CP-8 (1) Telecommunications Services | Priority of Service Provisions (M) (H)

NIST 800-53 (r4) Control:

The organization:

(a) Develops primary and alternate telecommunications service agreements that contain priority- of-service provisions in accordance with organizational availability requirements (including recovery time objectives); and

(b) Requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.

NIST 800-53 (r4) Supplemental Guidance:

Organizations consider the potential mission/business impact in situations where telecommunications service providers are servicing other organizations with similar priority-of-service provisions.

NIST 800-53 (r5) Discussion:

Organizations consider the potential mission or business impact in situations where telecommunications service providers are servicing other organizations with similar priority of service provisions. Telecommunications Service Priority (TSP) is a Federal Communications Commission (FCC) program that directs telecommunications service providers (e.g., wireline and wireless phone companies) to give preferential treatment to users enrolled in the program when they need to add new lines or have their lines restored following a disruption of service, regardless of the cause. The FCC sets the rules and policies for the TSP program, and the Department of Homeland Security manages the TSP program. The TSP program is always in effect and not contingent on a major disaster or attack taking place. Federal sponsorship is required to enroll in the TSP program.

38North Guidance:

Meets Minimum Requirement:

• Ensure that primary and secondary telecommunication services contain priority-of-service provisions in SLAs in accordance with customer availability and RTO requirements.

• Ensure that telecommunications service providers prioritize telecommunications services which are used for national security emergency preparedness and document it within the SLA.

Best Practice:

• TBD.

Unofficial FedRAMP Guidance: None.

Assessment Evidence:

• SLAs with telecommunication services that include priority-of-service provisions and RTO requirements and assurance for availability of telecommunications services for national security emergency preparedness.

CSP Implementation Tips:

• Amazon Web Services (AWS): TBD

• Microsoft Azure: TBD

• Google Cloud Platform: TBD