CP-7 CP · Contingency Planning

Alternate Processing Site

LOW ✓ MODERATE ✓ HIGH
5 Enhancements 1 Overlay 12 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

Alternate processing sites are geographically distinct from primary processing sites and provide processing capability if the primary processing site is not available. The alternate processing capability may be addressed using a physical processing site or other alternatives, such as failover to a cloud-based service provider or other internally or externally provided processing service. Geographically distributed architectures that support contingency requirements may also be considered alternate processing sites. Controls that are covered by alternate processing site agreements include the environmental conditions at alternate sites, access rules, physical and environmental protection requirements, and the coordination for the transfer and assignment of personnel. Requirements are allocated to alternate processing sites that reflect the requirements in contingency plans to maintain essential mission and business functions despite disruption, compromise, or failure in organizational systems.

Enhancements NIST SOURCE

CP-7(1) Separation from Primary Site LOW ✓ MODERATE ✓ HIGH

Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.

Discussion

Threats that affect alternate processing sites are defined in organizational assessments of risk and include natural disasters, structural failures, hostile attacks, and errors of omission or commission. Organizations determine what is considered a sufficient degree of separation between primary and alternate processing sites based on the types of threats that are of concern. For threats such as hostile attacks, the degree of separation between sites is less relevant.

Open full page for CP-7(1) →
CP-7(2) Accessibility LOW ✓ MODERATE ✓ HIGH

Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.

Discussion

Area-wide disruptions refer to those types of disruptions that are broad in geographic scope with such determinations made by organizations based on organizational assessments of risk.

Open full page for CP-7(2) →
CP-7(3) Priority of Service LOW ✓ MODERATE ✓ HIGH

Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).

Discussion

Priority of service agreements refer to negotiated agreements with service providers that ensure that organizations receive priority treatment consistent with their availability requirements and the availability of information resources for logical alternate processing and/or at the physical alternate processing site. Organizations establish recovery time objectives as part of contingency planning.

Open full page for CP-7(3) →
CP-7(4) Preparation for Use LOW MODERATE ✓ HIGH

Prepare the alternate processing site so that the site can serve as the operational site supporting essential mission and business functions.

Discussion

Site preparation includes establishing configuration settings for systems at the alternate processing site consistent with the requirements for such settings at the primary site and ensuring that essential supplies and logistical considerations are in place.

Open full page for CP-7(4) →
CP-7(5) Equivalent Information Security Safeguards WITHDRAWN

Withdrawn. Incorporated into CP-7.

CP-7(6) Inability to Return to Primary Site LOW MODERATE HIGH

Plan and prepare for circumstances that preclude returning to the primary processing site.

Discussion

There may be situations that preclude an organization from returning to the primary processing site such as if a natural disaster (e.g., flood or a hurricane) damaged or destroyed a facility and it was determined that rebuilding in the same location was not prudent.

Open full page for CP-7(6) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for CP-7 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. system operations for essential mission and business functions are defined;
  2. time period consistent with recovery time and recovery point objectives is defined;
  3. an alternate processing site, including necessary agreements to permit the transfer and resumption of <CP-07_ODP[01] system operations> for essential mission and business functions, is established within <CP-07_ODP[02] time period> when the primary processing capabilities are unavailable;
  4. the equipment and supplies required to transfer operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within <CP-07_ODP[02] time period> for transfer;
  5. the equipment and supplies required to resume operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within <CP-07_ODP[02] time period> for resumption;
  6. controls provided at the alternate processing site are equivalent to those at the primary site.

Examine

[SELECT FROM: Contingency planning policy; procedures addressing alternate processing sites; contingency plan; alternate processing site agreements; primary processing site agreements; spare equipment and supplies inventory at alternate processing site; equipment and supply contracts; service-level agreements; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for contingency planning and/or alternate site arrangements; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for recovery at the alternate site; mechanisms supporting and/or implementing recovery at the alternate processing site].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Not applicable at this tier.

MODERATE

  • Base control: Included (matches standard baseline)
  • Included: (1) (2) (3)

HIGH

  • Base control: Included (matches standard baseline)
  • Included: (1) (2) (3) (4)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for CP-7. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • Contingency planning policy
  • contingency plan
  • system security plan

Configuration

  • spare equipment and supplies inventory at alternate processing site

Testing

  • Organizational processes for recovery at the alternate site
  • mechanisms supporting and/or implementing recovery at the alternate processing site

Other Records

  • procedures addressing alternate processing sites
  • alternate processing site agreements
  • primary processing site agreements
  • equipment and supply contracts
  • service-level agreements
  • other relevant documents or records