CP-7 : ALTERNATE PROCESSING SITE

FAMILY: Contingency Planning

CLASS: Operational

CP-7 : ALTERNATE PROCESSING SITE

The organization:

a. Establishes an alternate processing site including necessary agreements to permit the resumption of information system operations for essential missions and business functions within [Assignment: organization-defined time period consistent with recovery time objectives] when the primary processing capabilities are unavailable; and

b. Ensures that equipment and supplies required to resume operations are available at the alternate site or contracts are in place to support delivery to the site in time to support the organization-defined time period for resumption.

Related control: CP-2.

Control Enhancements:

(1) The organization identifies an alternate processing site that is separated from the primary processing site so as not to be susceptible to the same hazards.

Enhancement Supplemental Guidance: Hazards that might affect the information system are typically defined in the risk assessment.

(2) The organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.

(3) The organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with the organization's availability requirements.

(4) The organization configures the alternate processing site so that it is ready to be used as the operational site supporting essential missions and business functions.

(5) The organization ensures that the alternate processing site provides information security measures equivalent to that of the primary site

References: NIST Special Publication 800-34.

Priority and Baseline Allocation:

P1

LOW CP-7 Not Selected

MOD CP-7 (1) (2) (3) (5)

HIGH CP-7 (1) (2) (3) (4) (5)