Lexim011/Compliance huggingface dataset:
CCI-001726 (policy): Use software in accordance with contract agreements.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 a NIST: NIST SP 800-53 Revision 5 (v5): CM-10 a
CCI-001727 (policy): Use software documentation in accordance with contract agreements.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 a NIST: NIST SP 800-53 Revision 5 (v5): CM-10 a
CCI-001728 (policy): Use software in accordance with copyright laws.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 a NIST: NIST SP 800-53 Revision 5 (v5): CM-10 a
CCI-001729 (policy): Use software documentation in accordance with copyright laws.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 a NIST: NIST SP 800-53 Revision 5 (v5): CM-10 a
CCI-001730 (policy): Track the use of software protected by quantity licenses to control copying of the software.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 b NIST: NIST SP 800-53 Revision 5 (v5): CM-10 b
CCI-001731 (policy): Track the use of software documentation protected by quantity licenses to control distribution of the software documentation.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 b NIST: NIST SP 800-53 Revision 5 (v5): CM-10 b
CCI-001802 (policy): Track the use of software documentation protected by quantity licenses to control copying of the software documentation.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 b NIST: NIST SP 800-53 Revision 5 (v5): CM-10 b
CCI-001803 (policy): Track the use of software protected by quantity licenses to control distribution of the software.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 b NIST: NIST SP 800-53 Revision 5 (v5): CM-10 b
CCI-001732 (policy): Control the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 c NIST: NIST SP 800-53 Revision 5 (v5): CM-10 c
CCI-001733 (policy): Document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 c NIST: NIST SP 800-53 Revision 5 (v5): CM-10 c
CCI-001734 (policy): Defines the restrictions to be followed on the use of open source software.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-10 (1)
CCI-001735 (policy): Establish organization-defined restrictions on the use of open source software.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-10 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-10 (1)
CCI-001804 (policy): Defines the policies for governing the installation of software by users.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-11 a NIST: NIST SP 800-53 Revision 5 (v5): CM-11 a
CCI-001805 (policy): Establish organization-defined policies governing the installation of software by users.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-11 a NIST: NIST SP 800-53 Revision 5 (v5): CM-11 a
CCI-001806 (policy): Defines methods to be employed to enforce the software installation policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-11 b NIST: NIST SP 800-53 Revision 5 (v5): CM-11 b
CCI-001807 (policy): Enforce software installation policies through organization-defined methods.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-11 b NIST: NIST SP 800-53 Revision 5 (v5): CM-11 b
CCI-001808 (policy): Defines the frequency on which it will monitor software installation policy compliance.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-11 c NIST: NIST SP 800-53 Revision 5 (v5): CM-11 c
CCI-001809 (policy): Monitor software installation policy compliance per an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-11 c NIST: NIST SP 800-53 Revision 5 (v5): CM-11 c
CCI-003980 (technical): Allow user installation of software only with explicit privileged status.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-11 (2)
CCI-003981 (technical): Enforce and monitor compliance with software installation policies using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-11 (3)
CCI-003982 (policy): Identify and document the location of the organization-defined information on which the information is processed and stored.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-12 a
CCI-003983 (policy): Identify and document the specific system components on which the organization-defined information is processed and stored.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-12 a
CCI-003984 (policy): Defines the information on which the location and specific system components are processed and stored.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-12 a
CCI-003985 (policy): Identify and document the users who have access to the system where the information is processed and stored.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-12 b
CCI-003986 (policy): Identify and document the users who have access to the system components where the information is processed and stored.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-12 b
CCI-003987 (policy): Document changes to the location (i.e., system or system components) where the information is processed and stored.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-12 c
CCI-003988 (policy): Use automated tools to identify organization-defined information by information type on organization-defined components to ensure adequate controls are in place to protect organizational information.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-12 (1)
CCI-003989 (policy): Defines the information by information type for identifying automated tools.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-12 (1)
CCI-003990 (policy): Defines the system components used to ensure controls are in place to protect organizational information and individual privacy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-12 (1)
CCI-003991 (policy): Develop and document a map of system data actions.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-13
CCI-003992 (policy, technical): Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-14
CCI-003993 (policy, technical): Defines the software and firmware for preventing installation without verification that the component has been digitally signed.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-14
CCI-000438 (policy): Develop and document an organizational-level; mission/business process-level; and/or system-level contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): CP-1 a NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 1 (a) NIST: NIST SP 800-53A (v1): CP-1.1 (i) (ii)
CCI-000439 (policy): Disseminate an organizational-level; mission/business process-level; and/or system-level contingency planning policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): CP-1 a NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 1 (a) NIST: NIST SP 800-53A (v1): CP-1.1 (iii)
CCI-000441 (policy): Develop and document procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls.
