|

controlCP-2

Contingency Plan (CP-2)

Develop a contingency plan for the system that: Distribute copies of the contingency plan to [organization-defined]; Coordinate contingency planning activities with incident handling activities; Review the contingency plan for the system [organization-defined]; Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; Communicate contingency plan changes to [organ

Security Baselines

LOWMODERATEHIGH

contingencydisaster-recoverybusiness-continuity

Why These Connect

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports51

These related controls work together — a change to one may affect the others.

Mitigates4

This control helps defend against or reduce the risk of the linked threat technique.

Enhances8

These enhancements add specific capabilities or refinements to the base control.

Related Controls(38)

CM-8System Component Inventory (CM-8)

CP-3Contingency Training (CP-3)

CP-4Contingency Plan Testing (CP-4)

CP-6Alternate Storage Site (CP-6)

CP-7Alternate Processing Site (CP-7)

CP-8Telecommunications Services (CP-8)

CP-9System Backup (CP-9)

CP-10System Recovery and Reconstitution (CP-10)

CP-11Alternate Communications Protocols (CP-11)CP-13Alternative Security Mechanisms (CP-13)IR-4Incident Handling (IR-4)

IR-6Incident Reporting (IR-6)

IR-8Incident Response Plan (IR-8)

IR-9Information Spillage Response (IR-9)MA-6Timely Maintenance (MA-6)

MP-2Media Access (MP-2)

MP-4Media Storage (MP-4)

MP-5Media Transport (MP-5)

PL-2System Security and Privacy Plans (PL-2)

PM-8Critical Infrastructure Plan (PM-8)PM-11Mission and Business Process Definition (PM-11)SA-15Development Process, Standards, and Tools (SA-15)

SA-20Customized Development of Critical Components (SA-20)SC-7Boundary Protection (SC-7)

SC-23Session Authenticity (SC-23)

SI-12Information Management and Retention (SI-12)

PE-11Emergency Power (PE-11)

PE-12Emergency Lighting (PE-12)

PE-14Environmental Controls (PE-14)

PE-18Location of System Components (PE-18)

PE-23Facility Location (PE-23)RA-9Criticality Analysis (RA-9)

SA-9External System Services (SA-9)

SA-24Design For Cyber Resiliency (SA-24)SC-5Denial-of-service Protection (SC-5)

SC-24Fail in Known State (SC-24)

SC-47Alternate Communications Paths (SC-47)SI-13Predictable Failure Prevention (SI-13)

Threat Coverage(4 ATT&CK techniques)

T1486Data Encrypted for Impact T1485Data Destruction T1499Endpoint Denial of Service T1498Network Denial of Service

Control Enhancements(8)

CP-2(1)Coordinate with Related Plans (CP-2(1))

CP-2(2)Capacity Planning (CP-2(2))

CP-2(3)Resume Mission and Business Functions (CP-2(3))

CP-2(4)Resume All Mission and Business Functions (CP-2(4))W

CP-2(5)Continue Mission and Business Functions (CP-2(5))

CP-2(6)Alternate Processing and Storage Sites (CP-2(6))

CP-2(7)Coordinate with External Service Providers (CP-2(7))

CP-2(8)Identify Critical Assets (CP-2(8))

See Also

@SP 800-53 Overview ⚖Compare Baselines