Telecommunications Services
LOW ✓ MODERATE ✓ HIGHRequirements NIST SOURCE
Establish alternate telecommunications services, including necessary agreements to permit the resumption of [system operations] for essential mission and business functions within [time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
Discussion (NIST Supplemental Guidance)
Telecommunications services (for data and voice) for primary and alternate processing and storage sites are in scope for CP-8 . Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential mission and business functions despite the loss of primary telecommunications services. Organizations may specify different time periods for primary or alternate sites. Alternate telecommunications services include additional organizational or commercial ground-based circuits or lines, network-based approaches to telecommunications, or the use of satellites. Organizations consider factors such as availability, quality of service, and access when entering into alternate telecommunications agreements.
Enhancements NIST SOURCE
CP-8(1) Priority of Service Provisions LOW ✓ MODERATE ✓ HIGH
- (a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and
- (b) Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.
Discussion
Organizations consider the potential mission or business impact in situations where telecommunications service providers are servicing other organizations with similar priority of service provisions. Telecommunications Service Priority (TSP) is a Federal Communications Commission (FCC) program that directs telecommunications service providers (e.g., wireline and wireless phone companies) to give preferential treatment to users enrolled in the program when they need to add new lines or have their lines restored following a disruption of service, regardless of the cause. The FCC sets the rules and policies for the TSP program, and the Department of Homeland Security manages the TSP program. The TSP program is always in effect and not contingent on a major disaster or attack taking place. Federal sponsorship is required to enroll in the TSP program.
CP-8(2) Single Points of Failure LOW ✓ MODERATE ✓ HIGH
Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.
Discussion
In certain circumstances, telecommunications service providers or services may share the same physical lines, which increases the vulnerability of a single failure point. It is important to have provider transparency for the actual physical transmission capability for telecommunication services.
CP-8(3) Separation of Primary and Alternate Providers LOW MODERATE ✓ HIGH
Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.
Discussion
Threats that affect telecommunications services are defined in organizational assessments of risk and include natural disasters, structural failures, cyber or physical attacks, and errors of omission or commission. Organizations can reduce common susceptibilities by minimizing shared infrastructure among telecommunications service providers and achieving sufficient geographic separation between services. Organizations may consider using a single service provider in situations where the service provider can provide alternate telecommunications services that meet the separation needs addressed in the risk assessment.
CP-8(4) Provider Contingency Plan LOW MODERATE ✓ HIGH
- (a) Require primary and alternate telecommunications service providers to have contingency plans;
- (b) Review provider contingency plans to ensure that the plans meet organizational contingency requirements; and
- (c) Obtain evidence of contingency testing and training by providers [organization-defined frequency].
Discussion
Reviews of provider contingency plans consider the proprietary nature of such plans. In some situations, a summary of provider contingency plans may be sufficient evidence for organizations to satisfy the review requirement. Telecommunications service providers may also participate in ongoing disaster recovery exercises in coordination with the Department of Homeland Security and state and local governments. Organizations may use these types of activities to satisfy evidentiary requirements related to service provider contingency plan reviews, testing, and training.
CP-8(5) Alternate Telecommunication Service Testing LOW MODERATE HIGH
Test alternate telecommunication services [frequency].
Discussion
Alternate telecommunications services testing is arranged through contractual agreements with service providers. The testing may occur in parallel with normal operations to ensure that there is no degradation in organizational missions or functions.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for CP-8 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- system operations to be resumed for essential mission and business functions are defined;
- time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined;
- alternate telecommunications services, including necessary agreements to permit the resumption of <CP-08_ODP[01] system operations> , are established for essential mission and business functions within <CP-08_ODP[02] time period> when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
Examine
[SELECT FROM: Contingency planning policy; procedures addressing alternate telecommunications services; contingency plan; primary and alternate telecommunications service agreements; system security plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with contingency plan telecommunications responsibilities; organizational personnel with system recovery responsibilities; organizational personnel with knowledge of requirements for mission and business functions; organizational personnel with information security responsibilities; organizational personnel with responsibility for acquisitions/contractual agreements].
Test
[SELECT FROM: Mechanisms supporting telecommunications].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for CP-8. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Contingency planning policy
- contingency plan
- system security plan
Testing
- Mechanisms supporting telecommunications
Other Records
- procedures addressing alternate telecommunications services
- primary and alternate telecommunications service agreements
- other relevant documents or records