{"data":{"id":"CP-05","name":"Contingency Plan Update","family":"CP","family_name":"Contingency Planning","withdrawn":true,"incorporated_into":["CP-02"],"description":"The organization reviews the contingency plan for the information system [Assignment: organization-defined frequency, at least annually] and revises the plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing.","supplemental_guidance":"Organizational changes include changes in mission, functions, or business processes supported by the information system. The organization communicates changes to appropriate organizational elements responsible for related plans (e.g., Business Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, Business Recovery Plan, Incident Response Plan, Emergency Action Plan).","enhancements":[],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"CP-05","name":"Contingency Plan Update","description":"","discussion":"","related_controls":[],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":[],"iso_27002_2022":["5.29"],"cobit_2019":["DSS04"],"pci_dss_v4":[],"nist_csf_2":[],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":["8"],"pra_op_resilience":[],"bsi_grundschutz":["DER.4"],"anssi":["Hygiene.35","Hygiene.36","SecNumCloud.18.1"],"osfi_b13":["B-13.2.6"],"finma_circular":["IV.E(87)","IV.F(98)","IV.F(99)"],"gdpr":["Art.32(1)(c)","Art.32(1)(d)"],"dora":["Art.11(6)"],"bio2":["5.29"],"rbi_csf":[],"fisc":["FISC.O5"],"lgpd_bcb":[],"hkma_tme1":["TME1.6.3"],"mlps_2":[],"dnb_good_practice":[],"cra":[],"swift_cscf":[],"cbb_tm":["TM-14"],"qatar_nia":["BC"],"eba_ict":["3.7.4"],"sebi_cscrf":["BCP-DR"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":["SYSC 13.8.1"],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":["17.1"],"lloyds_ms":[],"naic_ds":[],"nhs_dspt":[],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-02: recorded as withdrawn in SP 800-53 Rev 5, incorporated into CP-02, from NIST's Rev 5.2.0 catalogue. 2026-10-03: baselines LMH to ---, withdrawn in Rev 5 and in no baseline of NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"corrective","used_by_patterns":["SP-001","SP-002"]}}