NIST SP 800-53 Rev 5
CP - Contingency Planning

NIST SP 800-53 Rev 5 NIST800-CP-6: CP-6 Alternate Storage Site

a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and b. Ensure that the alternate storage site provides controls equivalent to that of the primary site.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 35 controls across 20 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27002:2022 · 5 controls

  • 5.29 Information security during disruption
  • 5.30 ICT readiness for business continuity
  • 7.9 Security of assets off-premises
  • 8.13 Information backup
  • 8.14 Redundancy of information processing facilities

FedRAMP High · 3 controls

  • CP-6 Alternate Storage Site
  • CP-6(1) Alternate Storage Site | Separation from Primary Site (CP-6(1))
  • CP-6(3) Alternate Storage Site | Accessibility (CP-6(3))

FedRAMP Moderate · 3 controls

  • CP-6 Alternate Storage Site
  • CP-6(1) Alternate Storage Site | Separation from Primary Site (CP-6(1))
  • CP-6(3) Alternate Storage Site | Accessibility (CP-6(3))

ISO 22301:2019 · 3 controls

  • 7.1 Resources
  • 8.3 Business continuity strategies and solutions
  • 8.3.5 Implementation of solutions

C5 (Germany) · 2 controls

ISO 27001:2022 · 2 controls

  • 8.13 Information backup
  • 8.14 Redundancy of information processing facilities

ISO 27701:2019 · 2 controls

PCI DSS 4.0 · 2 controls

  • 9.4.1.2 9.4.1.2 Annual review of offline backup location security
  • 3.2.1 3.2.1 Data retention and disposal minimise stored account data

SOC 2 · 2 controls

  • SOC2-A1.2 A1.2 Environmental protection, backup and recovery infrastructure
  • SOC2-CC9.1 CC9.1 Mitigating risks of business disruption
  • E8-BACKUP-ML1 Regular Backups (ML1)
  • CFTC-SS-10 Geographic Dispersal of Backup Infrastructure and Personnel

CIS Controls v8 · 1 control

  • CIS-11.4 Establish and Maintain an Isolated Instance of Recovery Data

DORA · 1 control

  • DORA-Art.12 Backup policies and procedures, restoration and recovery

HIPAA Security Rule · 1 control

  • CP-6 CP-6 Alternate Storage Site
  • CP-6 CP-6 Alternate Storage Site

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CP - Contingency Planning

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-CP-6 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

Query this from an agent

The graph holds this control, the 35 it maps to, and the evidence behind each claim, over MCP and REST.