CP-2 (3) - Resume Essential Missions / Business Functions

Control requirements

CP-2 (3) - 0

The organization plans for the resumption of essential missions and business functions within [Assignment: organization-defined time period] of contingency plan activation.

Additional IBM Cloud for Financial Services specifications

• Contingency plans should also include planning for the resumption of all missions and business functions within an organization-defined time period of contingency plan activation.
• Recovery strategies must meet the RTOs (Recovery Time Objectives) and RPOs (Recovery Point Objectives) for a minimum of six (6) weeks.

Implementation guidance

See the resources that follow to learn more about how to implement this control.

• Operational logging
• Operational monitoring

NIST supplemental guidance

Organizations may choose to carry out the contingency planning activities in this control enhancement as part of organizational business continuity planning including, for example, as part of business impact analyses. The time period for resumption of essential missions/business functions may be dependent on the severity/extent of disruptions to the information system and its supporting infrastructure.