compliance controls are associated with this Policy definition 'Coordinate contingency plans with related plans' (c5784049-959f-6067-420c-f4cefae93076)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| FedRAMP_High_R4 |
CP-2 |
FedRAMP_High_R4_CP-2 |
FedRAMP High CP-2 |
Contingency Planning |
Contingency Plan |
Shared |
n/a |
The organization:
a. Develops a contingency plan for the information system that:
1. Identifies essential missions and business functions and associated contingency requirements;
2. Provides recovery objectives, restoration priorities, and metrics;
3. Addresses contingency roles, responsibilities, assigned individuals with contact information;
4. Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;
5. Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and
6. Is reviewed and approved by [Assignment: organization-defined personnel or roles];
b. Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
c. Coordinates contingency planning activities with incident handling activities;
d. Reviews the contingency plan for the information system [Assignment: organization-defined frequency];
e. Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
f. Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and
g. Protects the contingency plan from unauthorized disclosure and modification.
Supplemental Guidance: Contingency planning for information systems is part of an overall organizational program for achieving continuity of operations for mission/business functions. Contingency planning addresses both information system restoration and implementation of alternative mission/business processes when systems are compromised. The effectiveness of contingency planning is maximized by considering such planning throughout the phases of the system development life cycle. Performing contingency planning on hardware, software, and firmware development can be an effective means of achieving information system resiliency. Contingency plans reflect the degree of restoration required for organizational information systems since not all systems may need to fully recover to achieve the level of continuity of operations desired. Information system recovery objectives reflect applicable laws, Executive Orders, directives, policies, standards, regulations, and guidelines. In addition to information system availability, contingency plans also address other security-related events resulting in a reduction in mission and/or business effectiveness, such as malicious attacks compromising the confidentiality or integrity of information systems. Actions addressed in contingency plans include, for example, orderly/graceful degradation, information system shutdown, fallback to a manual mode, alternate information flows, and operating in modes reserved for when systems are under attack. By closely coordinating contingency planning with incident handling activities, organizations can ensure that the necessary contingency planning activities are in place and activated in the event of a security incident. Related controls: AC-14, CP-6, CP-7, CP-8, CP-9, CP-10, IR-4, IR-8, MP-2, MP-4, MP-5, PM-8, PM-11.
References: Federal Continuity Directive 1; NIST Special Publication 800-34. |
link |
8 |
| FedRAMP_High_R4 |
CP-2(1) |
FedRAMP_High_R4_CP-2(1) |
FedRAMP High CP-2 (1) |
Contingency Planning |
Coordinate With Related Plans |
Shared |
n/a |
The organization coordinates contingency plan development with organizational elements responsible for related plans.
Supplemental Guidance: Plans related to contingency plans for organizational information systems include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber Incident Response Plans, Insider Threat Implementation Plan, and Occupant Emergency Plans. |
link |
1 |
| FedRAMP_High_R4 |
CP-4(1) |
FedRAMP_High_R4_CP-4(1) |
FedRAMP High CP-4 (1) |
Contingency Planning |
Coordinate With Related Plans |
Shared |
n/a |
The organization coordinates contingency plan testing with organizational elements responsible for related plans.
Supplemental Guidance: Plans related to contingency plans for organizational information systems include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber Incident Response Plans, and Occupant Emergency Plans. This control enhancement does not require organizations to create organizational elements to handle related plans or to align such elements with specific plans. It does require, however, that if such organizational elements are responsible for related plans, organizations should coordinate with those elements. Related controls: IR-8, PM-8. |
link |
1 |
| FedRAMP_High_R4 |
IR-4 |
FedRAMP_High_R4_IR-4 |
FedRAMP High IR-4 |
Incident Response |
Incident Handling |
Shared |
n/a |
The organization:
a. Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;
b. Coordinates incident handling activities with contingency planning activities; and
c. Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.
Supplemental Guidance: Organizations recognize that incident response capability is dependent on the capabilities of organizational information systems and the mission/business processes being supported by those systems. Therefore, organizations consider incident response as part of the definition, design, and development of mission/business processes and information systems. Incident-related information can be obtained from a variety of sources including, for example, audit monitoring, network monitoring, physical access monitoring, user/administrator reports, and reported supply chain events. Effective incident handling capability includes coordination among many organizational entities including, for example, mission/business owners, information system owners, authorizing officials, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the risk executive (function). Related controls: AU-6, CM-6, CP-2, CP-4, IR-2, IR-3, IR-8, PE-6, SC-5, SC-7, SI-3, SI-4, SI-7.
