N
|
controlCP-2

Contingency Plan (CP-2)

Develop a contingency plan for the system that: Distribute copies of the contingency plan to [organization-defined]; Coordinate contingency planning activities with incident handling activities; Review the contingency plan for the system [organization-defined]; Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; Communicate contingency plan changes to [organ

Security Baselines

LOWMODERATEHIGH
contingencydisaster-recoverybusiness-continuity

Why These Connect

Maps To16

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports51

These related controls work together — a change to one may affect the others.

Mitigates4

This control helps defend against or reduce the risk of the linked threat technique.

Enhances8

These enhancements add specific capabilities or refinements to the base control.

Related Controls(38)

CM-8System Component Inventory (CM-8)
LMH
CP-3Contingency Training (CP-3)
LMH
CP-4Contingency Plan Testing (CP-4)
LMH
CP-6Alternate Storage Site (CP-6)
MH
CP-7Alternate Processing Site (CP-7)
MH
CP-8Telecommunications Services (CP-8)
MH
CP-9System Backup (CP-9)
LMH
CP-10System Recovery and Reconstitution (CP-10)
LMH
CP-11Alternate Communications Protocols (CP-11)CP-13Alternative Security Mechanisms (CP-13)IR-4Incident Handling (IR-4)
LMH
IR-6Incident Reporting (IR-6)
LMH
IR-8Incident Response Plan (IR-8)
LMH
IR-9Information Spillage Response (IR-9)MA-6Timely Maintenance (MA-6)
MH
MP-2Media Access (MP-2)
LMH
MP-4Media Storage (MP-4)
MH
MP-5Media Transport (MP-5)
MH
PL-2System Security and Privacy Plans (PL-2)
LMH
PM-8Critical Infrastructure Plan (PM-8)PM-11Mission and Business Process Definition (PM-11)SA-15Development Process, Standards, and Tools (SA-15)
MH
SA-20Customized Development of Critical Components (SA-20)SC-7Boundary Protection (SC-7)
LMH
SC-23Session Authenticity (SC-23)
MH
SI-12Information Management and Retention (SI-12)
LMH
PE-11Emergency Power (PE-11)
MH
PE-12Emergency Lighting (PE-12)
LMH
PE-14Environmental Controls (PE-14)
LMH
PE-18Location of System Components (PE-18)
H
PE-23Facility Location (PE-23)RA-9Criticality Analysis (RA-9)
MH
SA-9External System Services (SA-9)
LMH
SA-24Design For Cyber Resiliency (SA-24)SC-5Denial-of-service Protection (SC-5)
LMH
SC-24Fail in Known State (SC-24)
H
SC-47Alternate Communications Paths (SC-47)SI-13Predictable Failure Prevention (SI-13)

Threat Coverage(4 ATT&CK techniques)

T1486Data Encrypted for ImpactT1485Data DestructionT1499Endpoint Denial of ServiceT1498Network Denial of Service

Cross-Framework Mappings(16)

ID.IM-01ID.IM-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-02ID.IM-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-03ID.IM-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-04ID.IM-04Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
PR.IR-02PR.IR-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
RC.RP-03RC.RP-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
RC.CO-04RC.CO-04Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ISO 27001ISO/IEC 27001:20226 mappingsFinal
NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022
HIPAAHIPAA Security Rule7 mappingsFinal
NIST OLIR informative reference — HIPAA Security Rule to SP 800-53 Rev 5
ID.IM-01ID.IM-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-02ID.IM-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-03ID.IM-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-04ID.IM-04Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
PR.IR-02PR.IR-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
RC.RP-03RC.RP-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
RC.CO-04RC.CO-04Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(7)

Assignmentorganization-defined personnel or roles
Assignmentorganization-defined personnel or roles
Assignmentorganization-defined key contingency personnel
Assignmentorganization-defined organizational elements
Assignmentorganization-defined frequency
Assignmentorganization-defined key contingency personnel
Assignmentorganization-defined organizational elements

Control Enhancements(8)

CP-2(1)Coordinate with Related Plans (CP-2(1))
MH
CP-2(2)Capacity Planning (CP-2(2))
H
CP-2(3)Resume Mission and Business Functions (CP-2(3))
MH
CP-2(4)Resume All Mission and Business Functions (CP-2(4))W
CP-2(5)Continue Mission and Business Functions (CP-2(5))
H
CP-2(6)Alternate Processing and Storage Sites (CP-2(6))
CP-2(7)Coordinate with External Service Providers (CP-2(7))
CP-2(8)Identify Critical Assets (CP-2(8))
MH

See Also

@SP 800-53 Overview⚖Compare Baselines