[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fcp-2":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","cp-2","CP-2","Contingency Plan",21,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must develop a contingency plan that identifies essential functions, recovery objectives, priorities and metrics, assigns roles and contact information, addresses maintaining essential functions during disruption and full restoration, is reviewed and approved, distributed, coordinated, updated and protected.\n\n**In practice.** Good practice links the plan to a business impact analysis, defines recovery time and recovery point objectives for critical services and documents dependencies on suppliers and infrastructure. Plans should be tested and updated after tests and real events. Auditors expect the plan, impact analysis, test reports and review history. ISO 22301 and the DORA resilience requirements address the same area.\n\n**Common gaps.** Plans are often IT-only and ignore business processes, people and suppliers. Recovery objectives are frequently set without checking that the technology can achieve them.","a. Develop a contingency plan for the system that:\n    1. Identifies essential mission and business functions and associated contingency requirements;\n    2. Provides recovery objectives, restoration priorities, and metrics;\n    3. Addresses contingency roles, responsibilities, assigned individuals with contact information;\n    4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;\n    5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;\n    6. Addresses the sharing of contingency information; and\n    7. Is reviewed and approved by [Assignment: organization-defined organization-defined personnel or roles];\n  b. Distribute copies of the contingency plan to [Assignment: organization-defined organization-defined key contingency personnel (identified by name and\u002For by role) and organizational elements];\n  c. Coordinate contingency planning activities with incident handling activities;\n  d. Review the contingency plan for the system [Assignment: organization-defined frequency];\n  e. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;\n  f. Communicate contingency plan changes to [Assignment: organization-defined organization-defined key contingency personnel (identified by name and\u002For by role) and organizational elements];\n  g. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and\n  h. Protect the contingency plan from unauthorized disclosure and modification.\nDiscussion: Contingency planning for systems is part of an overall program for achieving continuity of operations for organizational mission and business functions. Contingency planning addresses system restoration and implementation of alternative mission or business processes when systems are compromised or breached. Contingency planning is considered throughout the system development life cycle and is a fundamental part of the system design. Systems can be designed for redundancy, to provide backup capabilities, and for resilience. Contingency plans reflect the degree of restoration required for organizational systems since not all systems need to fully recover to achieve the level of continuity of operations desired. System recovery objectives reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, organizational risk tolerance, and system impact level.\n\nActions addressed in contingency plans include orderly system degradation, system shutdown, fallback to a manual mode, alternate information flows, and operating in modes reserved for when systems are under attack. By coordinating contingency planning with incident handling activities, organizations ensure that the necessary planning activities are in place and activated in the event of an incident. Organizations consider whether continuity of operations during an incident conflicts with the capability to automatically disable the system, as specified in [IR-4(5)](#ir-4.5) . Incident response planning is part of contingency planning for organizations and is addressed in the [IR](#ir) (Incident Response) family.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"bae-systems-breach-cripples-us-bankruptcy-court-noticing-system","BAE Systems Breach Cripples US Bankruptcy Court Noticing System","2026-10-16T16:20:16.497+00:00",{"slug":25,"title":26,"published_at":27},"bae-systems-contractor-incident-cripples-us-bankruptcy-court-notifications","BAE Systems Contractor Incident Cripples US Bankruptcy Court Notifications","2026-10-16T12:20:16.174+00:00",{"slug":29,"title":30,"published_at":31},"bae-systems-breach-disrupts-federal-court-infrastructure-via-supply-chain-attack","BAE Systems Breach Disrupts Federal Court Infrastructure via Supply Chain Attack","2026-10-16T08:20:29.888+00:00",{"slug":33,"title":34,"published_at":35},"russias-hybrid-cyber-physical-attacks-target-european-nations-supporting-ukraine","Russia's Hybrid Cyber-Physical Attacks Target European Nations Supporting Ukraine","2026-09-25T08:20:21.965+00:00",{"slug":37,"title":38,"published_at":39},"us-mexico-joint-operation-targets-criminal-drone-use-at-border","US-Mexico Joint Operation Targets Criminal Drone Use at Border","2026-09-11T10:20:31.966+00:00",{"slug":41,"title":42,"published_at":43},"exchange-online-outage-highlights-cloud-dependency-risks","Exchange Online Outage Highlights Cloud Dependency Risks","2026-08-31T18:20:54.35+00:00",{"slug":45,"title":46,"published_at":47},"cyberattack-cripples-boston-scientific-global-operations","Cyberattack Cripples Boston Scientific Global Operations","2026-08-27T12:21:51.692+00:00",{"slug":49,"title":50,"published_at":51},"chatgpt-global-outage-exposes-critical-service-availability-risks","ChatGPT Global Outage Exposes Critical Service Availability Risks","2026-08-20T02:20:22.161+00:00",{"slug":53,"title":54,"published_at":55},"cyberattack-disrupts-north-carolina-port-gate-operations","Cyberattack Disrupts North Carolina Port Gate Operations","2026-08-07T16:20:48.818+00:00",{"slug":57,"title":58,"published_at":59},"military-gps-jamming-exercise-blamed-in-fatal-civilian-medevac-crash","Military GPS Jamming Exercise Blamed in Fatal Civilian Medevac Crash","2026-07-30T12:22:03.665+00:00",{"slug":61,"title":62,"published_at":63},"election-officials-build-independent-cyber-defenses-as-federal-support-collapses","Election Officials Build Independent Cyber Defenses as Federal Support Collapses","2026-07-13T22:20:22.478+00:00",{"slug":65,"title":66,"published_at":67},"agentic-ai-makes-fast-confident-mistakes-when-given-bad-context","Agentic AI Makes Fast, Confident Mistakes When Given Bad Context","2026-06-24T12:20:36.111+00:00",[69,74,79,83,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",7,{"slug":75,"name":76,"problem":77,"stories":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":80,"name":81,"problem":82,"stories":78},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":84,"name":85,"problem":86,"stories":87},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",4,{"slug":89,"name":90,"problem":91,"stories":92},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",2,{"slug":94,"name":95,"problem":96,"stories":92},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[98,104,109,113,117,121,125,130],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","11","Control 11","Data Recovery",11,{"family":105,"item":106,"code":107,"title":107,"together":108},"itil","overview","ITIL",8,{"family":5,"item":110,"code":111,"title":112,"together":108},"ir-4","IR-4","Incident Handling",{"family":99,"item":114,"code":115,"title":116,"together":108},"17","Control 17","Incident Response Management",{"family":99,"item":118,"code":119,"title":120,"together":108},"12","Control 12","Network Infrastructure Management",{"family":5,"item":122,"code":123,"title":124,"together":78},"ir-1","IR-1","Policy and Procedures",{"family":126,"item":127,"code":128,"title":129,"together":78},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":99,"item":131,"code":132,"title":133,"together":87},"8","Control 8","Audit Log Management"]