References: Executive Order 13587; NIST Special Publication 800-61. |
link |
24 |
| FedRAMP_Moderate_R4 |
CP-2 |
FedRAMP_Moderate_R4_CP-2 |
FedRAMP Moderate CP-2 |
Contingency Planning |
Contingency Plan |
Shared |
n/a |
The organization:
a. Develops a contingency plan for the information system that:
1. Identifies essential missions and business functions and associated contingency requirements;
2. Provides recovery objectives, restoration priorities, and metrics;
3. Addresses contingency roles, responsibilities, assigned individuals with contact information;
4. Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;
5. Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and
6. Is reviewed and approved by [Assignment: organization-defined personnel or roles];
b. Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
c. Coordinates contingency planning activities with incident handling activities;
d. Reviews the contingency plan for the information system [Assignment: organization-defined frequency];
e. Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
f. Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and
g. Protects the contingency plan from unauthorized disclosure and modification.
Supplemental Guidance: Contingency planning for information systems is part of an overall organizational program for achieving continuity of operations for mission/business functions. Contingency planning addresses both information system restoration and implementation of alternative mission/business processes when systems are compromised. The effectiveness of contingency planning is maximized by considering such planning throughout the phases of the system development life cycle. Performing contingency planning on hardware, software, and firmware development can be an effective means of achieving information system resiliency. Contingency plans reflect the degree of restoration required for organizational information systems since not all systems may need to fully recover to achieve the level of continuity of operations desired. Information system recovery objectives reflect applicable laws, Executive Orders, directives, policies, standards, regulations, and guidelines. In addition to information system availability, contingency plans also address other security-related events resulting in a reduction in mission and/or business effectiveness, such as malicious attacks compromising the confidentiality or integrity of information systems. Actions addressed in contingency plans include, for example, orderly/graceful degradation, information system shutdown, fallback to a manual mode, alternate information flows, and operating in modes reserved for when systems are under attack. By closely coordinating contingency planning with incident handling activities, organizations can ensure that the necessary contingency planning activities are in place and activated in the event of a security incident. Related controls: AC-14, CP-6, CP-7, CP-8, CP-9, CP-10, IR-4, IR-8, MP-2, MP-4, MP-5, PM-8, PM-11.
References: Federal Continuity Directive 1; NIST Special Publication 800-34. |
link |
8 |
| FedRAMP_Moderate_R4 |
CP-2(1) |
FedRAMP_Moderate_R4_CP-2(1) |
FedRAMP Moderate CP-2 (1) |
Contingency Planning |
Coordinate With Related Plans |
Shared |
n/a |
The organization coordinates contingency plan development with organizational elements responsible for related plans.
Supplemental Guidance: Plans related to contingency plans for organizational information systems include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber Incident Response Plans, Insider Threat Implementation Plan, and Occupant Emergency Plans. |
link |
1 |
| FedRAMP_Moderate_R4 |
CP-4(1) |
FedRAMP_Moderate_R4_CP-4(1) |
FedRAMP Moderate CP-4 (1) |
Contingency Planning |
Coordinate With Related Plans |
Shared |
n/a |
The organization coordinates contingency plan testing with organizational elements responsible for related plans.
Supplemental Guidance: Plans related to contingency plans for organizational information systems include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber Incident Response Plans, and Occupant Emergency Plans. This control enhancement does not require organizations to create organizational elements to handle related plans or to align such elements with specific plans. It does require, however, that if such organizational elements are responsible for related plans, organizations should coordinate with those elements. Related controls: IR-8, PM-8. |
link |
1 |
| FedRAMP_Moderate_R4 |
IR-4 |
FedRAMP_Moderate_R4_IR-4 |
FedRAMP Moderate IR-4 |
Incident Response |
Incident Handling |
Shared |
n/a |
The organization:
a. Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;
b. Coordinates incident handling activities with contingency planning activities; and
c. Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.
