CP-4(2)

Requirement
Test the contingency plan at the alternate processing site:
1. To familiarize contingency personnel with the facility and available resources; and
2. To evaluate the capabilities of the alternate processing site to support contingency operations.

Discussion

Conditions at the alternate processing site may be significantly different than the conditions at the primary site. Having the opportunity to visit the alternate site and experience the actual capabilities available at the site can provide valuable information on potential vulnerabilities that could affect essential organizational mission and business functions. The on-site visit can also provide an opportunity to refine the contingency plan to address the vulnerabilities discovered during testing.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Contingency planning policy; procedures addressing contingency plan testing; contingency plan; contingency plan test documentation; contingency plan test results; alternate processing site agreements; service-level agreements; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for contingency plan testing; mechanisms supporting the contingency plan and/or contingency plan testing].

ID	Assessment Objectives
CP-04(02)(b)	the contingency plan is tested at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.
CP-04(02)(a)	the contingency plan is tested at the alternate processing site to familiarize contingency personnel with the facility and available resources;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!