Contingency Training CP-3

Contingency Planning · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds CP-3 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Contingency Planning family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CP-3 (Contingency Training) makes sure the people with a recovery role actually know how to do it before the day they need to. It is training tied to the job: whoever restores backups, fails over, or declares an outage gets trained when they take the role, again when the system changes, and on a regular refresh after that. It is a Low-baseline control.

What good looks like

Train people for the role they hold — the person who runs restores learns the restore steps, not a generic slideshow.
Deliver the training when someone takes on a recovery role, so they are ready from the start.
Re-train when the system changes — a new backup tool, a new server, or new restore steps.
Refresh on a schedule (for example, yearly) so the knowledge does not go stale.
Review and update the training content itself so it keeps matching how recovery actually works today.

Framework mapping

NIST CSF 2.0 — PR.IR-03 — Mechanisms are implemented to achieve resilience requirements in normal and adverse situations

How to move it toward Implemented

List the recovery roles for this server and the one skill each must prove (for example, ‘restore /etc and a database from last night’s backup’).
Run a short, hands-on walkthrough on the box — have the trainee perform a real restore into a scratch directory — and write down who was trained and when.
Set the refresh date and the trigger events (a system change, a new person in the role) so training is not a one-time checkbox.
Attach the dated training record as hardening evidence on the asset, naming CP-3 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.