Supplemental Guidance: Organizations recognize that incident response capability is dependent on the capabilities of organizational information systems and the mission/business processes being supported by those systems. Therefore, organizations consider incident response as part of the definition, design, and development of mission/business processes and information systems. Incident-related information can be obtained from a variety of sources including, for example, audit monitoring, network monitoring, physical access monitoring, user/administrator reports, and reported supply chain events. Effective incident handling capability includes coordination among many organizational entities including, for example, mission/business owners, information system owners, authorizing officials, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the risk executive (function). Related controls: AU-6, CM-6, CP-2, CP-4, IR-2, IR-3, IR-8, PE-6, SC-5, SC-7, SI-3, SI-4, SI-7.
References: Executive Order 13587; NIST Special Publication 800-61. |
link |
24 |
| hipaa |
1506.11a1Organizational.2-11.a |
hipaa-1506.11a1Organizational.2-11.a |
1506.11a1Organizational.2-11.a |
15 Incident Management |
1506.11a1Organizational.2-11.a 11.01 Reporting Information Security Incidents and Weaknesses |
Shared |
n/a |
There is a point of contact for reporting information security events who is made known throughout the organization, always available, and able to provide adequate and timely response. The organization also maintains a list of third-party contact information (e.g., the email addresses of their information security officers), which can be used to report a security incident. |
|
10 |
| hipaa |
1509.11a2Organizational.236-11.a |
hipaa-1509.11a2Organizational.236-11.a |
1509.11a2Organizational.236-11.a |
15 Incident Management |
1509.11a2Organizational.236-11.a 11.01 Reporting Information Security Incidents and Weaknesses |
Shared |
n/a |
The incident management program formally defines information security incidents and the phases of incident response; roles and responsibilities; incident handling, reporting and communication processes; third-party relationships and the handling of third-party breaches; and the supporting forensics program. The organization formally assigns job titles and duties for handling computer and network security incidents to specific individuals and identifies management personnel who will support the incident handling process by acting in key decision-making roles. |
|
17 |
| hipaa |
1511.11a2Organizational.5-11.a |
hipaa-1511.11a2Organizational.5-11.a |
1511.11a2Organizational.5-11.a |
15 Incident Management |
1511.11a2Organizational.5-11.a 11.01 Reporting Information Security Incidents and Weaknesses |
Shared |
n/a |
All employees, contractors and third-party users receive mandatory incident response training to ensure they are aware of their responsibilities to report information security events as quickly as possible, the procedure for reporting information security events, and the point(s) of contact, including the incident response team, and the contact information is published and made readily available. |
|
13 |
| hipaa |
1515.11a3Organizational.3-11.a |
hipaa-1515.11a3Organizational.3-11.a |
1515.11a3Organizational.3-11.a |
15 Incident Management |
1515.11a3Organizational.3-11.a 11.01 Reporting Information Security Incidents and Weaknesses |
Shared |
n/a |
Incidents (or a sample of incidents) are reviewed to identify necessary improvement to the security controls. |
|
11 |
| hipaa |
1521.11c2Organizational.56-11.c |
hipaa-1521.11c2Organizational.56-11.c |
1521.11c2Organizational.56-11.c |
15 Incident Management |
1521.11c2Organizational.56-11.c 11.02 Management of Information Security Incidents and Improvements |
Shared |
n/a |
Testing exercises are planned, coordinated, executed, and documented periodically, at least annually, using reviews, analyses, and simulations to determine incident response effectiveness. Testing includes personnel associated with the incident handling team to ensure that they understand current threats and risks, as well as their responsibilities in supporting the incident handling team. |
|
16 |
| hipaa |
1562.11d2Organizational.2-11.d |
hipaa-1562.11d2Organizational.2-11.d |
1562.11d2Organizational.2-11.d |
15 Incident Management |
1562.11d2Organizational.2-11.d 11.02 Management of Information Security Incidents and Improvements |
Shared |
n/a |
The organization coordinates incident handling activities with contingency planning activities. |
|
12 |
| hipaa |
1603.12c1Organizational.9-12.c |
hipaa-1603.12c1Organizational.9-12.c |
1603.12c1Organizational.9-12.c |
16 Business Continuity & Disaster Recovery |
1603.12c1Organizational.9-12.c 12.01 Information Security Aspects of Business Continuity Management |
Shared |