References: NIST: NIST SP 800-53 (v3): CP-1 b NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 2 NIST: NIST SP 800-53A (v1): CP-1.1 (iv) (v)
CCI-001597 (policy): Disseminate contingency planning procedures to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): CP-1 NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 2 NIST: NIST SP 800-53A (v1): CP-1.1 (vi)
CCI-002825 (policy): Defines the personnel or roles to whom the organizational-level; mission/business process-level; and/or system-level contingency planning policy is to be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 1 (a)
CCI-002826 (policy): Defines personnel or roles to whom the contingency planning procedures are disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 2
CCI-003994 (policy): Develop and document an organizational-level; mission/business process-level; and/or system-level contingency planning policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 1 (b)
CCI-003995 (policy): Disseminate an organizational-level; mission/business process-level; and/or system-level contingency planning policy to organization-defined personnel or roles that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 1 (b)
CCI-003996 (policy): Designate an organization-defined official to manage development and documentation of the contingency planning policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b
CCI-003997 (policy): Designate an organization-defined official to manage dissemination of the contingency planning policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b
CCI-003998 (policy): Defines the official designated to manage the development, documentation, and dissemination of the contingency policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b
CCI-003999 (policy): Designate an organization-defined official to manage the development and documentation of the contingency planning procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b
CCI-004000 (policy): Designate an organization-defined official to manage the dissemination of the contingency procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b
CCI-004001 (policy): Defines the official designated to manage the development, documentation, and dissemination of the contingency procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b
CCI-000437 (policy): Defines the frequency with which to review and update the current contingency planning policy.
References: NIST: NIST SP 800-53 (v3): CP-1 NIST: NIST SP 800-53 Revision 4 (v4): CP-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 1 NIST: NIST SP 800-53A (v1): CP-1.2 (i)
CCI-000440 (policy): Review and update the current contingency planning policy in accordance with an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CP-1 a NIST: NIST SP 800-53 Revision 4 (v4): CP-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 1 NIST: NIST SP 800-53A (v1): CP-1.2 (ii)
CCI-001596 (policy): Defines the frequency with which to review and update the current contingency planning procedures.
References: NIST: NIST SP 800-53 (v3): CP-1 NIST: NIST SP 800-53 Revision 4 (v4): CP-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 2 NIST: NIST SP 800-53A (v1): CP-1.2 (iii)
CCI-001598 (policy): Review and update the current contingency planning procedures in accordance with the organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CP-1 NIST: NIST SP 800-53 Revision 4 (v4): CP-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 2 NIST: NIST SP 800-53A (v1): CP-1.2 (iv)
CCI-004002 (policy): Review and update the current contingency planning policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 1
CCI-004003 (policy): Defines the events with which to review and update the current contingency planning policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 1
CCI-004004 (policy): Review and update the current contingency planning procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 2
CCI-004005 (policy): Defines the events with which to review and update the current contingency planning procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 2
CCI-000443 (policy): Develop a contingency plan for the system that identifies essential missions.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 1 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000444 (policy): Develop a contingency plan for the system that identifies essential business functions.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 1 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000445 (policy): Develop a contingency plan for the system that identifies associated contingency requirements.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 1 NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 1 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000446 (policy): Develop a contingency plan for the system that provides recovery objectives.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 2 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000447 (policy): Develop a contingency plan for the system that provides restoration priorities.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 2 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000448 (policy): Develop a contingency plan for the system that provides metrics.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 2 NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 2 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000449 (policy): Develop a contingency plan for the system that addresses contingency roles, responsibilities, assigned individuals with contact information.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 3 NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 3 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000456 (policy): Develop a contingency plan for the system that addresses eventual, full information system restoration without deterioration of the controls originally planned and implemented.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 5 NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 5 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-000457 (policy): Develop a contingency plan for the system that is reviewed and approved by organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): CP-2 a NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 6 NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 7 NIST: NIST SP 800-53A (v1): CP-2.1 (i)
CCI-002830 (policy): Defines the personnel or roles who review and approve the contingency plan for the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 6 NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 7
CCI-004006 (policy): Develop a contingency plan for the system that addresses maintaining essential mission functions despite a system disruption, compromise, or failure.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 4
CCI-004007 (policy): Develop a contingency plan for the system that addresses maintaining essential business functions despite a system disruption, compromise, or failure.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 4
CCI-004008 (policy): Develop a contingency plan for the system that addresses the sharing of contingency information.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 6
CCI-000458 (policy): Defines the key contingency personnel (identified by name and/or by role) and organizational elements designated to receive copies of the contingency plan.
