coordinate with related plans (CP-4(1))

• The System owner shall coordinate contingency plan testing with the organizational elements responsible for related plans. (CP-4(1))

Alternate storage site (CP-6)

Guidance

The alternate storage site holds the backups needed to recover the system. For a system in the cloud, a separate region or availability zone from the same provider can serve as the alternate site, if it meets the separation and control requirements below and the provider agreement supports it.

• The System owner shall establish an alternate storage site, including the agreements needed to permit the storage and retrieval of system backup information. (CP-6a)
• The System owner shall ensure the alternate storage site provides controls equivalent to those of the primary site. (CP-6b)

Separation from primary site (CP-6(1))

• The System owner shall identify an alternate storage site sufficiently separated from the primary storage site to reduce susceptibility to the same threats. (CP-6(1))

Accessibility (CP-6(3))

• The System owner shall identify potential problems with access to the alternate storage site in an area-wide disruption or disaster, and set out explicit mitigation actions. (CP-6(3))

Alternate processing site (CP-7)

Guidance

The alternate processing site is where the system runs when the primary site cannot. For a system in the cloud, a separate region or availability zone from the same provider can serve as the alternate site, if it meets the separation and control requirements below and the provider agreement supports it.

• The System owner shall establish an alternate processing site, including the agreements needed to permit the transfer and resumption of Fill in: system operations for essential mission and business functions Typical: the system operations that support essential mission and business functions for essential mission and business functions within Fill in: time period consistent with recovery time and recovery point objectives Typical: the recovery time objective set in the contingency plan from the business impact analysis when the primary processing capabilities are unavailable. (CP-7a)
• The System owner shall make available at the alternate processing site the equipment and supplies needed to transfer and resume operations, or put contracts in place to deliver them to the site within that time period. (CP-7b)
• The System owner shall provide controls at the alternate processing site equivalent to those at the primary site. (CP-7c)

Separation from primary site (CP-7(1))

• The System owner shall identify an alternate processing site sufficiently separated from the primary processing site to reduce susceptibility to the same threats. (CP-7(1))

Accessibility (CP-7(2))

• The System owner shall identify potential problems with access to the alternate processing site in an area-wide disruption or disaster, and set out explicit mitigation actions. (CP-7(2))

Priority of service (CP-7(3))

• The System owner shall ensure alternate processing site agreements contain priority-of-service provisions in accordance with the system’s availability requirements, including recovery time objectives. (CP-7(3))

Telecommunications services (CP-8)

Guidance

Alternate telecommunications keep the system reachable when the primary network or internet service fails, at the primary site or at the alternate sites: for example a second internet provider, a wireless backup link, or a provider-managed network with diverse paths.

• The System owner shall establish alternate telecommunications services, including the agreements needed to permit the resumption of Fill in: system operations to be resumed for essential mission and business functions Typical: the system operations that support essential mission and business functions for essential mission and business functions within Fill in: time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable Typical: the recovery time objective set in the contingency plan from the business impact analysis when the primary telecommunications capabilities are unavailable at the primary or alternate processing or storage sites. (CP-8)

Priority of service provisions (CP-8(1))

• The System owner shall ensure primary and alternate telecommunications service agreements contain priority-of-service provisions in accordance with the system’s availability requirements, including recovery time objectives. (CP-8(1)(a))
• Where the primary or alternate telecommunications services are provided by a common carrier, the System owner shall request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness. (CP-8(1)(b))

Federal systems

Telecommunications Service Priority is an FCC program, managed by CISA, which requires service providers to prioritize provisioning and restoration of voice and data circuits for organizations with national security and emergency preparedness missions (checked September 2026). CISA’s priority services are open to all levels of government and to organizations in the critical infrastructure sectors.

• The System owner shall register the system’s national security and emergency preparedness circuits in the Telecommunications Service Priority program. (CP-8(1)(b))

Single points of failure (CP-8(2))

• The System owner shall obtain alternate telecommunications services that reduce the likelihood of sharing a single point of failure with the primary telecommunications services. (CP-8(2))

System backup (CP-9)

Guidance

Set backup frequencies from the recovery point objectives in the contingency plan: how much data the business can afford to lose. Keep at least one copy that ransomware on the production network cannot reach or change, such as an immutable or offline copy.

• The System owner shall ensure backups of user-level information in Fill in: system components for which to conduct backups of user-level information Typical: all servers and cloud storage that hold user data are made Fill in: frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives Typical: daily incremental and weekly full, or more often where the recovery point objective requires it. (CP-9a)
• The System owner shall ensure backups of system-level information are made Fill in: frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives Typical: daily incremental and weekly full, or more often where the recovery point objective requires it. (CP-9b)
• The System owner shall ensure backups of system documentation, including security- and privacy-related documentation, are made Fill in: frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives Typical: on each change. (CP-9c)
• The System owner shall protect the confidentiality, integrity and availability of backup information. (CP-9d)

Testing for reliability and integrity (CP-9(1))

• The System owner shall test backup information Fill in: frequency at which to test backup information for media reliability Typical: quarterly to verify media reliability. (CP-9(1))
• The System owner shall test backup information Fill in: frequency at which to test backup information for information integrity Typical: quarterly to verify information integrity. (CP-9(1))

Cryptographic protection (CP-9(8))

Guidance

Encrypt backups with the cryptography the organization approves under SC-13, and keep the keys where a loss of the primary site does not take them too.

• The System owner shall implement cryptographic mechanisms to prevent unauthorized disclosure and modification of Fill in: backup information to protect against unauthorized disclosure and modification Typical: all backup information. (CP-9(8))

Federal systems

Federal systems use cryptographic modules validated by the NIST Cryptographic Module Validation Program, as SC-13 requires. The CMVP’s FIPS 140-3 transition page sets the schedule for moving FIPS 140-2 validations to the Historical List in September 2026, and says that modules on the Historical List remain supported for existing systems (as of September 2026).

• The System owner shall encrypt backup information with CMVP-validated cryptographic modules. (CP-9(8))

System recovery and reconstitution (CP-10)

Guidance

Recovery brings the system back into operation; reconstitution returns it to its fully operational, secure state, with its controls working and checked. After a compromise, recover from backups known to be clean.

• The System owner shall provide for the recovery of the system to a known state within Fill in: time period consistent with recovery time and recovery point objectives for the recovery of the system Typical: the recovery time objective set in the contingency plan from the business impact analysis after a disruption, compromise or failure. (CP-10)
• The System owner shall provide for the reconstitution of the system to a known state within Fill in: time period consistent with recovery time and recovery point objectives for the reconstitution of the system Typical: the reconstitution time set in the contingency plan after a disruption, compromise or failure. (CP-10)

Transaction recovery (CP-10(2))

• The System owner shall implement transaction recovery for a transaction-based system. (CP-10(2))

Review and update

• The Fill in: an official to manage the contingency planning policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current contingency planning policy is reviewed and updated Typical: annually and following Fill in: events that would require the current contingency planning policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (CP-1c.1)
• The Fill in: an official to manage the contingency planning policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current contingency planning procedures are reviewed and updated Typical: annually and following Fill in: events that would require procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (CP-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CP-1a.1(b))