NIST Special Publication 800-53 (Rev. 4)

Security and Privacy Controls for Federal Information Systems and Organizations

CP-3 CONTINGENCY TRAINING

Family:
Contingency Planning
Class:
Priority:
P2 - Implement P2 security controls after implementation of P1 controls.
Baseline Allocation:
Low Moderate High
CP-3
CP-3
CP-3 (1)

Control Description

The organization provides contingency training to information system users consistent with assigned roles and responsibilities:

a. Within [Assignment: organization-defined time period] of assuming a contingency role or responsibility;

b. When required by information system changes; and

c. [Assignment: organization-defined frequency] thereafter.

Supplemental Guidance

Contingency training provided by organizations is linked to the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail is included in such training. For example, regular users may only need to know when and where to report for duty during contingency operations and if normal duties are affected; system administrators may require additional training on how to set up information systems at alternate processing and storage sites; and managers/senior leaders may receive more specific training on how to conduct mission-essential functions in designated off-site locations and how to establish communications with other governmental entities for purposes of coordination on contingency-related activities. Training for contingency roles/responsibilities reflects the specific continuity requirements in the contingency plan.

Related to: AT-2AT-3CP-2IR-2

Control Enhancements

CP-3 (1) CONTINGENCY TRAINING | SIMULATED EVENTS
The organization incorporates simulated events into contingency training to facilitate effective response by personnel in crisis situations.
CP-3 (2) CONTINGENCY TRAINING | AUTOMATED TRAINING ENVIRONMENTS
The organization employs automated mechanisms to provide a more thorough and realistic contingency training environment.