CP-11 says provide the capability to employ alternate communications protocols, which you define, in support of continuity of operations.
800-53 binds US federal systems and others by contract. For a small or mid size company it is a reference, and you will rarely be asked about it directly.
What it means in practice
NIST says contingency plans, and the training and testing that go with them, should include an alternate communications protocol capability as part of resilience. Switching protocols can affect applications and operations, so the side effects need assessing before you implement it.
For most software companies the control reduces to a few questions. If the primary network path or protocol fails, what is the fallback? Can services fall back from one transport or messaging system to another? Can staff reach each other if the main chat tool is down?
Evidence to collect
- The list of alternate protocols or channels you chose, and which services use them.
- A note on the side effects assessment.
- Test or exercise records showing the switch was tried.
Common gaps
- Fallback exists in design documents and was never tested.
- Incident communications depend on the same platform that failed.
How to implement it
Name one fallback per critical path, test it during a contingency exercise and record the results.
Quick check
Why assess side effects first?
Switching protocols can change how applications behave, so NIST says to assess potential effects before implementation.
