800-53 · CP Contingency Planning
CP-7
Alternate Processing Site
frameworkNIST SP 800-53 Rev 5.2
sectionCP Contingency Planning
csf 2.0GV.OC-04 PR.IR-03 PR.IR-04 RC.RP-02 RC.RP-04 RC.RP-05
topicsBusiness Continuity, Disaster Recovery
frameworks2 8 2
Official texta. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period] when the primary processing capabilities are unavailable;
b. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and
c. Provide controls at the alternate processing site that are equivalent to those at the primary site.NIST SP 800-53 Rev 5.2 control statement (public domain)
b. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and
c. Provide controls at the alternate processing site that are equivalent to those at the primary site.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-04PR.IR-03RC.RP-02RC.RP-04RC.RP-05 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated; Mechanisms are implemented to achieve resilience requirements in normal and adverse situations… | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick)1 loosely related (not mappings)PR.IR-04 Adequate resource capacity to ensure availability is maintained Only shares CSF PR.IR-04: related, not a mapping |
| ISO 27001 | A.5.29A.5.30A.8.14A.7.5 | Information security during disruption; ICT readiness for business continuity… | Crosswalk | Same topic: Business Continuity, Disaster Recovery (editorial pick) NIST SP 800-53 → ISO 27001 mapping 9 loosely related (not mappings)A.5.26 Response to information security incidents Only shares CSF RC.RP-02, RC.RP-05: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-04, PR.IR-03: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-04: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.OC-04: related, not a mapping A.8.27 Secure system architecture and engineering principles Only shares CSF PR.IR-03: related, not a mapping …and 1 more in the downloads |
| CIS v8.1 | CIS 11.1 | Establish and Maintain a Data Recovery Process | Editorial | Same topic: Disaster Recovery (editorial pick) |
| SOC 2 | A1.1A1.2A1.3CC9.1 | Capacity management to meet availability commitments; Environmental protections, backups and recovery infrastructure… | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick) |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick)10 loosely related (not mappings)1.2.3 Accurate network diagram maintained Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping 12.5.1 Inventory of in-scope system components Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Only shares CSF RC.RP-05: related, not a mapping …and 2 more in the downloads |
| CMMC | IR.L2-3.6.1SC.L2-3.13.2 | Incident Handling; Security Engineering | No mapping. Only shares CSF RC.RP-02, PR.IR-03: related, not a mapping | |
| HIPAA | §164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(C)§164.308(a)(7)(ii)(D)§164.310(a)(2)(i) | Disaster Recovery Plan; Emergency Mode Operation Plan… | Crosswalk | Same topic: Disaster Recovery, Business Continuity (editorial pick) NIST HIPAA → SP 800-53 crosswalk 8 loosely related (not mappings)§164.308(a)(6) Security Incident Procedures Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping §164.308(a)(6)(ii) Response and Reporting Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF GV.OC-04: related, not a mapping |
| GDPR | Art.32(1)(b)Art.32(1)(c) | Security of processing; Security of processing | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick)1 loosely related (not mappings)Art.34(1) Communication of a personal data breach to the data subject Only shares CSF RC.RP-05: related, not a mapping |
| NIS2 | 4.14.24.3 | Business continuity and disaster recovery plan; Backup management… | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick) |
| Essential Eight | ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | Editorial | Same topic: Disaster Recovery (editorial pick) |
| DORA | Art.11(1)Art.11(4)Art.11(6)Art.12(4) | Response and recovery; Response and recovery… | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick)6 loosely related (not mappings)Art.12(6) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF RC.RP-02: related, not a mapping |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.