NIST SP 800-53 Rev 5 MODERATE
CP Contingency Planning

NIST SP 800-53 Rev 5 MODERATE CP-2: Contingency Plan

Develop contingency plan; review and update annually (FedRAMP); coordinate with related plans.

What else in your programme already covers this

This control maps to 68 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 22301:2019 · 15 controls

  • 4.3.2 Scope of the business continuity management system
  • 5.3 Roles, responsibilities and authorities
  • 6.2 Business continuity objectives and planning to achieve them
  • 6.2.1 Establishing business continuity objectives
  • 6.3 Planning changes to the business continuity management system
  • 7.4 Communication
  • 7.5.3 Control of documented information
  • 8.1 Operational planning and control
  • 8.2 Business impact analysis and risk assessment
  • 8.2.1 General
  • 8.2.2 Business impact analysis
  • 8.4 Business continuity plans and procedures
  • 8.4.1 General
  • 8.4.3 Warning and communication
  • 8.4.4 Business continuity plans

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 7 controls

APRA CPS 230 Operational Risk Management · 5 controls

  • CPS230-20 Prevention, Adaptation and Return to Normal Operations
  • CPS230-26 Critical Operations Register, Continuity Plan and Activation
  • CPS230-8 Board Oversight, Approval of the BCP, Tolerance Levels and Service Provider Policy
  • CPS230-P40 Required Content of the Business Continuity Plan
  • CPS230-P45 Annual Update of the Business Continuity Plan

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
  • NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • NIST-CSF-RC.CO-03 Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders
  • NIST-CSF-RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed
  • NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied

C5 (Germany) · 3 controls

  • C5-BCM-02 Business impact analysis policies and instructions
  • C5-BCM-03 Planning business continuity
  • C5-SSO-05 Exit strategy for the receipt of benefits

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 3 controls

  • CFTC-SS-22 Business Continuity and Disaster Recovery Planning Category
  • CFTC-SS-24 Periodic Update of the Recovery Plan and Emergency Procedures
  • CFTC-SS-8 Business Continuity and Disaster Recovery Plan and Resources

CIS Controls v8 · 3 controls

  • CIS-11.1 Establish and Maintain a Data Recovery Process
  • CIS-11.5 Test Data Recovery
  • CIS-17.4 Establish and Maintain an Incident Response Process

ISO 27002:2022 · 3 controls

  • 5.24 Information security incident management planning and preparation
  • 5.29 Information security during disruption
  • 5.30 ICT readiness for business continuity

SOC 2 · 3 controls

  • SOC2-A1.2 Environmental protections, data backups, and recovery infrastructure support availability
  • SOC2-A1.3 Recovery plan procedures support system recovery from failures
  • SOC2-CC9.1 Identifies, selects and develops risk mitigation activities

Azure Security Benchmark · 2 controls

  • ASBv3-GS-8 Define and implement backup and recovery strategy
  • BR-1 Ensure regular automated backups

DORA · 2 controls

HIPAA Security Rule · 2 controls

ISO 27001:2022 · 2 controls

  • 5.29 Information security during disruption
  • 5.30 ICT readiness for business continuity

NIST SP 800-66 Rev 2 · 2 controls

PCI DSS 4.0 · 2 controls

  • 12.10.1 Incident response plan
  • 12.3.1 Targeted risk analysis documented for requirements that specify one

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-37 Define and Apply a Backup Policy for Critical Components

APRA CPS 220 Risk Management · 1 control

  • CPS220-P35 Required Content of Risk Management Policies and Procedures

APRA CPS 234 · 1 control

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-35 Business continuity and disaster recovery plans (Very Good)

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • AEO-12 Crisis Management and Incident Recovery

ISO 27701:2019 · 1 control

  • 6.14.1 Information security continuity

NIS2 Directive · 1 control

  • Art.21.2.c Business continuity, backup management, disaster recovery and crisis management

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-53 Rev 5 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CP Contingency Planning

Query this from an agent

The graph holds this control, the 68 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 MODERATE controls