FedRAMP Controls / CP

CP-1 Policy and Procedures

Family CP
Baselines moderate
Mapped KSIs 1

Control statement

a. Develop, document, and disseminate to {{ insert: param, cp-1_prm_1 }}:
        1.  {{ insert: param, cp-01_odp.03 }} contingency planning policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
        2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls;
    b. Designate an {{ insert: param, cp-01_odp.04 }} to manage the development, documentation, and dissemination of the contingency planning policy and procedures; and
    c. Review and update the current contingency planning:
        1. Policy {{ insert: param, cp-01_odp.05 }} and following {{ insert: param, cp-01_odp.06 }} ; and
        2. Procedures {{ insert: param, cp-01_odp.07 }} and following {{ insert: param, cp-01_odp.08 }}.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators

KSITitleCategory
KSI-AFR-01Minimum Assessment Scope
Apply the FedRAMP Minimum Assessment Scope (MAS) to identify and document the scope of the cloud service offering to be assessed for FedRAMP authorization and persistently address all related requirements and recommendations.
Authorization by FedRAMP