Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 18 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 1 of 7 

5.18 Contingency Planning (CP)1 

1. Based on inquiry and record examination, has the 

Tribe or TGRA developed, documented, and 

disseminated to organizational personnel with 

contingency planning responsibilities an agencylevel contingency planning policy that: 

 Addresses purpose, scope, roles, 

responsibilities, management commitment, 

coordination among organizational 

entities, and compliance? 

 Is consistent with applicable laws, 

executive orders, directives, regulations, 

policies, standards, and guidelines? 

____ 

____ 

____ 

____ 

____ 

____ 

CP-1, a.1.(a) 

CP-1, a.1.(b) 

2. Does the Tribe or TGRA have procedures to 

facilitate the implementation of the contingency 

planning policy and the associated contingency 

planning controls? ____ ____ ____ CP-1, a.2 

3. Has the Tribe or TGRA designated organizational 

personnel with information security 

responsibilities to manage the development, 

documentation, and dissemination of the 

contingency planning policy and procedures? ____ ____ ____ CP-1, b 

4. Based on inquiry and record examination, does 

the Tribe or TGRA review and update the current 

contingency planning: 

 Policy annually and following any security 

incidents involving unauthorized access to 

Criminal Justice Information (CJI) / 

Criminal History Record Information 

(CHRI) or systems used to process, store, 

or transmit CJI / CHRI, or training 

simulations or exercises? 

 Procedures annually and following any 

security incidents involving unauthorized 

access to CJI / CHRI or systems used to 

process, store, or transmit CJI / CHRI, or 

training simulations or exercises? 

____ 

____ 

____ 

____ 

____ 

____ 

CP-1, c.1 

CP-1, c.2 

 

1

 These requirements are sanctionable for audit beginning October 1, 2024. 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 18 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 2 of 7 

5. Based on inquiry and record examination, has the 

Tribe or TGRA developed a contingency plan for 

the system that: 

 Identifies essential mission and business 

functions and associated contingency 

requirements? 

 Provides recovery objectives, restoration 

priorities, and metrics? 

 Addresses contingency roles, 

responsibilities, assigned individuals with 

contact information? 

 Addresses maintaining essential mission 

and business functions despite a system 

disruption, compromise, or failure? 

 Addresses eventual, full system restoration 

without deterioration of the controls 

originally planned and implemented? 

 Addresses the sharing of contingency 

information? 

 Is reviewed and approved by agency head 

or their designee? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CP-2, a.1 

CP-2, a.2 

CP-2, a.3 

CP-2, a.4 

CP-2, a.5 

CP-2, a.6 

CP-2, a.7 

6. Based on inquiry and record examination, does 

the Tribe or TGRA distribute copies of the 

contingency plan to organizational personnel with 

contingency planning or incident response duties? ____ ____ ____ CP-2, b 

7. Based on inquiry and record examination, does 

the Tribe or TGRA coordinate contingency 

planning activities with incident handling 

activities? ____ ____ ____ CP-2, c 

8. Based on inquiry and record examination, does 

the Tribe or TGRA review the contingency plan 

for the system annually? ____ ____ ____ CP-2, d 

9. Based on inquiry and record examination, does 

the Tribe or TGRA update the contingency plan to 

address changes to the organization, system, or 

environment of operation and problems 

encountered during contingency plan 

implementation, execution, or testing? ____ ____ ____ CP-2, e 

 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 18 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 3 of 7 

10. Based on inquiry and record examination, does 

the Tribe or TGRA communicate contingency 

plan changes to organizational personnel with 

contingency planning or incident response duties? ____ ____ ____ CP-2, f 

11. Based on inquiry and record examination, does 

the Tribe or TGRA incorporate lessons learned 

from contingency plan testing, training, or actual 

contingency activities into contingency testing and 

training? ____ ____ ____ CP-2, g 

12. Based on inquiry and record examination, does 

the Tribe or TGRA protect the contingency plan 

from unauthorized disclosure and modification? ____ ____ ____ CP-2, h 

13. Based on inquiry and record examination, does 

the Tribe or TGRA coordinate contingency plan 

development with organizational elements 

responsible for related plans2

? ____ ____ ____ CP-2, (1) 

