Contingency Planning Decision Worksheet

Contingency Planning Decision Worksheet template: Every decision the Contingency Planning family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Contingency Planning family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every CP control in the baseline, with a typical value where the Contingency Planning Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV

Decisions (Moderate baseline)

42 decisions.

Decision	Control	Typical value	Who decides
Who sets each system’s recovery time and recovery point objectives, and from what?	CP-2, CP-10	The system owner, from a business impact analysis agreed with the business owner; the authorizing official approves them with the contingency plan.	System owner
Where are the alternate storage and processing sites for each system?	CP-6, CP-7	A second region or availability zone of the same cloud provider for cloud systems; a second data center or a recovery service for on-premises systems.	Chief Information Security Officer
How are backups protected against ransomware and deliberate deletion?	CP-9	At least one immutable or offline copy, separate backup credentials, and encryption.	Chief Information Security Officer
What kind of contingency plan test does each baseline need?	CP-4	A tabletop exercise each year for Low systems; a functional recovery test each year for Moderate and High systems, at the alternate site for High.	Chief Information Security Officer
Personnel or roles to whom the contingency planning policy is to be disseminated	CP-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the contingency planning procedures are to be disseminated	CP-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	CP-1	Organization-level	Chief Information Security Officer
An official to manage the contingency planning policy and procedures	CP-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current contingency planning policy is reviewed and updated	CP-1	Annually	Chief Information Security Officer
Events that would require the current contingency planning policy to be reviewed and updated	CP-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current contingency planning procedures are reviewed and updated	CP-1	Annually	Chief Information Security Officer
Events that would require procedures to be reviewed and updated	CP-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
Personnel or roles to review a contingency plan	CP-2	The system owner and the system security officer	Chief Information Security Officer
Personnel or roles to approve a contingency plan	CP-2	The authorizing official, or the business owner the authorizing official names	Chief Information Security Officer
Key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed	CP-2	The contingency team members, by role	Chief Information Security Officer
Key contingency organizational elements to which copies of the contingency plan are distributed	CP-2	The operations, facilities and communications functions	Chief Information Security Officer
Frequency of contingency plan review	CP-2	Annually	Chief Information Security Officer
Key contingency personnel (identified by name and/or by role) to communicate changes to	CP-2	The contingency team members, by role	Chief Information Security Officer
Key contingency organizational elements to communicate changes to	CP-2	The operations, facilities and communications functions	Chief Information Security Officer
Select one: all; essential	CP-2(3)	Essential	Chief Information Security Officer
The contingency plan activation time period within which to resume mission and business functions	CP-2(3)	The recovery time objective set in the contingency plan from the business impact analysis	Chief Information Security Officer
Select one: all; essential	CP-2(8)	Essential	Chief Information Security Officer
The time period within which to provide contingency training after assuming a contingency role or responsibility	CP-3	30 days	Chief Information Security Officer
Frequency at which to provide training to system users with a contingency role or responsibility	CP-3	Annually	Chief Information Security Officer
Frequency at which to review and update contingency training content	CP-3	Annually	Chief Information Security Officer
Events necessitating review and update of contingency training	CP-3	A change to the contingency plan, and lessons learned from a test or an actual contingency event	Chief Information Security Officer
Frequency of testing the contingency plan for the system	CP-4	Annually	Chief Information Security Officer
Tests for determining the effectiveness of the contingency plan	CP-4	A functional test that restores the system, or a representative part of it, from backup	Chief Information Security Officer
Tests for determining readiness to execute the contingency plan	CP-4	A tabletop exercise that walks the contingency team through the plan	Chief Information Security Officer
System operations for essential mission and business functions	CP-7	The system operations that support essential mission and business functions	Chief Information Security Officer
Time period consistent with recovery time and recovery point objectives	CP-7	The recovery time objective set in the contingency plan from the business impact analysis	Chief Information Security Officer
System operations to be resumed for essential mission and business functions	CP-8	The system operations that support essential mission and business functions	Chief Information Security Officer
Time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable	CP-8	The recovery time objective set in the contingency plan from the business impact analysis	Chief Information Security Officer
System components for which to conduct backups of user-level information	CP-9	All servers and cloud storage that hold user data	Chief Information Security Officer
Frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives	CP-9	Daily incremental and weekly full, or more often where the recovery point objective requires it	Chief Information Security Officer
Frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives	CP-9	Daily incremental and weekly full, or more often where the recovery point objective requires it	Chief Information Security Officer
Frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives	CP-9	On each change	Chief Information Security Officer
Frequency at which to test backup information for media reliability	CP-9(1)	Quarterly	Chief Information Security Officer
Frequency at which to test backup information for information integrity	CP-9(1)	Quarterly	Chief Information Security Officer
Backup information to protect against unauthorized disclosure and modification	CP-9(8)	All backup information	Chief Information Security Officer
Time period consistent with recovery time and recovery point objectives for the recovery of the system	CP-10	The recovery time objective set in the contingency plan from the business impact analysis	Chief Information Security Officer
Time period consistent with recovery time and recovery point objectives for the reconstitution of the system	CP-10	The reconstitution time set in the contingency plan	Chief Information Security Officer