CP-8(3)_separation-of-primary-and-alternate-providers

CP-8(3) Separation of Primary and Alternate Providers

Enhancement of: CP-8

High-Level Description

Family: Contingency Planning (CP) Framework: NIST SP 800-53 Rev 5

Threats that affect telecommunications services are defined in organizational assessments of risk and include natural disasters, structural failures, cyber or physical attacks, and errors of omission or commission. Organizations can reduce common susceptibilities by minimizing shared infrastructure among telecommunications service providers and achieving sufficient geographic separation between services. Organizations may consider using a single service provider in situations where the service provider can provide alternate telecommunications services that meet the separation needs addressed in the risk assessment.

What to Check

• Verify CP-8(3) Separation of Primary and Alternate Providers is documented in SSP
• Confirm control is operating effectively
• Review evidence of continuous monitoring for CP-8(3)
• Verify enhancement builds upon base control CP-8

How to Test

Step 1: Review Documentation

Examine the System Security Plan (SSP) and related artifacts for CP-8(3) implementation details. Verify the organization has documented how this control is satisfied.

Step 2: Validate Implementation

# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly

# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null

Step 3: Test Operating Effectiveness

Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.

Tools

Remediation Guide

Control Statement

Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.

Implementation Guidance

Threats that affect telecommunications services are defined in organizational assessments of risk and include natural disasters, structural failures, cyber or physical attacks, and errors of omission or commission. Organizations can reduce common susceptibilities by minimizing shared infrastructure among telecommunications service providers and achieving sufficient geographic separation between services. Organizations may consider using a single service provider in situations where the service provider can provide alternate telecommunications services that meet the separation needs addressed in the risk assessment.

Risk Assessment

CWE Categories

References

• NIST SP 800-53 Rev 5 - CP-8(3)
• NIST SP 800-53A Rev 5 (Assessment Procedures)
• NIST SP 800-53 Rev 5 Full Catalog

Checklist

• Control documented in SSP
• Implementation evidence collected
• Operating effectiveness validated
• Continuous monitoring in place
• Related controls (none) reviewed