14. Based on inquiry and record examination, does 

the Tribe or TGRA plan for the resumption of 

essential mission and business functions within 

twenty-four (24) hours of contingency plan 

activation? ____ ____ ____ CP-2, (3) 

15. Based on inquiry and record examination, does 

the Tribe or TGRA identify critical system assets 

supporting essential mission and business 

functions? ____ ____ ____ CP-2, (8) 

16. Based on inquiry and record examination, does 

the Tribe or TGRA provide contingency training 

to system users consistent with assigned roles and 

responsibilities: 

 Within thirty (30) days of assuming a 

contingency role or responsibility? 

 When required by system changes? 

 Annually thereafter? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CP-3, a.1 

CP-3, a.2 

CP-3, a.3 

 

2

 Plans that are related to contingency plans include Business Continuity Plans, Disaster Recovery Plans, Critical 

Infrastructure Plans, Continuity of Operations Plans, Crisis Communications Plans, Insider Threat Implementation 

Plans, Data Breach Response Plans, Cyber Incident Response Plans, Breach Response Plans, and Occupant 

Emergency Plans. 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 18 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 4 of 7 

17. Based on inquiry and record examination, does 

the Tribe or TGRA review and update 

contingency training content annually and 

following any security incidents involving 

unauthorized access to CJI / CHRI or systems 

used to process, store, or transmit CJI / CHRI, or 

training simulations or exercises? ____ ____ ____ CP-3, b 

18. Based on inquiry and record examination, does 

the Tribe or TGRA: 

 Test the contingency plan for the system 

annually using the following tests to 

determine the effectiveness of the plan 

and the readiness to execute the plan: 

checklists, walk-through and tabletop 

exercises, simulations (parallel or full 

interrupt), or comprehensive exercises? 

 Review the contingency plan test results? 

 Initiate corrective actions, if needed? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CP-4, a 

CP-4, b 

CP-4, c 

19. Based on inquiry and record examination, does 

the Tribe or TGRA coordinate contingency plan 

testing with organizational elements responsible 

for related plans3? ____ ____ ____ CP-4, (1) 

20. Based on inquiry and record examination, has the 

Tribe or TGRA established an alternate storage 

site, including necessary agreements4 to permit the 

storage and retrieval of system backup 

information? ____ ____ ____ CP-6, a 

21. Based on inquiry and record examination, does 

the Tribe or TGRA ensure that the alternate 

storage site provides controls equivalent to that of 

the primary site? ____ ____ ____ CP-6, b 

22. Based on inquiry and record examination, has the 

Tribe or TGRA identified an alternate storage site 

that is sufficiently separated from the primary 

storage site to reduce susceptibility to the same 

threats? ____ ____ ____ CP-6, (1) 

3

 Id. 

4

 Items covered by alternate storage site agreements include environmental conditions at the alternate sites, access 

rules for systems and facilities, physical and environmental protection requirements, and coordination of delivery 

and retrieval of backup media. 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 18 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 5 of 7 

23. Based on inquiry and record examination, does 

the Tribe or TGRA identify potential accessibility 

problems to the alternate storage site in the event 

of an area-wide disruption or disaster and outline 

explicit mitigation actions5? ____ ____ ____ CP-6, (3) 

24. Based on inquiry and record examination, has the 

Tribe or TGRA established an alternate 

processing site, including necessary agreements to 

permit the transfer and resumption of operations 

for essential mission and business functions 

within the time period defined in the system 

contingency plan(s) when the primary processing 

capabilities are unavailable? ____ ____ ____ CP-7, a 

25. Based on inquiry and record examination, does 

the Tribe or TGRA make available at the alternate 

processing site, the equipment and supplies 

required to transfer and resume operations or put 

contracts in place to support delivery to the site 

within the organization-defined time period for 

transfer and resumption? ____ ____ ____ CP-7, b 

26. Based on inquiry and record examination, does 

the Tribe or TGRA provide controls at the 

alternate processing site that are equivalent to 

those at the primary site? ____ ____ ____ CP-7, c 

27. Based on inquiry and record examination, has the 

Tribe or TGRA identified an alternate processing 

site that is sufficiently separated from the primary 

processing site to reduce susceptibility to the same 

threats? ____ ____ ____ CP-7, (1) 

