# NIST800 53 CP-2 — Contingency Plan

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_nist80053_cp2_c22da658a3-nist800-53-cp-2-contingency-plan
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [Contingency Planning](https://support.icompaas.com/support/solutions/folders/f_gen_62000112528_contingencyplanning)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST800 53 · Control CP-2 · Priority: high · Component: Contingency Planning

### What this control covers

Develop and maintain a contingency plan to ensure continuity of essential functions during disruptions. Define recovery objectives, roles, restoration steps, and align with incident response. Review/update regularly and protect from unauthorized access. This control supports the Planning capability within the Contingency Planning family.

### Why it matters

How quickly and methodically you contain an incident determines the regulatory consequence — most fines are not for the breach itself but for the slow or absent response.

### How to implement

#### AWS

Wire **GuardDuty**, **Security Hub** and **Macie** findings into your ticketing/SIEM via EventBridge. Maintain documented playbooks for IAM-key compromise, EC2 instance compromise, S3 data exposure, and run **quarterly tabletop exercises**.

#### Azure

Use **Defender for Cloud** + **Microsoft Sentinel** with playbooks (Logic Apps) for automated containment — disable user, isolate VM (NSG), revoke session tokens. Keep an on-call rotation in Teams with PagerDuty.

#### GCP

**Org Policy Service** for guardrails and **Config Validator** in CI to pre-check Terraform plans against policy as code (Rego).

#### Google Workspace

**Google Vault** retention rules cover Gmail/Drive/Chat; combine with periodic third-party backups (e.g., Spanning, Backupify) for full restore-by-user.

#### GitHub

Subscribe to **secret-scanning** alerts and **Dependabot** security advisories; require triage SLAs by severity. For exposed secrets, rotate at the cloud provider FIRST then revoke at GitHub — order matters.

### Evidence to collect

-   `ticketing_workflow` — See the iCompaas Evidence library for the canonical source for this evidence type.

Workflow metrics (ServiceNow, Jira) show approvals and remediation. Focus: Contingency Plan.

### Quick checklist

-   Access — Management / Functions
-   Review — Management / Functions
-   Response — Management / Functions
-   Unauthorized — Management / Functions
-   Control — Management / Functions
-   Plan — Management / Functions

### Related articles on this site

-   [Ensure EBS Volume in AWS Backup Plan](https://support.icompaas.com/support/solutions/articles/62000218582-ensure-ebs-volume-in-aws-backup-plan)
-   [Business Continuity and Disaster Recovery](https://support.icompaas.com/support/solutions/articles/62000225171-business-continuity-and-disaster-recovery)
-   [NIST 800-171 3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.](https://support.icompaas.com/support/solutions/articles/62000229301-nist-800-171-3-6-1-establish-an-operational-incident-handling-capability-for-organizational-systems-t)
-   [CMMC 2.0 IR.2.092 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.](https://support.icompaas.com/support/solutions/articles/62000229547-cmmc-2-0-ir-2-092-establish-an-operational-incident-handling-capability-for-organizational-systems-th)

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.