Alternate Processing Site CP-7

Contingency Planning · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds CP-7 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Contingency Planning family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CP-7 (Alternate Processing Site) is the ability to bring this server’s essential functions back up somewhere else — a second host, a spare machine, or a cloud instance — within a set time when the primary is unavailable. It is not just having the data (that is CP-6); it is having somewhere to run it, with the equipment, agreements, and equal controls in place. It is a Moderate-baseline control.

What good looks like

Identify an alternate place to run the essential functions — a standby host, a spare server, or a cloud instance.
Set the time target for transferring and resuming operations there, and make sure the site can meet it.
Have the equipment and supplies ready at the alternate site, or a contract that delivers them inside that time window.
Give the alternate site controls equal to the primary — same hardening, same access limits — so failing over does not lower your security.
Keep a current, tested way to rebuild — a machine image or infrastructure-as-code — so the standby matches the real server.

Framework mapping

NIST CSF 2.0 — PR.IR-03 — Mechanisms are implemented to achieve resilience requirements in normal and adverse situations

How to move it toward Implemented

Prepare a repeatable build for this server — a documented rebuild script, a configuration-management playbook (for example Ansible), or a machine image — so a fresh host can be stood up fast.
Stand the build up on a second host or a cloud instance, restore the latest backup onto it, and time how long transfer and resume actually take against your target.
Harden the alternate host to the same standard as the primary (same baseline, same access controls) and record the failover steps in the contingency plan.
Attach the alternate-site build and failover-test result as hardening evidence on the asset, naming CP-7 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.