CP-13 says to employ alternative security mechanisms, which you define, for satisfying security functions you define, when the primary means is unavailable or compromised.
800-53 binds US federal systems and others by contract. For everyone else it is a reference.
What it means in practice
NIST's guidance says alternative mechanisms support resilience and continuity. They may be less effective than the primary, but having them ready beats curtailing operations until the primary returns. Because of the cost and effort, they apply only to critical security capabilities. The guidance gives one example. An organization may issue one time pads to senior officials and administrators if the multi factor tokens used for authentication are compromised.
Think about your own critical security functions. If your identity provider is down, how do administrators sign in to fix things? If your signing key is suspected stolen, what is the fallback?
Evidence to collect
- The list of critical security functions and the fallback for each.
- The procedure to switch, including who may authorize it.
- A test or exercise record.
Common gaps
- Break glass credentials exist but were never tested.
- The fallback depends on the same system that failed.
How to implement it
Pick two or three critical functions, document a fallback, and rehearse it during a CP-4 test.
Quick check
Must the alternative be as strong as the primary?
No. The guidance accepts that it may be less effective, as long as it keeps critical operations going.