n/a |
Copies of the business continuity plans are distributed to key contingency personnel. |
|
5 |
| hipaa |
1634.12b1Organizational.1-12.b |
hipaa-1634.12b1Organizational.1-12.b |
1634.12b1Organizational.1-12.b |
16 Business Continuity & Disaster Recovery |
1634.12b1Organizational.1-12.b 12.01 Information Security Aspects of Business Continuity Management |
Shared |
n/a |
The organization identifies the critical business processes requiring business continuity. |
|
5 |
| hipaa |
1636.12b2Organizational.1-12.b |
hipaa-1636.12b2Organizational.1-12.b |
1636.12b2Organizational.1-12.b |
16 Business Continuity & Disaster Recovery |
1636.12b2Organizational.1-12.b 12.01 Information Security Aspects of Business Continuity Management |
Shared |
n/a |
The organization identifies its critical business processes and integrates the information security management requirements of business continuity with other continuity requirements relating to such aspects as operations, staffing, materials, transport and facilities. |
|
3 |
| hipaa |
1666.12d1Organizational.1235-12.d |
hipaa-1666.12d1Organizational.1235-12.d |
1666.12d1Organizational.1235-12.d |
16 Business Continuity & Disaster Recovery |
1666.12d1Organizational.1235-12.d 12.01 Information Security Aspects of Business Continuity Management |
Shared |
n/a |
The organization creates, at a minimum, one business continuity plan and ensures each plan: (i) has an owner; (ii) describes the approach for continuity, ensuring at a minimum the approach to maintain information or information asset availability and security; and, (iii) specifies the escalation plan and the conditions for its activation, as well as the individuals responsible for executing each component of the plan. |
|
4 |
| hipaa |
1667.12d1Organizational.4-12.d |
hipaa-1667.12d1Organizational.4-12.d |
1667.12d1Organizational.4-12.d |
16 Business Continuity & Disaster Recovery |
1667.12d1Organizational.4-12.d 12.01 Information Security Aspects of Business Continuity Management |
Shared |
n/a |
When new requirements are identified, any existing emergency procedures (e.g., evacuation plans or fallback arrangements) are amended as appropriate. |
|
4 |
| hipaa |
1672.12d2Organizational.3-12.d |
hipaa-1672.12d2Organizational.3-12.d |
1672.12d2Organizational.3-12.d |
16 Business Continuity & Disaster Recovery |
1672.12d2Organizational.3-12.d 12.01 Information Security Aspects of Business Continuity Management |
Shared |
n/a |
The business continuity planning framework addresses the specific, minimal set of information security requirements as well as (i) temporary operational procedures to follow pending completion of recovery and restoration, and (ii) the responsibilities of the individuals, describing who is responsible for executing which component of the plan (alternatives are nominated as required). |
|
5 |
| ISO27001-2013 |
A.11.1.5 |
ISO27001-2013_A.11.1.5 |
ISO 27001:2013 A.11.1.5 |
Physical And Environmental Security |
Working in secure areas |
Shared |
n/a |
Procedures for working in secure areas shall be designed and applied. |
link |
3 |
| ISO27001-2013 |
A.16.1.4 |
ISO27001-2013_A.16.1.4 |
ISO 27001:2013 A.16.1.4 |
Information Security Incident Management |
Assessment of and decision on information security events |
Shared |
n/a |
Information security events shall be assessed and it shall be decided if they are to be classified as information security incidents. |
link |
23 |
| ISO27001-2013 |
A.16.1.5 |
ISO27001-2013_A.16.1.5 |
ISO 27001:2013 A.16.1.5 |
Information Security Incident Management |
Response to information security incidents |
Shared |
n/a |
Information security incidents shall be responded to in accordance with the documented procedures. |
link |
12 |
| ISO27001-2013 |
A.16.1.6 |
ISO27001-2013_A.16.1.6 |
ISO 27001:2013 A.16.1.6 |
Information Security Incident Management |
Learning from information security incidents |
Shared |
n/a |
Knowledge gained from analyzing and resolving information security incidents shall be used to reduce the likelihood or impact of future incidents. |
link |
13 |
| ISO27001-2013 |
A.17.1.1 |
ISO27001-2013_A.17.1.1 |
ISO 27001:2013 A.17.1.1 |
Information Security Aspects Of Business Continuity Management |
Planning information security continuity |
Shared |
n/a |
The organization shall determine its requirements for information security and the continuity of information security management in adverse situations, e.g. during a crisis or disaster. |
link |
11 |
| ISO27001-2013 |
A.17.1.2 |
ISO27001-2013_A.17.1.2 |
ISO 27001:2013 A.17.1.2 |
Information Security Aspects Of Business Continuity Management |
Implementing information security continuity |
Shared |
n/a |
The organization shall establish, document, implement and maintain processes, procedures and controls to ensure the required level of continuity for information security during an adverse situation. |