28. Based on inquiry and record examination, does 

the Tribe or TGRA identify potential accessibility 

problems to alternate processing sites in the event 

of an area-wide disruption or disaster and outlines 

explicit mitigation actions? ____ ____ ____ CP-7, (2) 

 

5

 Explicit mitigation actions include duplicating backup information at other alternate storage sites if access 

problems occur at originally designated alternate sites or planning for physical access to retrieve backup information 

if electronic accessibility to the alternate site is disrupted. 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 18 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 6 of 7 

29. Based on inquiry and record examination, has the 

Tribe or TGRA developed alternate processing 

site agreements that contain priority-of-service 

provisions6

 in accordance with availability 

requirements (including recovery time 

objectives)? ____ ____ ____ CP-7, (3) 

30. Based on inquiry and record examination, has the 

Tribe or TGRA established alternate 

telecommunications services, including necessary 

agreements to permit the resumption of system 

operations for essential mission and business 

functions within the time period as defined in the 

system contingency plan(s) when the primary 

telecommunications capabilities are unavailable at 

either the primary or alternate processing or 

storage sites? ____ ____ ____ CP-8 

31. Based on inquiry and record examination, has the 

Tribe or TGRA: 

 Developed primary and alternate 

telecommunications service agreements 

that contain priority-of-service provisions 

in accordance with availability 

requirements (including recovery time 

objectives)? 

 Requested Telecommunications Service 

Priority for all telecommunications 

services used for national security 

emergency preparedness if the primary 

and/or alternate telecommunications 

services are provided by a common 

carrier? 

____ 

____ 

____ 

____ 

____ 

____ 

CP-8, (1) a 

CP-8, (1) b 

32. Based on inquiry and record examination, has the 

Tribe or TGRA Obtain alternate 

telecommunications services to reduce the 

likelihood of sharing a single point of failure with 

primary telecommunications services? ____ ____ ____ CP-8, (2) 

 

6

 Priority of service agreements refer to negotiated agreements with service providers that ensure that organizations 

receive priority treatment consistent with their availability requirements and the availability of information resources 

for logical alternate processing and/or at the physical alternate processing site. 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 18 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 7 of 7 

30. Based on inquiry and record examination, does 

the Tribe or TGRA conduct backups of user-level 

information7 contained in operational systems for 

essential business functions as required by the 

contingency plans? ____ ____ ____ CP-9, a 

31. Based on inquiry and record examination, does 

the Tribe or TGRA conduct backups of systemlevel information8

 contained in the system as 

required by the contingency plans? ____ ____ ____ CP-9, b 

32. Based on inquiry and record examination, does 

the Tribe or TGRA conduct backups of system 

documentation, including security- and privacyrelated documentation as required by the 

contingency plans? ____ ____ ____ CP-9, c 

33. Based on inquiry and record examination, does 

the Tribe or TGRA protect the confidentiality, 

integrity, and availability of backup information? ____ ____ ____ CP-9, d 

34. Based on inquiry and record examination, does 

the Tribe or TGRA test backup information as 

required by the contingency plans to verify media 

reliability and information integrity? ____ ____ ____ CP-9, (1) 

35. Based on inquiry and record examination, does 

the Tribe or TGRA implement cryptographic 

mechanisms to prevent unauthorized disclosure 

and modification of CJI / CHRI? ____ ____ ____ CP-9, (8) 

36. Based on inquiry and record examination, does 

the Tribe or TGRA provide for the recovery and 

reconstitution of the system to a known state 

within the timeframe as required by the 

contingency plans after a disruption, compromise, 

or failure? ____ ____ ____ CP-10 

37. Based on inquiry and record examination, does 

the Tribe or TGRA implement transaction 

recovery for systems that are transaction-based9

? ____ ____ ____ CP-10, (2) 

7

 User-level information includes information other than system-level information. 8

 System-level information includes system state information, operating system software, middleware, application 

software, and licenses. 

9

 Transaction-based systems include database management systems and transaction processing systems. 

Mechanisms supporting transaction recovery include transaction rollback and transaction journaling.