References: NIST: NIST SP 800-53 (v3): CP-2 b NIST: NIST SP 800-53 Revision 4 (v4): CP-2 b NIST: NIST SP 800-53 Revision 5 (v5): CP-2 b NIST: NIST SP 800-53A (v1): CP-2.1 (ii)
CCI-000459 (policy): Distributes copies of the contingency plan to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.
References: NIST: NIST SP 800-53 (v3): CP-2 b NIST: NIST SP 800-53 Revision 4 (v4): CP-2 b NIST: NIST SP 800-53 Revision 5 (v5): CP-2 b NIST: NIST SP 800-53A (v1): CP-2.1 (iii)
CCI-000460 (policy): Coordinate contingency planning activities with incident handling activities.
References: NIST: NIST SP 800-53 (v3): CP-2 c NIST: NIST SP 800-53 Revision 4 (v4): CP-2 c NIST: NIST SP 800-53 Revision 5 (v5): CP-2 c NIST: NIST SP 800-53A (v1): CP-2.2 (i)
CCI-000461 (policy): Defines the frequency with which to review the contingency plan for the system.
References: NIST: NIST SP 800-53 (v3): CP-2 c NIST: NIST SP 800-53 Revision 4 (v4): CP-2 d NIST: NIST SP 800-53 Revision 5 (v5): CP-2 d NIST: NIST SP 800-53A (v1): CP-2.2 (ii)
CCI-000462 (policy): Reviews the contingency plan for the system in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CP-2 c NIST: NIST SP 800-53 Revision 4 (v4): CP-2 d NIST: NIST SP 800-53 Revision 5 (v5): CP-2 d NIST: NIST SP 800-53A (v1): CP-2.2 (iii)
CCI-000463 (policy): Updates the contingency plan to address changes to the organization.
References: NIST: NIST SP 800-53 (v3): CP-2 e NIST: NIST SP 800-53 Revision 4 (v4): CP-2 e NIST: NIST SP 800-53 Revision 5 (v5): CP-2 e NIST: NIST SP 800-53A (v1): CP-2.2 (iv)
CCI-000464 (policy): Updates the contingency plan to address changes to the system.
References: NIST: NIST SP 800-53 (v3): CP-2 e NIST: NIST SP 800-53 Revision 4 (v4): CP-2 e NIST: NIST SP 800-53 Revision 5 (v5): CP-2 e NIST: NIST SP 800-53A (v1): CP-2.2 (iv)
CCI-000465 (policy): Updates the contingency plan to address changes to the environment of operation.
References: NIST: NIST SP 800-53 (v3): CP-2 e NIST: NIST SP 800-53 Revision 4 (v4): CP-2 e NIST: NIST SP 800-53 Revision 5 (v5): CP-2 e NIST: NIST SP 800-53A (v1): CP-2.2 (iv)
CCI-000466 (policy): Updates the contingency plan to address problems encountered during contingency plan implementation, execution, or testing.
References: NIST: NIST SP 800-53 (v3): CP-2 e NIST: NIST SP 800-53 Revision 4 (v4): CP-2 e NIST: NIST SP 800-53 Revision 5 (v5): CP-2 e NIST: NIST SP 800-53A (v1): CP-2.2 (iv)
CCI-000468 (policy): Communicates contingency plan changes to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.