link |
18 |
| ISO27001-2013 |
A.17.2.1 |
ISO27001-2013_A.17.2.1 |
ISO 27001:2013 A.17.2.1 |
Information Security Aspects Of Business Continuity Management |
Availability of information processing facilities |
Shared |
n/a |
Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements. |
link |
17 |
| ISO27001-2013 |
A.6.1.1 |
ISO27001-2013_A.6.1.1 |
ISO 27001:2013 A.6.1.1 |
Organization of Information Security |
Information security roles and responsibilities |
Shared |
n/a |
All information security responsibilities shall be clearly defined and allocated. |
link |
73 |
|
mp.eq.3 Protection of portable devices |
mp.eq.3 Protection of portable devices |
404 not found |
|
|
|
n/a |
n/a |
|
71 |
|
mp.eq.4 Other devices connected to the network |
mp.eq.4 Other devices connected to the network |
404 not found |
|
|
|
n/a |
n/a |
|
35 |
|
mp.if.1 Separate areas with access control |
mp.if.1 Separate areas with access control |
404 not found |
|
|
|
n/a |
n/a |
|
23 |
|
mp.if.2 Identification of persons |
mp.if.2 Identification of persons |
404 not found |
|
|
|
n/a |
n/a |
|
13 |
|
mp.if.3 Fitting-out of premises |
mp.if.3 Fitting-out of premises |
404 not found |
|
|
|
n/a |
n/a |
|
18 |
|
mp.if.5 Fire protection |
mp.if.5 Fire protection |
404 not found |
|
|
|
n/a |
n/a |
|
16 |
|
mp.if.6 Flood protection |
mp.if.6 Flood protection |
404 not found |
|
|
|
n/a |
n/a |
|
16 |
|
mp.if.7 Recording of entries and exits of equipment |
mp.if.7 Recording of entries and exits of equipment |
404 not found |
|
|
|
n/a |
n/a |
|
12 |
|
mp.info.6 Backups |
mp.info.6 Backups |
404 not found |
|
|
|
n/a |
n/a |
|
65 |
| NIST_SP_800-171_R2_3 |
.6.1 |
NIST_SP_800-171_R2_3.6.1 |
NIST SP 800-171 R2 3.6.1 |
Incident response |
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Organizations recognize that incident handling capability is dependent on the capabilities of organizational systems and the mission/business processes being supported by those systems. Organizations consider incident handling as part of the definition, design, and development of mission/business processes and systems. Incident-related information can be obtained from a variety of sources including audit monitoring, network monitoring, physical access monitoring, user and administrator reports, and reported supply chain events. Effective incident handling capability includes coordination among many organizational entities including mission/business owners, system owners, authorizing officials, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the risk executive. As part of user response activities, incident response training is provided by organizations and is linked directly to the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail is included in such training. For example, regular users may only need to know who to call or how to recognize an incident on the system; system administrators may require additional training on how to handle or remediate incidents; and incident responders may receive more specific training on forensics, reporting, system recovery, and restoration. Incident response training includes user training in the identification/reporting of suspicious activities from external and internal sources. User response activities also includes incident response assistance which may consist of help desk support, assistance groups, and access to forensics services or consumer redress services, when required. [SP 800-61] provides guidance on incident handling. [SP 800-86] and [SP 800-101] provide guidance on integrating forensic techniques into incident response. [SP 800-161] provides guidance on supply chain risk management. |
link |
12 |
| NIST_SP_800-53_R4 |
CP-2 |
NIST_SP_800-53_R4_CP-2 |
NIST SP 800-53 Rev. 4 CP-2 |
Contingency Planning |
Contingency Plan |
Shared |
n/a |
The organization:
a. Develops a contingency plan for the information system that:
1. Identifies essential missions and business functions and associated contingency requirements;
2. Provides recovery objectives, restoration priorities, and metrics;
3. Addresses contingency roles, responsibilities, assigned individuals with contact information;
4. Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;
5. Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and
6. Is reviewed and approved by [Assignment: organization-defined personnel or roles];
b. Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
c. Coordinates contingency planning activities with incident handling activities;
d. Reviews the contingency plan for the information system [Assignment: organization-defined frequency];
e. Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
f. Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and
g. Protects the contingency plan from unauthorized disclosure and modification.
