# CP-08 Telecommunications Services

NIST SP 800-53 control. Family: CP Contingency Planning. Function: corrective. Baselines: moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
Guidance: Telecommunications services (for data and voice) for primary and alternate processing and storage sites are in scope for CP-08. Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential mission and business functions despite the loss of primary telecommunications services. Organizations may specify different time periods for primary or alternate sites. Alternate telecommunications services include additional organizational or commercial ground-based circuits or lines, network-based approaches to telecommunications, or the use of satellites. Organizations consider factors such as availability, quality of service, and access when entering into alternate telecommunications agreements.

## Enhancements (5)
- CP-08(01) Priority of Service Provisions. Baselines: moderate, high
- CP-08(02) Single Points of Failure. Baselines: moderate, high
- CP-08(03) Separation of Primary and Alternate Providers. Baselines: high
- CP-08(04) Provider Contingency Plan. Baselines: high
- CP-08(05) Alternate Telecommunication Service Testing
Each enhancement's statement: /api/v1/controls/CP-08?fields=enhancements

## Patterns that use it (2)
- Important (1): SP-034 Cyber Resilience
- Standard (1): SP-036 Incident Response

## Clauses by framework (48 frameworks)
- iso_27001_2022: A.5.29, A.5.30, A.7.11, A.8.14. OSA's own, not in NIST's crosswalk: A.5.30, A.8.14
- iso_27002_2022: 5.29, 5.30, 8.14
- cobit_2019: BAI04, DSS04
- nist_csf_2: PR.IR-03, PR.IR-04. OSA's own, not in NIST's crosswalk: PR.IR-03
- soc2_tsc: A1.2
- nis2: Art. 21(2)(c), Art. 21(2)(j)
- mas_trm: 8
- bsi_grundschutz: DER.4
- anssi: Hygiene.30, SecNumCloud.18.3
- osfi_b13: B-13.2.6
- finma_circular: IV.A(28), IV.E(89), IV.E(90)
- gdpr: Art.32(1)(b), Art.32(1)(c)
- dora: Art.11(3), Art.12(2)
- bio2: 5.29, 5.30, 8.14
- rbi_csf: ITGRCA.29
- fisc: FISC.F5, FISC.O5
- hkma_tme1: TME1.6.2, TME1.6.4
- mlps_2: 8.1.2.1
- dnb_good_practice: DNB.11.1, DNB.18.1
- cbb_tm: TM-14
- cbuae: CR-13
- nca_ecc: 3-1
- qatar_nia: BC
- uae_ia: T12
- bog_cisd: CISD-BCM
- bom_ctrm: 5.2
- cbe_csf: OVM-2
- cbn_csf: Part3.7
- sa_js2: JS2-7.5
- bcbs_239: Principle 2, Principle 5
- bot_cyber: Ch4.2
- cpmi_pfmi: CG.RR, PFMI.P17
- eba_ict: 3.7.2
- ecb_croe: CROE.2.5.2
- hipaa_sr: §164.308(a)(7)(i), §164.308(a)(7)(ii)(B)
- iosco_cyber: PFMI-17, RR-2
- sebi_cscrf: BCP-DR, RC.RP
- fca_sysc_13: SYSC 13.8.1, SYSC 13.8.2
- hitrust_csf: 12.b
- iso_27799: 17.2, 17.3
- lloyds_ms: MS8.6
- nhs_dspt: NDG-7.1, NDG-7.2
- solvency_ii: DR.266-BCP, EIOPA-ICT-4.10
- csa_ccm_v4: BCR-03, BCR-07, BCR-11
- csa_aicm: BCR-03, BCR-07, BCR-11
- basel_sco60: SCO60.53
- bssc: NOS-07
- sec_custody_digital: SEC-CD-12
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/CP-08
- Clauses only: /api/v1/controls/CP-08?fields=mappings
- Page for people: /controls/cp-08/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.