id: "CP-06" title: "Alternate Storage Site" family: "CP" family_name: "Contingency Planning" sort_id: "cp-06" priority: "P2" implementation_level: "organization" enhancements: - cp-6.1 - cp-6.2 - cp-6.3
Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and
Ensure that the alternate storage site provides controls equivalent to that of the primary site.
Guidance
Alternate storage sites are geographically distinct from primary storage sites and maintain duplicate copies of information and data if the primary storage site is not available. Similarly, alternate processing sites provide processing capability if the primary processing site is not available. Geographically distributed architectures that support contingency requirements may be considered alternate storage sites. Items covered by alternate storage site agreements include environmental conditions at the alternate sites, access rules for systems and facilities, physical and environmental protection requirements, and coordination of delivery and retrieval of backup media. Alternate storage sites reflect the requirements in contingency plans so that organizations can maintain essential mission and business functions despite compromise, failure, or disruption in organizational systems.
Assessment Objective: an alternate storage site is established;
Assessment Objective: establishment of the alternate storage site includes necessary agreements to permit the storage and retrieval of system backup information;
Assessment Objective: the alternate storage site provides controls equivalent to that of the primary site.
Contingency planning policy
procedures addressing alternate storage sites
contingency plan
alternate storage site agreements
primary storage site agreements
system security plan
other relevant documents or records
Organizational personnel with contingency plan alternate storage site responsibilities
organizational personnel with system recovery responsibilities
organizational personnel with information security responsibilities
Organizational processes for storing and retrieving system backup information at the alternate storage site
mechanisms supporting and/or implementing the storage and retrieval of system backup information at the alternate storage site