References: NIST: NIST SP 800-53 (v3): CP-2 f NIST: NIST SP 800-53 Revision 4 (v4): CP-2 f NIST: NIST SP 800-53 Revision 5 (v5): CP-2 f NIST: NIST SP 800-53A (v1): CP-2.2 (v)
CCI-002831 (policy): Defines a list of key contingency personnel (identified by name and/or by role) and organizational elements to whom contingency plan changes are to be communicated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-2 f NIST: NIST SP 800-53 Revision 5 (v5): CP-2 f
CCI-004009 (policy): Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-2 g
CCI-002832 (policy): Protects the contingency plan from unauthorized disclosure and modification.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-2 g NIST: NIST SP 800-53 Revision 5 (v5): CP-2 h
CCI-000469 (policy): Coordinate contingency plan development with organizational elements responsible for related plans.
References: NIST: NIST SP 800-53 (v3): CP-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (1) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (1) NIST: NIST SP 800-53A (v1): CP-2 (1).1
CCI-000470 (policy): Conduct capacity planning so that necessary capacity for information processing exists during contingency operations.
References: NIST: NIST SP 800-53 (v3): CP-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (2) NIST: NIST SP 800-53A (v1): CP-2 (2).1
CCI-000471 (policy): Conduct capacity planning so that necessary capacity for telecommunications exists during contingency operations.
References: NIST: NIST SP 800-53 (v3): CP-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (2) NIST: NIST SP 800-53A (v1): CP-2 (2).1
CCI-000472 (policy): Conduct capacity planning so that necessary capacity for environmental support exists during contingency operations.
References: NIST: NIST SP 800-53 (v3): CP-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (2) NIST: NIST SP 800-53A (v1): CP-2 (2).1
CCI-000473 (policy): Defines the time period for planning the resumption of essential missions as a result of contingency plan activation.
References: NIST: NIST SP 800-53 (v3): CP-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (3) NIST: NIST SP 800-53A (v1): CP-2 (3).1 (i)
CCI-000474 (policy): Defines the time period for planning the resumption of essential business functions as a result of contingency plan activation.
References: NIST: NIST SP 800-53 (v3): CP-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (3) NIST: NIST SP 800-53A (v1): CP-2 (3).1 (i)
CCI-000475 (policy): Plan for the resumption of all or essential mission functions within the organization-defined time period of contingency plan activation.
References: NIST: NIST SP 800-53 (v3): CP-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (3) NIST: NIST SP 800-53A (v1): CP-2 (3).1 (ii)
CCI-000476 (policy): Plan for the resumption of all or essential business functions within the organization-defined time period of contingency plan activation.
References: NIST: NIST SP 800-53 (v3): CP-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (3) NIST: NIST SP 800-53A (v1): CP-2 (3).1 (ii)
CCI-000481 (policy): Plan for the continuance of all or essential missions with little or no loss of operational continuity.
References: NIST: NIST SP 800-53 (v3): CP-2 (5) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (5) NIST: NIST SP 800-53A (v1): CP-2 (5).1 (a)
CCI-000482 (policy): Plan for the continuance of all or essential business functions with little or no loss of operational continuity.
References: NIST: NIST SP 800-53 (v3): CP-2 (5) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (5) NIST: NIST SP 800-53A (v1): CP-2 (5).1 (a)
CCI-001599 (policy): Sustain operational continuity of essential missions until full information system restoration at primary processing and/or storage sites.
References: NIST: NIST SP 800-53 (v3): CP-2 (5) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (5) NIST: NIST SP 800-53A (v1): CP-2 (5).1 (b)
CCI-001600 (policy): Sustains operational continuity of essential business functions until full information system restoration at primary processing and/or storage sites.
References: NIST: NIST SP 800-53 (v3): CP-2 (5) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (5) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (5) NIST: NIST SP 800-53A (v1): CP-2 (5).1 (b)
CCI-000483 (policy): Plan for the transfer of all or essential mission functions to alternate processing and/or storage sites with minimal or no loss of operational continuity.
References: NIST: NIST SP 800-53 (v3): CP-2 (6) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (6) NIST: NIST SP 800-53A (v1): CP-2 (6).1 (i)
CCI-000484 (policy): Plan for the transfer of all or essential business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity.
References: NIST: NIST SP 800-53 (v3): CP-2 (6) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (6) NIST: NIST SP 800-53A (v1): CP-2 (6).1 (i)
CCI-001601 (policy): Sustain operational continuity of essential mission functions at alternate processing and/or storage sites until system restoration to primary processing and/or storage sites.
References: NIST: NIST SP 800-53 (v3): CP-2 (6) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (6) NIST: NIST SP 800-53A (v1): CP-2 (6).1 (ii)
CCI-001602 (policy): Sustain operational continuity of essential business functions at alternate processing and/or storage sites until system restoration at primary processing and/or storage sites.
