Contingency Plan Testing

frameworkNIST SP 800-53 Rev 5.2 sectionCP Contingency Planning csf 2.0ID.IM-02 RC.RP-03 topics— frameworks2 0 3

Official texta. Test the contingency plan for the system [Assignment: organization-defined frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [Assignment: organization-defined organization-defined tests].
b. Review the contingency plan test results; and
c. Initiate corrective actions, if needed.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of CP-4 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	RC.RP-03	The integrity of backups and other restoration assets is verified before using them for restoration	Loosely related	No mapping. Only shares CSF RC.RP-03: related, not a mapping
ISO 27001	A.5.29 A.5.30	Information security during disruption; ICT readiness for business continuity	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 1 loosely related (not mappings) A.8.13 Information backup Loosely related Only shares CSF RC.RP-03: related, not a mapping
CIS v8.1	CIS 11.5 CIS 11.4	Test Data Recovery; Establish and Maintain an Isolated Instance of Recovery Data	Loosely related	No mapping. Only shares CSF RC.RP-03: related, not a mapping
SOC 2	A1.2	Environmental protections, backups and recovery infrastructure	Loosely related	No mapping. Only shares CSF RC.RP-03: related, not a mapping
PCI DSS	5.3.2 9.4.1.1 9.4.1.2 12.10.1	Periodic scans or continuous behavioural analysis; Offline backup media stored securely…	Loosely related	No mapping. Only shares CSF RC.RP-03: related, not a mapping
CMMC	MP.L2-3.8.9	Protect Backups	Loosely related	No mapping. Only shares CSF RC.RP-03: related, not a mapping
HIPAA	§164.308(a)(7)(ii)(D)	Testing and Revision Procedure	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 9 loosely related (not mappings) §164.308(a)(7) Contingency Plan Loosely related Only shares CSF ID.IM-02, RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(B) Disaster Recovery Plan Loosely related Only shares CSF ID.IM-02, RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Loosely related Only shares CSF ID.IM-02, RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Loosely related Only shares CSF ID.IM-02, RC.RP-03: related, not a mapping §164.310(a)(2)(i) Contingency Operations Loosely related Only shares CSF ID.IM-02, RC.RP-03: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF ID.IM-02, RC.RP-03: related, not a mapping §164.312(c) Integrity Loosely related Only shares CSF ID.IM-02, RC.RP-03: related, not a mapping §164.308(a)(7)(ii)(A) Data Backup Plan Loosely related Only shares CSF RC.RP-03: related, not a mapping …and 1 more in the downloads
GDPR	Art.32(1)(c)	Security of processing	Loosely related	No mapping. Only shares CSF RC.RP-03: related, not a mapping
NIS2	—	No requirement	No mapping in our data	No mapping in our data.
Essential Eight	ISM-1511 ISM-1515 ISM-1705 ISM-1706	Backups of data, applications and settings are performed and retained in accordance…; Restoration of data, applications and settings from backups to a common point in time……	Loosely related	No mapping. Only shares CSF RC.RP-03: related, not a mapping +7 more loosely related (not mappings) ISM-1707 Privileged user accounts (excluding backup administrator accounts) are prevented from… Loosely related Only shares CSF RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Loosely related Only shares CSF RC.RP-03: related, not a mapping ISM-1810 Backups of data, applications and settings are synchronised to enable restoration to a… Loosely related Only shares CSF RC.RP-03: related, not a mapping ISM-1811 Backups of data, applications and settings are retained in a secure and resilient manner Loosely related Only shares CSF RC.RP-03: related, not a mapping …and 3 more in the downloads
DORA	Art.12(1)Art.12(2)Art.12(3)	Backup policies and procedures, restoration and recovery procedures and methods; Backup policies and procedures, restoration and recovery procedures and methods…	Loosely related	No mapping. Only shares CSF RC.RP-03: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.