CP-7(5) — Equivalent Information Security Safeguards

This enhancement was incorporated into CP-7. It required your alternate processing site to have equivalent security controls as your primary site.

Example 1: Apply the same STIG baselines and security group policies to systems at your alternate site as you do at your primary site, and include them in your regular SCAP scans.

Example 2: Ensure your backup Azure subscription has the same security configurations — network security groups, Defender for Cloud settings, and access controls — as production.