Supplemental Guidance: Contingency planning for information systems is part of an overall organizational program for achieving continuity of operations for mission/business functions. Contingency planning addresses both information system restoration and implementation of alternative mission/business processes when systems are compromised. The effectiveness of contingency planning is maximized by considering such planning throughout the phases of the system development life cycle. Performing contingency planning on hardware, software, and firmware development can be an effective means of achieving information system resiliency. Contingency plans reflect the degree of restoration required for organizational information systems since not all systems may need to fully recover to achieve the level of continuity of operations desired. Information system recovery objectives reflect applicable laws, Executive Orders, directives, policies, standards, regulations, and guidelines. In addition to information system availability, contingency plans also address other security-related events resulting in a reduction in mission and/or business effectiveness, such as malicious attacks compromising the confidentiality or integrity of information systems. Actions addressed in contingency plans include, for example, orderly/graceful degradation, information system shutdown, fallback to a manual mode, alternate information flows, and operating in modes reserved for when systems are under attack. By closely coordinating contingency planning with incident handling activities, organizations can ensure that the necessary contingency planning activities are in place and activated in the event of a security incident. Related controls: AC-14, CP-6, CP-7, CP-8, CP-9, CP-10, IR-4, IR-8, MP-2, MP-4, MP-5, PM-8, PM-11.
References: Federal Continuity Directive 1; NIST Special Publication 800-34. |
link |
8 |
| NIST_SP_800-53_R4 |
CP-2(1) |
NIST_SP_800-53_R4_CP-2(1) |
NIST SP 800-53 Rev. 4 CP-2 (1) |
Contingency Planning |
Coordinate With Related Plans |
Shared |
n/a |
The organization coordinates contingency plan development with organizational elements responsible for related plans.
Supplemental Guidance: Plans related to contingency plans for organizational information systems include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber Incident Response Plans, Insider Threat Implementation Plan, and Occupant Emergency Plans. |
link |
1 |
| NIST_SP_800-53_R4 |
CP-4(1) |
NIST_SP_800-53_R4_CP-4(1) |
NIST SP 800-53 Rev. 4 CP-4 (1) |
Contingency Planning |
Coordinate With Related Plans |
Shared |
n/a |
The organization coordinates contingency plan testing with organizational elements responsible for related plans.
Supplemental Guidance: Plans related to contingency plans for organizational information systems include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber Incident Response Plans, and Occupant Emergency Plans. This control enhancement does not require organizations to create organizational elements to handle related plans or to align such elements with specific plans. It does require, however, that if such organizational elements are responsible for related plans, organizations should coordinate with those elements. Related controls: IR-8, PM-8. |
link |
1 |
| NIST_SP_800-53_R4 |
IR-4 |
NIST_SP_800-53_R4_IR-4 |
NIST SP 800-53 Rev. 4 IR-4 |
Incident Response |
Incident Handling |
Shared |
n/a |
The organization:
a. Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;
b. Coordinates incident handling activities with contingency planning activities; and
c. Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.
Supplemental Guidance: Organizations recognize that incident response capability is dependent on the capabilities of organizational information systems and the mission/business processes being supported by those systems. Therefore, organizations consider incident response as part of the definition, design, and development of mission/business processes and information systems. Incident-related information can be obtained from a variety of sources including, for example, audit monitoring, network monitoring, physical access monitoring, user/administrator reports, and reported supply chain events. Effective incident handling capability includes coordination among many organizational entities including, for example, mission/business owners, information system owners, authorizing officials, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the risk executive (function). Related controls: AU-6, CM-6, CP-2, CP-4, IR-2, IR-3, IR-8, PE-6, SC-5, SC-7, SI-3, SI-4, SI-7.