References: NIST: NIST SP 800-53 (v3): CP-2 (6) NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (6) NIST: NIST SP 800-53A (v1): CP-2 (6).1 (ii)
CCI-002827 (policy): Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (7) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (7)
CCI-002828 (policy): Identify critical system assets supporting all or essential mission functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (8) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (8)
CCI-002829 (policy): Identify critical system assets supporting all or essential business functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (8) NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (8)
CCI-000485 (policy): Defines the frequency of contingency training to system users.
References: NIST: NIST SP 800-53 (v3): CP-3 NIST: NIST SP 800-53 Revision 4 (v4): CP-3 c NIST: NIST SP 800-53 Revision 5 (v5): CP-3 a 3 NIST: NIST SP 800-53A (v1): CP-3.1 (ii)
CCI-000486 (policy): Provide contingency training to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming a contingency role or responsibility.
References: NIST: NIST SP 800-53 (v3): CP-3 NIST: NIST SP 800-53 Revision 4 (v4): CP-3 a NIST: NIST SP 800-53 Revision 5 (v5): CP-3 a 1 NIST: NIST SP 800-53A (v1): CP-3.1 (i)
CCI-000487 (policy): Provide contingency training to system users consistent with assigned roles and responsibilities in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CP-3 NIST: NIST SP 800-53 Revision 4 (v4): CP-3 c NIST: NIST SP 800-53 Revision 5 (v5): CP-3 a 3 NIST: NIST SP 800-53A (v1): CP-3.1 (iii)
CCI-002833 (policy): Defines the time period that contingency training is to be provided to system users consistent with assigned roles and responsibilities within assuming a contingency role or responsibility.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-3 a NIST: NIST SP 800-53 Revision 5 (v5): CP-3 a 1
CCI-002834 (policy): Provide contingency training to system users consistent with assigned roles and responsibilities when required by system changes.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-3 b NIST: NIST SP 800-53 Revision 5 (v5): CP-3 a 2
CCI-004010 (policy): Review and update contingency training content on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-3 b
CCI-004011 (policy): Defines the frequency the contingency training content will be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-3 b
CCI-004012 (policy): Review and update contingency training content following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-3 b
CCI-004013 (policy): Defines the events for which the contingency training content will be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-3 b
CCI-000488 (policy): Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.
References: NIST: NIST SP 800-53 (v3): CP-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): CP-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): CP-3 (1) NIST: NIST SP 800-53A (v1): CP-3 (1).1 (i) (ii)
CCI-000489 (policy): Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment.
References: NIST: NIST SP 800-53 (v3): CP-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): CP-3 (2) NIST: NIST SP 800-53A (v1): CP-3 (2).1
CCI-000490 (policy): Defines the frequency with which to test the contingency plan for the system.
References: NIST: NIST SP 800-53 (v3): CP-4 NIST: NIST SP 800-53 Revision 4 (v4): CP-4 a NIST: NIST SP 800-53 Revision 5 (v5): CP-4 a NIST: NIST SP 800-53A (v1): CP-4.1 (ii)
CCI-000492 (policy): Defines contingency plan tests to be conducted for the system.
References: NIST: NIST SP 800-53 (v3): CP-4 NIST: NIST SP 800-53 Revision 4 (v4): CP-4 a NIST: NIST SP 800-53 Revision 5 (v5): CP-4 a NIST: NIST SP 800-53A (v1): CP-4.1 (i)
CCI-000494 (policy): Test the contingency plan for the system in accordance with organization-defined frequency using organization-defined tests to determine the effectiveness of the plan and the organizational readiness to execute the plan.
References: NIST: NIST SP 800-53 (v3): CP-4 a NIST: NIST SP 800-53 Revision 4 (v4): CP-4 a NIST: NIST SP 800-53 Revision 5 (v5): CP-4 a NIST: NIST SP 800-53A (v1): CP-4.1 (iii)
CCI-000496 (policy): Review the contingency plan test results.
References: NIST: NIST SP 800-53 (v3): CP-4 b NIST: NIST SP 800-53 Revision 4 (v4): CP-4 b NIST: NIST SP 800-53 Revision 5 (v5): CP-4 b NIST: NIST SP 800-53A (v1): CP-4.1 (iv)
CCI-000497 (policy): Initiate corrective actions, if needed, after reviewing the contingency plan test results.
