CP-04 Contingency Plan Testing
Contingency Planning
Description
a. Test the contingency plan for the system [Assignment: organization-defined frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [Assignment: organization-defined tests]. b. Review the contingency plan test results; and c. Initiate corrective actions, if needed.
Supplemental Guidance
Methods for testing contingency plans to determine the effectiveness of the plans and identify potential weaknesses include checklists, walk-through and tabletop exercises, simulations (parallel or full interrupt), and comprehensive exercises. Organizations conduct testing based on the requirements in contingency plans and include a determination of the effects on organizational operations, assets, and individuals due to contingency operations. Organizations have flexibility and discretion in the breadth, depth, and timelines of corrective actions.
Enhancements (5)
What NIST adds to this control. Select one to read its statement.
CP-04(01) Coordinate with Related Plans ModerateHigh
Coordinate contingency plan testing with organizational elements responsible for related plans.
CP-04(02) Alternate Processing Site High
Test the contingency plan at the alternate processing site: a. To familiarize contingency personnel with the facility and available resources; and b. To evaluate the capabilities of the alternate processing site to support contingency operations.
CP-04(03) Automated Testing
Test the contingency plan using [Assignment: organization-defined automated mechanisms].
CP-04(04) Full Recovery and Reconstitution
Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing.
CP-04(05) Self-challenge
Employ [Assignment: organization-defined mechanisms] to [Assignment: organization-defined system or system component] to disrupt and adversely affect the system or system component.
Patterns that use this control (3)
Grouped by the emphasis each pattern gives it.