References: Executive Order 13587; NIST Special Publication 800-61. |
link |
24 |
| NIST_SP_800-53_R5 |
CP-2 |
NIST_SP_800-53_R5_CP-2 |
NIST SP 800-53 Rev. 5 CP-2 |
Contingency Planning |
Contingency Plan |
Shared |
n/a |
a. Develop a contingency plan for the system that:
1. Identifies essential mission and business functions and associated contingency requirements;
2. Provides recovery objectives, restoration priorities, and metrics;
3. Addresses contingency roles, responsibilities, assigned individuals with contact information;
4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;
6. Addresses the sharing of contingency information; and
7. Is reviewed and approved by [Assignment: organization-defined personnel or roles];
b. Distribute copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
c. Coordinate contingency planning activities with incident handling activities;
d. Review the contingency plan for the system [Assignment: organization-defined frequency];
e. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
f. Communicate contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];
g. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and
h. Protect the contingency plan from unauthorized disclosure and modification. |
link |
8 |
| NIST_SP_800-53_R5 |
CP-2(1) |
NIST_SP_800-53_R5_CP-2(1) |
NIST SP 800-53 Rev. 5 CP-2 (1) |
Contingency Planning |
Coordinate with Related Plans |
Shared |
n/a |
Coordinate contingency plan development with organizational elements responsible for related plans. |
link |
1 |
| NIST_SP_800-53_R5 |
CP-4(1) |
NIST_SP_800-53_R5_CP-4(1) |
NIST SP 800-53 Rev. 5 CP-4 (1) |
Contingency Planning |
Coordinate with Related Plans |
Shared |
n/a |
Coordinate contingency plan testing with organizational elements responsible for related plans. |
link |
1 |
| NIST_SP_800-53_R5 |
IR-4 |
NIST_SP_800-53_R5_IR-4 |
NIST SP 800-53 Rev. 5 IR-4 |
Incident Response |
Incident Handling |
Shared |
n/a |
a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;
b. Coordinate incident handling activities with contingency planning activities;
c. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
d. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization. |
link |
24 |
|
op.cont.1 Impact analysis |
op.cont.1 Impact analysis |
404 not found |
|
|
|
n/a |
n/a |
|
68 |
|
op.cont.2 Continuity plan |
op.cont.2 Continuity plan |
404 not found |
|
|
|
n/a |
n/a |
|
68 |
|
op.cont.3 Periodic tests |
op.cont.3 Periodic tests |
404 not found |
|
|
|
n/a |
n/a |
|
91 |
|
op.cont.4 Alternative means |
op.cont.4 Alternative means |
404 not found |
|
|
|
n/a |
n/a |
|
95 |
|
op.exp.7 Incident management |
op.exp.7 Incident management |
404 not found |
|
|
|
n/a |
n/a |
|
103 |
|
op.exp.9 Incident management record |
op.exp.9 Incident management record |
404 not found |
|
|
|
n/a |
n/a |
|
30 |
|
org.1 Security policy |
org.1 Security policy |
404 not found |
|
|
|
n/a |
n/a |
|
94 |
| SOC_2 |
A1.3 |
SOC_2_A1.3 |
SOC 2 Type 2 A1.3 |
Additional Criteria For Availability |
Recovery plan testing |
Shared |
The customer is responsible for implementing this recommendation. |
• Implements Business Continuity Plan Testing — Business continuity plan testing is
performed on a periodic basis. The testing includes (1) development of testing scenarios based on threat likelihood and magnitude; (2) consideration of system components from across the entity that can impair the availability; (3) scenarios that
consider the potential for the lack of availability of key personnel; and (4) revision
of continuity plans and systems based on test results.
• Tests Integrity and Completeness of Backup Data — The integrity and completeness
of backup information is tested on a periodic basis |
|
4 |
| SOC_2 |
CC7.4 |
SOC_2_CC7.4 |
SOC 2 Type 2 CC7.4 |
System Operations |
Security incidents response |
Shared |
The customer is responsible for implementing this recommendation. |
Assigns Roles and Responsibilities — Roles and responsibilities for the design, implementation, maintenance, and execution of the incident response program are assigned, including the use of external resources when necessary.
• Contains Security Incidents — Procedures are in place to contain security incidents
that actively threaten entity objectives.
• Mitigates Ongoing Security Incidents — Procedures are in place to mitigate the effects of ongoing security incidents.
• Ends Threats Posed by Security Incidents — Procedures are in place to end the
threats posed by security incidents through closure of the vulnerability, removal of
unauthorized access, and other remediation actions.
• Restores Operations — Procedures are in place to restore data and business operations to an interim state that permits the achievement of entity objectives.
