Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

cp-6(2)

alternate storage site  | recovery time / point objectives

assessment objective:

Determine if the organization configures the alternate storage site to facilitate recovery operations in accordance with recovery time objectives and recovery point objectives (as specified in the information system contingency plan).

potential assessment methods and objects:

Examine: [select from: Contingency planning policy; procedures addressing alternate storage sites; contingency plan; alternate storage site; alternate storage site agreements; alternate storage site configurations; other relevant documents or records].

Interview: [select from: Organizational personnel with contingency plan testing responsibilities; organizational personnel with responsibilities for testing related plans; organizational personnel with information security responsibilities].

Test: [SELECT FROM: Organizational processes for contingency plan testing; automated mechanisms supporting recovery time/point objectives].