NIST 800-53 REV 5 • CONTINGENCY PLANNING
CP-4(2) — Alternate Processing Site
Test the contingency plan at the alternate processing site: To familiarize contingency personnel with the facility and available resources; and To evaluate the capabilities of the alternate processing site to support contingency operations.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
Supplemental Guidance
Conditions at the alternate processing site may be significantly different than the conditions at the primary site. Having the opportunity to visit the alternate site and experience the actual capabilities available at the site can provide valuable information on potential vulnerabilities that could affect essential organizational mission and business functions. The on-site visit can also provide an opportunity to refine the contingency plan to address the vulnerabilities discovered during testing.
Practitioner Notes
This enhancement requires testing your contingency plan at the alternate processing site — not just in theory, but by actually failing over to the backup location.
Example 1: Conduct an annual Azure Site Recovery test failover to your secondary region and verify that critical applications are accessible and functional at the backup site.
Example 2: Perform a live test where your team sets up operations at your designated alternate office location and verifies VPN connectivity, phone systems, and application access.