CP-8 (2) Telecommunications Services | Single Points of Failure (M) (H)

NIST 800-53 (r4) Control:

The organization obtains alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.

NIST 800-53 (r4) Supplemental Guidance:

None

NIST 800-53 (r5) Discussion:

In certain circumstances, telecommunications service providers or services may share the same physical lines, which increases the vulnerability of a single failure point. It is important to have provider transparency for the actual physical transmission capability for telecommunication services.

38North Guidance:

Meets Minimum Requirement:

• The organization must procure alternate telecommunications services or implement an alternate solution at the organization level.

• Document and identify alternate solutions if telecommunications services are not feasible (e.g., a call tree for using the organizations mobile devices with primary and alternate points of contacts for critical functions).

Best Practice:

• TBD.

Unofficial FedRAMP Guidance: None.

Assessment Evidence:

• SLA of alternate Telecommunication services.

• Call trees/table listing points of contacts for organizational personnel required for contingency planning activities.

CSP Implementation Tips:

• Amazon Web Services (AWS): TBD

• Microsoft Azure: TBD

• Google Cloud Platform: TBD