Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

cp-2

contingency plan

assessment objective:

Determine if the organization:

cp-2(a)

develops and documents a contingency plan for the information system that:

cp-2(a)(1)

identifies essential missions and business functions and associated contingency requirements;

cp-2(a)(2)

cp-2(a)(2)[1]

provides recovery objectives;

cp-2(a)(2)[2]

provides restoration priorities;

cp-2(a)(2)[3]

provides metrics;

cp-2(a)(3)

cp-2(a)(3)[1]

addresses contingency roles;

cp-2(a)(3)[2]

addresses contingency responsibilities;

cp-2(a)(3)[3]

addresses assigned individuals with contact information;

cp-2(a)(4)

addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;

cp-2(a)(5)

addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented;

cp-2(a)(6)

cp-2(a)(6)[1]

defines personnel or roles to review and approve the contingency plan for the information system;

cp-2(a)(6)[2]

is reviewed and approved by organization-defined personnel or roles;

cp-2(b)

cp-2(b)[1]

defines key contingency personnel (identified by name and/or by role) and organizational elements to whom copies of the contingency plan are to be distributed;

cp-2(b)[2]

distributes copies of the contingency plan to organization-defined key contingency personnel and organizational elements;

cp-2(c)

coordinates contingency planning activities with incident handling activities;

cp-2(d)

cp-2(d)[1]

defines a frequency to review the contingency plan for the information system;

cp-2(d)[2]

reviews the contingency plan with the organization-defined frequency;

cp-2(e)

updates the contingency plan to address:

cp-2(e)[1]

changes to the organization, information system, or environment of operation;

cp-2(e)[2]

problems encountered during plan implementation, execution, and testing;

cp-2(f)

cp-2(f)[1]

defines key contingency personnel (identified by name and/or by role) and organizational elements to whom contingency plan changes are to be communicated;

cp-2(f)[2]

communicates contingency plan changes to organization-defined key contingency personnel and organizational elements; and

cp-2(g)

protects the contingency plan from unauthorized disclosure and modification.

potential assessment methods and objects:

Examine: [select from: Contingency planning policy; procedures addressing contingency operations for the information system; contingency plan; security plan; evidence of contingency plan reviews and updates; other relevant documents or records].

Interview: [select from: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with incident handling responsibilities; organizational personnel with information security responsibilities].

Test: [SELECT FROM: Organizational processes for contingency plan development, review, update, and protection; automated mechanisms for developing, reviewing, updating and/or protecting the contingency plan].