controlCP-3

Contingency Training (CP-3)

Provide contingency training to system users consistent with assigned roles and responsibilities: Review and update contingency training content [organization-defined] and following [organization-defined].

Security Baselines

LOWMODERATEHIGH

contingencydisaster-recoverybusiness-continuity

Why These Connect

Maps To2

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports15

These related controls work together — a change to one may affect the others.

Enhances2

These enhancements add specific capabilities or refinements to the base control.

Related Controls(10)

AT-2Literacy Training and Awareness (AT-2)

LMH

AT-3Role-based Training (AT-3)

LMH

AT-4Training Records (AT-4)

LMH

CP-2Contingency Plan (CP-2)

LMH

CP-4Contingency Plan Testing (CP-4)

LMH

CP-8Telecommunications Services (CP-8)

IR-2Incident Response Training (IR-2)

LMH

IR-4Incident Handling (IR-4)

LMH

IR-9Information Spillage Response (IR-9)IR-3Incident Response Testing (IR-3)

Cross-Framework Mappings(2)

ISO 27001ISO/IEC 27001:20221 mappingFinal

NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022

HIPAAHIPAA Security Rule1 mappingFinal

NIST OLIR informative reference — HIPAA Security Rule to SP 800-53 Rev 5

Organization-Defined Parameters(4)

Assignmentorganization-defined time period

Assignmentorganization-defined frequency

Assignmentorganization-defined events

Control Enhancements(2)

CP-3(1)Simulated Events (CP-3(1))

CP-3(2)Mechanisms Used in Training Environments (CP-3(2))