CP-2(3)

Requirement

Plan for the resumption of [Selection: all; essential] mission and business functions within [Assignment: organization-defined time period] of contingency plan activation.

Discussion

Organizations may choose to conduct contingency planning activities to resume mission and business functions as part of business continuity planning or as part of business impact analyses. Organizations prioritize the resumption of mission and business functions. The time period for resuming mission and business functions may be dependent on the severity and extent of the disruptions to the system and its supporting infrastructure.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Contingency planning policy; procedures addressing contingency operations for the system; contingency plan; business impact assessment; system security plan; privacy plan; other related plans; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with information security and privacy responsibilities; organizational personnel with knowledge of requirements for mission and business functions].

Test

[SELECT FROM: Organizational processes for resumption of missions and business functions].

ID	Assessment Objectives
CP-02(03)	the resumption of <CP-02(03)_ODP[01] SELECTED PARAMETER VALUE> mission and business functions are planned for within <CP-02(03)_ODP[02] time period> of contingency plan activation.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!