References: NIST: NIST SP 800-53 (v3): CP-4 b NIST: NIST SP 800-53 Revision 4 (v4): CP-4 c NIST: NIST SP 800-53 Revision 5 (v5): CP-4 c NIST: NIST SP 800-53A (v1): CP-4.1 (iv)
CCI-000498 (policy): Coordinate contingency plan testing with organizational elements responsible for related plans.
References: NIST: NIST SP 800-53 (v3): CP-4 (1) NIST: NIST SP 800-53 Revision 4 (v4): CP-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (1) NIST: NIST SP 800-53A (v1): CP-4 (1).1
CCI-000500 (policy): Test the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources.
References: NIST: NIST SP 800-53 (v3): CP-4 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-4 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (2) (a) NIST: NIST SP 800-53A (v1): CP-4 (2).1
CCI-002835 (policy): Test the contingency plan at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-4 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (2) (b)
CCI-000502 (policy): Test the contingency plan using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CP-4 (3) NIST: NIST SP 800-53 Revision 4 (v4): CP-4 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (3) NIST: NIST SP 800-53A (v1): CP-4 (3).1
CCI-004014 (policy): Defines the automated mechanisms to test the contingency plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (3)
CCI-000504 (policy): Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing.
References: NIST: NIST SP 800-53 (v3): CP-4 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-4 (4)4 NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (4) NIST: NIST SP 800-53A (v1): CP-4 (4).1
CCI-004015 (policy, technical): Employ organization-defined mechanisms to organization-defined system or system component to disrupt and adversely affect the system or system component.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (5)
CCI-004016 (policy, technical): Defines the mechanisms employed to disrupt and adversely affect the system or system component.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (5)
CCI-004017 (policy, technical): Defines the system or system component used to employ organization-defined mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (5)
CCI-000505 (policy): Establish an alternate storage site, including necessary agreements to permit the storage of system backup information.
References: NIST: NIST SP 800-53 (v3): CP-6 NIST: NIST SP 800-53 Revision 4 (v4): CP-6 a NIST: NIST SP 800-53 Revision 5 (v5): CP-6 a NIST: NIST SP 800-53A (v1): CP-6.1 (i)
CCI-004018 (policy): Establish an alternate storage site, including necessary agreements to permit the retrieval of system backup information.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-6 a
CCI-002836 (policy): Ensure that the alternate storage site provides security controls equivalent to that of the primary site.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-6 b NIST: NIST SP 800-53 Revision 5 (v5): CP-6 b
CCI-000507 (policy): Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.
References: NIST: NIST SP 800-53 (v3): CP-6 (1) NIST: NIST SP 800-53 Revision 4 (v4): CP-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): CP-6 (1) NIST: NIST SP 800-53A (v1): CP-6 (1).1 (ii)
CCI-000508 (policy): Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.
References: NIST: NIST SP 800-53 (v3): CP-6 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): CP-6 (2) NIST: NIST SP 800-53A (v1): CP-6 (2).1
CCI-000509 (policy): Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.
References: NIST: NIST SP 800-53 (v3): CP-6 (3) NIST: NIST SP 800-53 Revision 4 (v4): CP-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-6 (3) NIST: NIST SP 800-53A (v1): CP-6 (3).1 (i)
CCI-001604 (policy): Outline explicit mitigation actions for potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.
References: NIST: NIST SP 800-53 (v3): CP-6 (3) NIST: NIST SP 800-53 Revision 4 (v4): CP-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-6 (3) NIST: NIST SP 800-53A (v1): CP-6 (3).1 (ii)
CCI-000510 (policy): Defines the time-period consistent with recovery time and recovery point objectives for essential missions/business functions to permit the transfer and resumption of organization-defined system operations at an alternate processing site when the primary processing capabilities are unavailable.
References: NIST: NIST SP 800-53 (v3): CP-7 NIST: NIST SP 800-53 Revision 4 (v4): CP-7 a NIST: NIST SP 800-53 Revision 5 (v5): CP-7 a NIST: NIST SP 800-53A (v1): CP-7.1 (ii)
CCI-000513 (policy): Establish an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential mission functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.
