CP-4 Contingency Plan Testing
Control
a.
Test the contingency plan for the system [at least every 3 years] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [classroom exercise/table top written tests].
b.
Review the contingency plan test results; and
c.
Initiate corrective actions, if needed.
Discussion
Methods for testing contingency plans to determine the effectiveness of the plans and identify potential weaknesses include checklists, walk-through and tabletop exercises, simulations (parallel or full interrupt), and comprehensive exercises. Organizations conduct testing based on the requirements in contingency plans and include a determination of the effects on organizational operations, assets, and individuals due to contingency operations. Organizations have flexibility and discretion in the breadth, depth, and timelines of corrective actions.
FedRAMP-Defined Assignment / Selection Parameters
- CP-4 (a) [at least every 3 years] - frequency of testing the contingency plan for the system is defined;
- CP-4 (a) [classroom exercise/table top written tests] -