---

id: "CP-03(01)" title: "Simulated Events" family: "CP" family_name: "Contingency Planning" sort_id: "cp-03.01" priority: "P2" implementation_level: "organization" parent: "CP-03" enhancement: True

---

Statement

Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.

Guidance

The use of simulated events creates an environment for personnel to experience actual threat events, including cyber-attacks that disable websites, ransomware attacks that encrypt organizational data on servers, hurricanes that damage or destroy organizational facilities, or hardware or software failures.

Assessment Objective

simulated events are incorporated into contingency training to facilitate effective response by personnel in crisis situations.

Contingency planning policy

procedures addressing contingency training

contingency plan

contingency training curriculum

contingency training material

system security plan

other relevant documents or records

Organizational personnel with contingency planning, plan implementation, and training responsibilities

organizational personnel with information security responsibilities

Organizational processes for contingency training

mechanisms for simulating contingency events