References: NIST: NIST SP 800-53 (v3): CP-7 a NIST: NIST SP 800-53 Revision 4 (v4): CP-7 a NIST: NIST SP 800-53 Revision 5 (v5): CP-7 a NIST: NIST SP 800-53A (v1): CP-7.1 (iii)
CCI-000514 (policy): Establish an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential business functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.
References: NIST: NIST SP 800-53 (v3): CP-7 a NIST: NIST SP 800-53 Revision 4 (v4): CP-7 a NIST: NIST SP 800-53 Revision 5 (v5): CP-7 a NIST: NIST SP 800-53A (v1): CP-7.1 (iii)
CCI-002839 (policy): Defines system operations that are permitted to transfer and resume at an alternate processing site for essential missions/business functions when the primary processing capabilities are unavailable.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-7 a NIST: NIST SP 800-53 Revision 5 (v5): CP-7 a
CCI-000515 (policy): Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption.
References: NIST: NIST SP 800-53 (v3): CP-7 b NIST: NIST SP 800-53 Revision 4 (v4): CP-7 b NIST: NIST SP 800-53 Revision 5 (v5): CP-7 b NIST: NIST SP 800-53A (v1): CP-7.1 (iv)
CCI-000521 (policy): Provide controls at the alternate processing site that are equivalent to those at the primary site.
References: NIST: NIST SP 800-53 (v3): CP-7 (5) NIST: NIST SP 800-53 Revision 4 (v4): CP-7 c NIST: NIST SP 800-53 Revision 5 (v5): CP-7 c NIST: NIST SP 800-53A (v1): CP-7 (5).1
CCI-000516 (policy): Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.
References: NIST: NIST SP 800-53 (v3): CP-7 (1) NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (1) NIST: NIST SP 800-53A (v1): CP-7 (1).1 (ii)
CCI-000517 (policy): Identify potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.
References: NIST: NIST SP 800-53 (v3): CP-7 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (2) NIST: NIST SP 800-53A (v1): CP-7 (2).1 (i)
CCI-001606 (policy): Identify potential accessibility problems to outline explicit mitigation actions.
References: NIST: NIST SP 800-53 (v3): CP-7 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (2) NIST: NIST SP 800-53A (v1): CP-7 (2).1 (ii)
CCI-000518 (policy): Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).
References: NIST: NIST SP 800-53 (v3): CP-7 (3) NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (3) NIST: NIST SP 800-53A (v1): CP-7 (3).1
CCI-000519 (policy): Prepare the alternate processing site so that the site can serve as the operational site supporting essential missions.
References: NIST: NIST SP 800-53 (v3): CP-7 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (4) NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (4) NIST: NIST SP 800-53A (v1): CP-7 (4).1
CCI-000520 (policy): Prepare the alternate processing site so that the site can serve as the operational site supporting essential business functions.
References: NIST: NIST SP 800-53 (v3): CP-7 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (4) NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (4) NIST: NIST SP 800-53A (v1): CP-7 (4).1
CCI-002837 (policy): Plan for circumstances that preclude returning to the primary processing site.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (6) NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (6)
CCI-002838 (policy): Prepare for circumstances that preclude returning to the primary processing site.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (6) NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (6)
CCI-000522 (policy): Defines the time-period within which to permit the resumption of organization-defined system operations for essential mission functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
References: NIST: NIST SP 800-53 (v3): CP-8 NIST: NIST SP 800-53 Revision 4 (v4): CP-8 NIST: NIST SP 800-53 Revision 5 (v5): CP-8 NIST: NIST SP 800-53A (v1): CP-8.1 (ii)
CCI-000523 (policy): Defines the time-period within which to permit the resumption of organization-defined system operations for essential business functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
References: NIST: NIST SP 800-53 (v3): CP-8 NIST: NIST SP 800-53 Revision 4 (v4): CP-8 NIST: NIST SP 800-53 Revision 5 (v5): CP-8 NIST: NIST SP 800-53A (v1): CP-8.1 (ii)
CCI-000524 (policy): Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential mission functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
References: NIST: NIST SP 800-53 (v3): CP-8 NIST: NIST SP 800-53 Revision 4 (v4): CP-8 NIST: NIST SP 800-53 Revision 5 (v5): CP-8 NIST: NIST SP 800-53A (v1): CP-8.1 (iii)
CCI-000525 (policy): Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential business functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
References: NIST: NIST SP 800-53 (v3): CP-8 NIST: NIST SP 800-53 Revision 4 (v4): CP-8 NIST: NIST SP 800-53 Revision 5 (v5): CP-8 NIST: NIST SP 800-53A (v1): CP-8.1 (iii)
CCI-002840 (policy): Defines the system operations to be resumed for essential mission functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-8 NIST: NIST SP 800-53 Revision 5 (v5): CP-8
CCI-002841 (policy): Defines the system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-8 NIST: NIST SP 800-53 Revision 5 (v5): CP-8
CCI-000526 (policy): Develop primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).
