CP-3 (1) Contingency Training | Simulated Events (H)

NIST 800-53 (r4) Control:

The organization incorporates simulated events into contingency training to facilitate effective response by personnel in crisis situations.

NIST 800-53 (r4) Supplemental Guidance:

None

NIST 800-53 (r5) Discussion:

The use of simulated events creates an environment for personnel to experience actual threat events, including cyber-attacks that disable websites, ransomware attacks that encrypt organizational data on servers, hurricanes that damage or destroy organizational facilities, or hardware or software failures.

38North Guidance:

Meets Minimum Requirement:

• Simulated events and/or mock exercises are provided as part of CP training for personnel with CP roles and responsibilities.

Best Practice:

• Training modules that offer simulation scenarios for addressing cyber attacks, restoring data, restoring access to data, isolating components if necessary, etc., would suffice to meet the requirements of this control.

Unofficial FedRAMP Guidance: None.

Assessment Evidence:

• Simulation events and scenarios that are conducted for CP training.

• Contingency training records that include conducting simulated events for training.

CSP Implementation Tips:

• Amazon Web Services (AWS): TBD

• Microsoft Azure: TBD

• Google Cloud Platform: TBD