• Develops and Implements Communication Protocols for Security Incidents — Protocols for communicating security incidents and actions taken to affected parties
are developed and implemented to meet the entity's objectives.
• Obtains Understanding of Nature of Incident and Determines Containment Strategy
— An understanding of the nature (for example, the method by which the incident
occurred and the affected system resources) and severity of the security incident is
obtained to determine the appropriate containment strategy, including (1) a determination of the appropriate response time frame, and (2) the determination and execution of the containment approach.
• Remediates Identified Vulnerabilities — Identified vulnerabilities are remediated
through the development and execution of remediation activities.
• Communicates Remediation Activities — Remediation activities are documented
and communicated in accordance with the incident-response program.
• Evaluates the Effectiveness of Incident Response — The design of incident-response
activities is evaluated for effectiveness on a periodic basis.
• Periodically Evaluates Incidents — Periodically, management reviews incidents related to security, availability, processing integrity, confidentiality, and privacy and
identifies the need for system changes based on incident patterns and root causes
Communicates Unauthorized Use and Disclosure — Events that resulted in unauthorized use or disclosure of personal information are communicated to the data
subjects, legal and regulatory authorities, and others as required.
• Application of Sanctions — The conduct of individuals and organizations operating
under the authority of the entity and involved in the unauthorized use or disclosure
of personal information is evaluated and, if appropriate, sanctioned in accordance with entity policies and legal and regulatory requirements |
|
17 |
| SOC_2 |
CC7.5 |
SOC_2_CC7.5 |
SOC 2 Type 2 CC7.5 |
System Operations |
Recovery from identified security incidents |
Shared |
The customer is responsible for implementing this recommendation. |
• Restores the Affected Environment — The activities restore the affected environment
to functional operation by rebuilding systems, updating software, installing patches,
and changing configurations, as needed.
• Communicates Information About the Event — Communications about the nature of
the incident, recovery actions taken, and activities required for the prevention of future security events are made to management and others as appropriate (internal
and external).
• Determines Root Cause of the Event — The root cause of the event is determined.
• Implements Changes to Prevent and Detect Recurrences — Additional architecture
or changes to preventive and detective controls, or both, are implemented to prevent
and detect recurrences on a timely basis.
• Improves Response and Recovery Procedures — Lessons learned are analyzed and
the incident-response plan and recovery procedures are improved.
• Implements Incident-Recovery Plan Testing — Incident-recovery plan testing is performed on a periodic basis. The testing includes (1) development of testing scenarios based on threat likelihood and magnitude; (2) consideration of relevant system
components from across the entity that can impair availability; (3) scenarios that
consider the potential for the lack of availability of key personnel; and (4) revision
of continuity plans and systems based on test results |
|
19 |
| SWIFT_CSCF_v2022 |
10.1 |
SWIFT_CSCF_v2022_10.1 |
SWIFT CSCF v2022 10.1 |
10. Be Ready in case of Major Disaster |
Business continuity is ensured through a documented plan communicated to the potentially affected
parties (service bureau and customers). |
Shared |
n/a |
Business continuity is ensured through a documented plan communicated to the potentially affected
parties (service bureau and customers). |
link |
5 |
| SWIFT_CSCF_v2022 |
8.1 |
SWIFT_CSCF_v2022_8.1 |
SWIFT CSCF v2022 8.1 |
8. Set and Monitor Performance |
Ensure availability by formally setting and monitoring the objectives to be achieved |
Shared |
n/a |
Ensure availability by formally setting and monitoring the objectives to be achieved |
link |
8 |
| SWIFT_CSCF_v2022 |
8.4 |
SWIFT_CSCF_v2022_8.4 |
SWIFT CSCF v2022 8.4 |
8. Set and Monitor Performance |
Ensure availability, capacity, and quality of services to customers |
Shared |
n/a |
Ensure availability, capacity, and quality of services to customers |
link |
7 |
| SWIFT_CSCF_v2022 |
9.1 |
SWIFT_CSCF_v2022_9.1 |
SWIFT CSCF v2022 9.1 |
9. Ensure Availability through Resilience |
Providers must ensure that the service remains available for customers in the event of a local disturbance or malfunction. |
Shared |
n/a |
Providers must ensure that the service remains available for customers in the event of a local disturbance or malfunction. |
link |
8 |