# NIST800 53 CP-1 — Policy And Procedures

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_nist80053_cp1_884fd787dd-nist800-53-cp-1-policy-and-procedures
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [Contingency Planning](https://support.icompaas.com/support/solutions/folders/f_gen_62000112528_contingencyplanning)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST800 53 · Control CP-1 · Priority: high · Component: Contingency Planning

### What this control covers

Develop, document, and disseminate contingency planning policies/procedures, defining roles, responsibilities, and compliance. Assign oversight officials and review regularly for relevance. This control supports the Governance capability within the Contingency Planning family.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policy or standard documents the safeguard. Focus: Policy And Procedures.

### Quick checklist

-   Policy — Procedures / Management
-   Review — Procedures / Management
-   Control — Procedures / Management
-   Compliance — Procedures / Management
-   Contingency — Procedures / Management
-   Document — Procedures / Management

### Related articles on this site

-   [Ensure IAM policies are attached only to groups or roles](https://support.icompaas.com/support/solutions/articles/62000081037-ensure-iam-policies-are-attached-only-to-groups-or-roles)
-   [Ensure Required IAM Policies for IAM Roles Check](https://support.icompaas.com/support/solutions/articles/62000218458-ensure-required-iam-policies-for-iam-roles-check)
-   [Roles and responsibilities](https://support.icompaas.com/support/solutions/articles/62000225140-roles-and-responsibilities)
-   [Policies & Procedures](https://support.icompaas.com/support/solutions/articles/62000225150-policies-procedures)

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.