FedRAMP Moderate Compliance Checklist for: (CP) Contingency Planning Control Family

The Contingency Planning family ensures organizations can maintain or quickly resume critical mission and business operations during and after a disruption, compromise, or failure of their information systems. These controls establish comprehensive planning, testing, and implementation of backup strategies, alternate sites, telecommunications services, and recovery procedures to minimize operational downtime and data loss. The family emphasizes proactive preparation through documented plans, regular training and testing, and establishing redundant infrastructure to support business continuity and disaster recovery objectives aligned with the organization's risk tolerance and operational requirements.

Security controls are written in a way that's unnecessarily complex and difficult to understand. We took the time to simplify the FedRAMP Moderate security controls so you don't have to. Here's a straightforward list of everything you need to do to implement the CP family:

Policy and Documentation

• CP-01: Develop, document, and disseminate contingency planning policy at organization-level, mission/business process-level, or system-level that addresses purpose, scope, roles, responsibilities, management commitment, coordination, and compliance
• CP-01: Ensure contingency planning policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines
• CP-01: Develop and document procedures to facilitate implementation of contingency planning policy and associated controls
• CP-01: Designate an official to manage development, documentation, and dissemination of contingency planning policy and procedures
• CP-01: Review and update contingency planning policy at least every 3 years and following significant changes
• CP-01: Review and update contingency planning procedures at least annually and following significant changes

Contingency Plan Development and Maintenance

• CP-02: Develop a contingency plan that identifies essential mission and business functions and associated contingency requirements
• CP-02: Include recovery objectives, restoration priorities, and metrics in the contingency plan
• CP-02: Document contingency roles, responsibilities, and assigned individuals with contact information
• CP-02: Address maintaining essential mission and business functions despite system disruption, compromise, or failure
• CP-02: Address eventual full system restoration without deterioration of originally planned controls
• CP-02: Address sharing of contingency information in the plan
• CP-02: Obtain review and approval of contingency plan from organization-defined personnel or roles
• CP-02: Distribute copies of contingency plan to key contingency personnel and organizational elements
• CP-02: Coordinate contingency planning activities with incident handling activities
• CP-02: Review the contingency plan for the system at least annually
• CP-02: Update contingency plan to address organizational, system, or environmental changes
• CP-02: Update contingency plan based on problems encountered during implementation, execution, or testing
• CP-02: Communicate contingency plan changes to key contingency personnel and organizational elements
• CP-02: Incorporate lessons learned from testing, training, or actual contingency activities
• CP-02: Protect contingency plan from unauthorized disclosure and modification
• CP-02(01): Coordinate contingency plan development with organizational elements responsible for related plans
• CP-02(03): Plan for resumption of all mission and business functions within time period defined in service provider and organization SLA
• CP-02(08): Identify critical system assets supporting all or essential mission and business functions

Contingency Training

• CP-03: Provide contingency training to system users consistent with assigned roles and responsibilities within ten (10) days of assuming a contingency role
• CP-03: Provide contingency training when required by system changes
• CP-03: Provide contingency training at least annually after initial training
• CP-03: Review and update contingency training content at least annually
• CP-03: Update contingency training content following organization-defined events

Contingency Plan Testing

• CP-04: Test the contingency plan at least annually using functional exercises
• CP-04: Determine effectiveness of the plan through testing
• CP-04: Determine readiness to execute the plan through testing
• CP-04: Review contingency plan test results
• CP-04: Initiate corrective actions based on test results when needed
• CP-04(01): Coordinate contingency plan testing with organizational elements responsible for related plans

Alternate Storage Site

• CP-06: Establish an alternate storage site with necessary agreements for storage and retrieval of system backup information
• CP-06: Ensure alternate storage site provides controls equivalent to the primary site
• CP-06(01): Identify an alternate storage site sufficiently separated from primary site to reduce susceptibility to same threats
• CP-06(03): Identify potential accessibility problems to alternate storage site during area-wide disruption or disaster
• CP-06(03): Outline explicit mitigation actions for alternate storage site accessibility problems

Alternate Processing Site

• CP-07: Establish an alternate processing site with necessary agreements for transfer and resumption of system operations
• CP-07: Ensure alternate processing site supports essential mission and business functions within defined time period when primary processing is unavailable
• CP-07: Make available required equipment and supplies at alternate processing site or establish contracts for delivery
• CP-07: Provide controls at alternate processing site equivalent to primary site
• CP-07(01): Identify an alternate processing site sufficiently separated from primary site to reduce susceptibility to same threats
• CP-07(02): Identify potential accessibility problems to alternate processing site during area-wide disruption or disaster
• CP-07(02): Outline explicit mitigation actions for alternate processing site accessibility problems
• CP-07(03): Develop alternate processing site agreements with priority-of-service provisions in accordance with availability requirements and recovery time objectives

Telecommunications Services

• CP-08: Establish alternate telecommunications services with necessary agreements for resumption of system operations
• CP-08: Ensure alternate telecommunications services support essential mission and business functions when primary capabilities are unavailable
• CP-08(01): Develop primary and alternate telecommunications service agreements with priority-of-service provisions
• CP-08(01): Request Telecommunications Service Priority for all services used for national security emergency preparedness if provided by common carrier
• CP-08(02): Obtain alternate telecommunications services to reduce likelihood of sharing single point of failure with primary services

System Backup

• CP-09: Conduct daily incremental and weekly full backups of user-level information in organization-defined system components
• CP-09: Conduct daily incremental and weekly full backups of system-level information
• CP-09: Conduct daily incremental and weekly full backups of system documentation, including security- and privacy-related documentation
• CP-09: Ensure all backup frequencies are consistent with recovery time and recovery point objectives
• CP-09: Protect confidentiality, integrity, and availability of backup information
• CP-09(01): Test backup information at least annually to verify media reliability and information integrity
• CP-09(08): Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all backup files

System Recovery and Reconstitution

• CP-10: Provide for recovery and reconstitution of the system to a known state within organization-defined time period after disruption, compromise, or failure
• CP-10: Ensure recovery time period is consistent with recovery time and recovery point objectives
• CP-10(02): Implement transaction recovery for systems that are transaction-based