Telecommunications Services CP-8

Source: NIST SP 800-53 Rev.5, Contingency Planning family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CP-8 (Telecommunications Services) is about making sure the network links your system depends on can survive an outage. It asks you to arrange alternate telecommunications service — a second way for the system to communicate — along with the agreements needed so essential functions can resume within a set time when the primary connection is unavailable at either your main site or your backup site. It is a Contingency Planning control that appears at the Moderate baseline.

What good looks like

• Map the dependency — list the essential functions and the network links each one needs, including the primary uplink, internal routing, and the Domain Name System (DNS, which turns names into addresses).
• Arrange an alternate service so the system can resume operations within a defined recovery time when the primary link is down.
• Put agreements in place with priority-of-service provisions so your service is restored ahead of others in an emergency (enhancement CP-8(1)).
• Remove single points of failure — route the alternate service over a separate path and, where you can, a separate provider (enhancements CP-8(2) and CP-8(3)).
• Test the alternate service on a schedule so you know it actually carries traffic before you need it (enhancement CP-8(5)).

Framework mapping

• NIST CSF 2.0 — PR.IR-03 — Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
• CIS Controls v8 — Control 17 — Incident response management — define mechanisms for communicating during incident response (Safeguard 17.6)

How to move it toward Implemented

• Write a one-page telecommunications plan: the network links you depend on (primary and backup uplinks), the recovery time objective (RTO — how fast communications must be back), and any alternate-service agreement or priority-of-service arrangement.
• Add a second network path with automatic failover — give the backup route a higher metric so traffic reroutes on its own (for example ip route add default via <gateway> dev <iface> metric 200, or set connection priorities in netplan or NetworkManager).
• Add a second name resolver so lookups survive one provider failing — list more than one server in /etc/systemd/resolved.conf (DNS= and FallbackDNS=) or in /etc/resolv.conf.
• Test the failover and log it — take the primary link down (ip link set <iface> down), confirm essential services stay reachable over the backup, bring it back up, and save a dated result file.
• Attach that plan and the dated failover-test result as hardening evidence on the asset, naming CP-8 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.