CP-11 Alternate Communications Protocols. Provide the capability to employ [organization-defined] in support of maintaining continuity of operations
Alternate Communications Protocols. Provide the capability to employ [organization-defined] in support of maintaining continuity of operations.
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Design or configuration evidence showing the alternative protocol is available and reachable when the primary fails · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Test records demonstrating the alternative protocol carried real traffic during a contingency exercise · Document repository
governing documentDocuments that govern the control
- The defined alternative communications protocols identified for continuity use · Document repository
- Continuity plan section naming who switches to the alternative and on what trigger · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Alternative protocol depends on the same physical path or provider as the primary, so both fail together
- Listed in the plan but never exercised, so failure to switch is discovered during a real event
- No defined trigger, leaving the switch to an individual judgement call under pressure
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCP-10 System recovery and reconstitution · CP-12 Safe Mode. When [organization-defined] are detected, enter a safe mode of operation with [organization-defined]