FedRAMP Moderate
CP - Contingency Planning

FedRAMP Moderate CP-2: Contingency Plan

Develop contingency plan; review and update annually (FedRAMP); coordinate with related plans.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 71 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 22301:2019 · 15 controls

  • 4.3.2 Scope of the business continuity management system
  • 5.3 Roles, responsibilities and authorities
  • 6.2 Business continuity objectives and planning to achieve them
  • 6.2.1 Establishing business continuity objectives
  • 6.3 Planning changes to the business continuity management system
  • 7.4 Communication
  • 7.5.3 Control of documented information
  • 8.1 Operational planning and control
  • 8.2 Business impact analysis and risk assessment
  • 8.2.1 General
  • 8.2.2 Business impact analysis
  • 8.4 Business continuity plans and procedures
  • 8.4.1 General
  • 8.4.3 Warning and communication
  • 8.4.4 Business continuity plans

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 7 controls

APRA CPS 230 Operational Risk Management · 5 controls

  • CPS230-20 Prevention, Adaptation and Return to Normal Operations
  • CPS230-26 Critical Operations Register, Continuity Plan and Activation
  • CPS230-8 Board Oversight, Approval of the BCP, Tolerance Levels and Service Provider Policy
  • CPS230-P40 Required Content of the Business Continuity Plan
  • CPS230-P45 Annual Update of the Business Continuity Plan

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
  • NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • NIST-CSF-RC.CO-03 Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders
  • NIST-CSF-RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed
  • NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied

C5 (Germany) · 3 controls

  • C5-BCM-02 Business impact analysis policies and instructions
  • C5-BCM-03 Planning business continuity
  • C5-SSO-05 Exit strategy for the receipt of benefits

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 3 controls

  • CFTC-SS-22 Business Continuity and Disaster Recovery Planning Category
  • CFTC-SS-24 Periodic Update of the Recovery Plan and Emergency Procedures
  • CFTC-SS-8 Business Continuity and Disaster Recovery Plan and Resources

CIS Controls v8 · 3 controls

  • CIS-11.1 Establish and Maintain a Data Recovery Process
  • CIS-11.5 Test Data Recovery
  • CIS-17.4 Establish and Maintain an Incident Response Process

ISO 27002:2022 · 3 controls

  • 5.24 Information security incident management planning and preparation
  • 5.29 Information security during disruption
  • 5.30 ICT readiness for business continuity

SOC 2 · 3 controls

  • SOC2-A1.2 A1.2 Environmental protection, backup and recovery infrastructure
  • SOC2-A1.3 A1.3 Testing recovery plan procedures
  • SOC2-CC9.1 CC9.1 Mitigating risks of business disruption

Azure Security Benchmark · 2 controls

  • ASBv3-GS-8 Define and implement backup and recovery strategy
  • BR-1 Ensure regular automated backups

DORA · 2 controls

HIPAA Security Rule · 2 controls

ISO 27001:2022 · 2 controls

  • 5.29 Information security during disruption
  • 5.30 ICT readiness for business continuity

NIST SP 800-66 Rev 2 · 2 controls

PCI DSS 4.0 · 2 controls

  • 12.10.1 12.10.1 Incident response plan ready for activation
  • 12.3.1 12.3.1 Targeted risk analysis for flexible-frequency requirements

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-37 Define and Apply a Backup Policy for Critical Components

APRA CPS 220 Risk Management · 1 control

  • CPS220-P35 Required Content of Risk Management Policies and Procedures

APRA CPS 234 · 1 control

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-35 Business continuity and disaster recovery plans (Very Good)

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • AEO-12 Crisis Management and Incident Recovery

ISO 27701:2019 · 1 control

  • 6.14.1 Information security continuity

NIS2 Directive · 1 control

  • Art.21.2.c Business continuity, backup management, disaster recovery and crisis management

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-53 Rev 5 · 1 control

NIST SP 800-53 Rev 5 HIGH · 1 control

  • CP-2 CP-2 Contingency Plan

NIST SP 800-53 Rev 5 LOW · 1 control

  • CP-2 CP-2 Contingency Plan

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • CP-2 CP-2 Contingency Plan

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CP - Contingency Planning

You are reading one control. How much of FedRAMP Moderate have you already done?

FedRAMP Moderate CP-2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of FedRAMP Moderate your existing evidence covers. Hold ISO 27002:2022 and 182 of 323 FedRAMP Moderate controls already carry evidence.

If you hold ISO 27002:202256.3% covered · 141 gapsIf you hold PCI DSS 4.051.1% covered · 158 gapsIf you hold ISO 27001:202249.8% covered · 162 gapsIf you hold NIST SP 800-171 Rev 345.5% covered · 176 gapsIf you hold C5 (Germany)37.2% covered · 203 gapsIf you hold CMMC 2.035% covered · 210 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 348 were rejected on the ISO 27002:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 71 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll FedRAMP Moderate controls