{"data":{"id":"CP-08","name":"Telecommunications Services","family":"CP","family_name":"Contingency Planning","withdrawn":false,"description":"Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.","supplemental_guidance":"Telecommunications services (for data and voice) for primary and alternate processing and storage sites are in scope for CP-08. Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential mission and business functions despite the loss of primary telecommunications services. Organizations may specify different time periods for primary or alternate sites. Alternate telecommunications services include additional organizational or commercial ground-based circuits or lines, network-based approaches to telecommunications, or the use of satellites. Organizations consider factors such as availability, quality of service, and access when entering into alternate telecommunications agreements.","enhancements":[{"id":"CP-08(01)","name":"Priority of Service Provisions","statement":"a. Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and\nb. Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.","baselines":["moderate","high"]},{"id":"CP-08(02)","name":"Single Points of Failure","statement":"Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.","baselines":["moderate","high"]},{"id":"CP-08(03)","name":"Separation of Primary and Alternate Providers","statement":"Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.","baselines":["high"]},{"id":"CP-08(04)","name":"Provider Contingency Plan","statement":"a. Require primary and alternate telecommunications service providers to have contingency plans;\nb. Review provider contingency plans to ensure that the plans meet organizational contingency requirements; and\nc. Obtain evidence of contingency testing and training by providers [Assignment: organization-defined frequency].","baselines":["high"]},{"id":"CP-08(05)","name":"Alternate Telecommunication Service Testing","statement":"Test alternate telecommunication services [Assignment: organization-defined frequency].","baselines":[]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CP-08","name":"Telecommunications Services","description":"Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.","discussion":"Telecommunications services (for data and voice) for primary and alternate processing and storage sites are in scope for CP-08. Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential mission and business functions despite the loss of primary telecommunications services. Organizations may specify different time periods for primary or alternate sites. Alternate telecommunications services include additional organizational or commercial ground-based circuits or lines, network-based approaches to telecommunications, or the use of satellites. Organizations consider factors such as availability, quality of service, and access when entering into alternate telecommunications agreements.","related_controls":["CP-02","CP-06","CP-07","CP-11","SC-07"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.5.29","A.5.30","A.7.11","A.8.14"],"iso_27002_2022":["5.29","5.30","8.14"],"cobit_2019":["BAI04","DSS04"],"pci_dss_v4":[],"nist_csf_2":["PR.IR-03","PR.IR-04"],"cis_controls_v8":[],"soc2_tsc":["A1.2"],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":["Art. 21(2)(c)","Art. 21(2)(j)"],"apra_cps_234":[],"mas_trm":["8"],"pra_op_resilience":[],"bsi_grundschutz":["DER.4"],"anssi":["Hygiene.30","SecNumCloud.18.3"],"osfi_b13":["B-13.2.6"],"finma_circular":["IV.A(28)","IV.E(89)","IV.E(90)"],"gdpr":["Art.32(1)(b)","Art.32(1)(c)"],"dora":["Art.11(3)","Art.12(2)"],"bio2":["5.29","5.30","8.14"],"rbi_csf":["ITGRCA.29"],"fisc":["FISC.F5","FISC.O5"],"lgpd_bcb":[],"hkma_tme1":["TME1.6.2","TME1.6.4"],"mlps_2":["8.1.2.1"],"dnb_good_practice":["DNB.11.1","DNB.18.1"],"cra":[],"swift_cscf":[],"cbb_tm":["TM-14"],"cbuae":["CR-13"],"nca_ecc":["3-1"],"qatar_nia":["BC"],"uae_ia":["T12"],"bog_cisd":["CISD-BCM"],"bom_ctrm":["5.2"],"cbe_csf":["OVM-2"],"cbn_csf":["Part3.7"],"sa_js2":["JS2-7.5"],"bcbs_239":["Principle 2","Principle 5"],"bot_cyber":["Ch4.2"],"cpmi_pfmi":["CG.RR","PFMI.P17"],"eba_ict":["3.7.2"],"ecb_croe":["CROE.2.5.2"],"hipaa_sr":["§164.308(a)(7)(i)","§164.308(a)(7)(ii)(B)"],"iosco_cyber":["PFMI-17","RR-2"],"sebi_cscrf":["BCP-DR","RC.RP"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":["SYSC 13.8.1","SYSC 13.8.2"],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":["12.b"],"iso_27799":["17.2","17.3"],"lloyds_ms":["MS8.6"],"naic_ds":[],"nhs_dspt":["NDG-7.1","NDG-7.2"],"pra_ss1_23":[],"solvency_ii":["DR.266-BCP","EIOPA-ICT-4.10"],"owasp_masvs_v2":[],"csa_ccm_v4":["BCR-03","BCR-07","BCR-11"],"csa_aicm":["BCR-03","BCR-07","BCR-11"],"ccss_v9":[],"mica":[],"basel_sco60":["SCO60.53"],"bssc":["NOS-07"],"sec_custody_digital":["SEC-CD-12"],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: iso_27001_2022 A.5.29, A.7.11 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 PR.IR-04 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"corrective","used_by_patterns":["SP-034","SP-036"]}}