Frameworks / NIST SP 800-66 Rev 2 / 164.308(a)(7)(ii)(D) NIST SP 800-66 Rev 2
Administrative
NIST SP 800-66 Rev 2 164.308(a)(7)(ii)(D): Testing and Revision Procedures (Addressable) Implement procedures for periodic testing and revision of contingency plans. NIST recommends annual tabletop, biennial functional, and post-incident lessons-learned updates.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 44 controls across 25 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission NIST-CSF-ID.IM-01 Improvements are identified from evaluations NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared CFTC-SS-11 Testing and Review of Business Continuity and Disaster Recovery Capabilities CFTC-SS-22 Business Continuity and Disaster Recovery Planning Category CFTC-SS-24 Periodic Update of the Recovery Plan and Emergency Procedures 10.2 Continual improvement 8.5 Exercise programme 8.6 Evaluation of business continuity documentation and capabilities CPS230-33 Systematic BCP Testing Program CPS230-P45 Annual Update of the Business Continuity Plan ASD37-34 Regular backups (Essential) ASD37-35 Business continuity and disaster recovery plans (Very Good) C5-BCM-04 Verification, updating and testing of the business continuity C5-OPS-08 Data Backup and Recovery - Regular Testing CP-3 Contingency Training CP-4 Contingency Plan Testing CP-3 Contingency Training CP-4 Contingency Plan Testing 5.27 Learning from information security incidents 5.30 ICT readiness for business continuity 5.27 Learning from information security incidents 5.30 ICT readiness for business continuity 12.10.2 12.10.2 Annual review and testing of the incident response plan 12.3.1 12.3.1 Targeted risk analysis for flexible-frequency requirements E8-BACKUP-ML1 Regular Backups (ML1) ANSSI-HYG-37 Define and Apply a Backup Policy for Critical Components CPS234-32 Annual Review and Testing of Response Plans 6.14.1 Information security continuity SOC2-A1.3 A1.3 Testing recovery plan procedures Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Administrative Query this from an agent The graph holds this control, the 44 it maps to, and the evidence behind each claim, over MCP and REST.