References: NIST: NIST SP 800-53 (v3): CP-8 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (1) (a) NIST: NIST SP 800-53A (v1): CP-8 (1).1 (i)
CCI-000527 (policy): Develop alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).
References: NIST: NIST SP 800-53 (v3): CP-8 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (1) (a) NIST: NIST SP 800-53A (v1): CP-8 (1).1 (i)
CCI-004019 (policy): Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (1) (b)
CCI-000530 (policy): Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.
References: NIST: NIST SP 800-53 (v3): CP-8 (2) NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (2) NIST: NIST SP 800-53A (v1): CP-8 (2).1
CCI-000531 (policy): Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.
References: NIST: NIST SP 800-53 (v3): CP-8 (3) NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (3) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (3) NIST: NIST SP 800-53A (v1): CP-8 (3).1 (ii)
CCI-000532 (policy): Require primary telecommunications service providers to have contingency plans.
References: NIST: NIST SP 800-53 (v3): CP-8 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (a) NIST: NIST SP 800-53A (v1): CP-8 (4).1
CCI-000533 (policy): Require alternate telecommunications service providers to have contingency plans.
References: NIST: NIST SP 800-53 (v3): CP-8 (4) NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (a) NIST: NIST SP 800-53A (v1): CP-8 (4).1
CCI-002842 (policy): Review provider contingency plans to ensure that the plans meet organizational contingency requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (b)
CCI-002843 (policy): Defines the frequency with which to obtain evidence of contingency testing by providers.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (c)
CCI-002844 (policy): Defines the frequency with which to obtain evidence of contingency training by providers.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (c)
CCI-002845 (policy): Obtain evidence of contingency testing by providers in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (c)
CCI-002846 (policy): Obtain evidence of contingency training by providers in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (c)
CCI-002847 (policy): Defines the frequency with which to test alternate telecommunication services.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (5) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (5)
CCI-002848 (policy): Test alternate telecommunication services per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (5) NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (5)
CCI-000534 (policy): Defines the frequency of conducting user-level information backups to support recovery time objectives and recovery point objectives.
References: NIST: NIST SP 800-53 (v3): CP-9 (a) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (a) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (a) NIST: NIST SP 800-53A (v1): CP-9 (6).1 (ii)
CCI-000535 (policy): Conduct backups of user-level information contained in organization-defined system components per organization-defined frequency that is consistent with recovery time and recovery point objectives.
References: NIST: NIST SP 800-53 (v3): CP-9 (a) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (a) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (a) NIST: NIST SP 800-53A (v1): CP-9.1 (iv)
CCI-000536 (policy): Defines the frequency of conducting system-level information backups to support recovery time objectives and recovery point objectives.
References: NIST: NIST SP 800-53 (v3): CP-9 (b) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (b) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (b) NIST: NIST SP 800-53A (v1): CP-9.1 (ii)
CCI-000537 (policy): Conduct backups of system-level information contained in the system per organization-defined frequency that is consistent with recovery time and recovery point objectives.
References: NIST: NIST SP 800-53 (v3): CP-9 (b) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (b) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (b) NIST: NIST SP 800-53A (v1): CP-9.1 (v)
CCI-000538 (policy): Defines the frequency of conducting system documentation backups, including security-related documentation, to support recovery time objectives and recovery point objectives.
References: NIST: NIST SP 800-53 (v3): CP-9 (c) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (c) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (c) NIST: NIST SP 800-53A (v1): CP-9.1 (iii)
CCI-000539 (policy): Conduct backups of system documentation, including security-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives.
References: NIST: NIST SP 800-53 (v3): CP-9 (c) NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (c) NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (c) NIST: NIST SP 800-53A (v1): CP-9.1 (vi)
CCI-004020 (policy): Defines the system components to conduct backups of user level information.
References: NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (a)