# CP-07 Alternate Processing Site

NIST SP 800-53 control. Family: CP Contingency Planning. Function: corrective. Baselines: moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable; b. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and c. Provide controls at the alternate processing site that are equivalent to those at the primary site.
Guidance: Alternate processing sites are geographically distinct from primary processing sites and provide processing capability if the primary processing site is not available. The alternate processing capability may be addressed using a physical processing site or other alternatives, such as failover to a cloud-based service provider or other internally or externally provided processing service. Geographically distributed architectures that support contingency requirements may also be considered alternate processing sites. Controls that are covered by alternate processing site agreements include the environmental conditions at alternate sites, access rules, physical and environmental protection requirements, and the coordination for the transfer and assignment of personnel. Requirements are allocated to alternate processing sites that reflect the requirements in contingency plans to maintain essential mission and business functions despite disruption, compromise, or failure in organizational systems.

## Enhancements (5)
- CP-07(01) Separation from Primary Site. Baselines: moderate, high
- CP-07(02) Accessibility. Baselines: moderate, high
- CP-07(03) Priority of Service. Baselines: moderate, high
- CP-07(04) Preparation for Use. Baselines: high
- CP-07(06) Inability to Return to Primary Site
Withdrawn by NIST: CP-07(05) (now in CP-07).
Each enhancement's statement: /api/v1/controls/CP-07?fields=enhancements

## Patterns that use it (3)
- Critical (2): SP-034 Cyber Resilience; SP-054 CBDC and Digital Currency Infrastructure (draft)
- Standard (1): SP-008 Public Web Server Pattern

## Clauses by framework (58 frameworks)
- iso_27001_2022: A.5.29, A.5.30, A.7.5, A.8.14. OSA's own, not in NIST's crosswalk: A.5.30
- iso_27002_2022: 5.29, 5.30, 8.14
- cobit_2019: BAI04, DSS04
- nist_csf_2: PR.IR-03, PR.IR-04. OSA's own, not in NIST's crosswalk: PR.IR-03
- soc2_tsc: A1.2
- iso_42001_2023: A.4.5
- nis2: Art. 21(2)(c)
- mas_trm: 8
- pra_op_resilience: SS1/21-5.3, SS2/21-10.1
- bsi_grundschutz: DER.4
- anssi: Hygiene.30, SecNumCloud.18.3
- osfi_b13: B-13.2.6
- finma_circular: IV.E(89), IV.E(90), IV.E(91)
- gdpr: Art.32(1)(c)
- dora: Art.11(3), Art.12(2), Art.12(5)
- bio2: 5.29, 5.30, 8.14
- rbi_csf: ITGRCA.29
- fisc: FISC.F5, FISC.O5
- lgpd_bcb: BCB.Art.3
- hkma_tme1: TME1.6.2, TME1.6.4
- mlps_2: 8.1.4.9
- dnb_good_practice: DNB.11.1, DNB.18.1
- cra: CRA.I.2h
- cbb_tm: TM-14
- cbuae: CR-13
- nca_ecc: 3-1, 3-2
- qatar_nia: BC
- uae_ia: T12
- bog_cisd: CISD-BCM, CISD-XII
- bom_ctrm: 5.2
- cbe_csf: OVM-2
- cbn_csf: Part3.7
- sa_js2: JS2-7.5
- bcbs_239: Principle 2, Principle 5
- bot_cyber: Ch4.2
- cpmi_pfmi: CG.RR, PFMI.P17
- eba_ict: 3.7.2
- ecb_croe: CROE.2.5.2
- hipaa_sr: §164.308(a)(7)(i), §164.308(a)(7)(ii)(B), §164.310(a)(2)(i)
- iosco_cyber: PFMI-17, RR-2
- nydfs_500: 500.16
- sebi_cscrf: BCP-DR, RC.RP
- api_1164: Sec 11
- fca_sysc_13: SYSC 13.8.1, SYSC 13.8.2
- hitrust_csf: 12.b
- iso_27799: 17.2, 17.3
- lloyds_ms: MS8.6
- naic_ds: 4F-b
- nhs_dspt: NDG-7.1, NDG-7.2
- pra_ss1_23: P-IT.3
- solvency_ii: DR.266-BCP, EIOPA-ICT-4.10
- csa_ccm_v4: BCR-03, BCR-11
- csa_aicm: BCR-03, BCR-11
- mica: Art.62(5), Art.62(6), Art.68(5)
- basel_sco60: SCO60.53, SCO60.65
- bssc: NOS-07
- sec_custody_digital: SEC-CD-12
- dpdpa: Rules.6(1)(d)
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/CP-07
- Clauses only: /api/v1/controls/CP-07?fields=mappings
- Page for people: /controls/cp-07/