CP-3 asks that people who have a part in your contingency plan are trained for that part. The statement has three timing rules. Train within a period you define of someone taking a contingency role. Train again when system changes require it. Train at a frequency you define after that. You also review and update the training content on a schedule and after defined events.
800-53 binds US federal systems and others by contract. It is a reference for the rest.
What it means in practice
NIST ties training to roles. Some staff only need to know when and where to report and whether normal duties change. Administrators may need training on rebuilding systems at an alternate site. Leaders may need to practice making decisions and coordinating externally. Content follows the specific continuity requirements in the plan.
Updates to content should follow plan tests, real events with lessons learned, audit findings, incidents and legal changes. The guidance also says that taking part in a plan test or exercise, including the lessons learned session, can count as training at your discretion. For a small team, a tabletop doubles as training.
Evidence to collect
- The role list from the contingency plan and the training each role gets.
- Training materials with version dates.
- Completion records for new role holders within the required period.
- Attendance and outcome records for exercises used as training.
- Content review records after tests or incidents.
Common gaps
- Training is generic and not tied to the plan.
- New on call engineers skip it.
- Content is never updated after a test shows a gap.
- No record that a system change triggered retraining.
How to implement it
Add a contingency module to onboarding for anyone on a plan role. Run a yearly tabletop and record it as training. Revisit content after each test. CP-3.1 covers Simulated Events and CP-3.2 covers Mechanisms Used in Training Environments.
Quick check
Can a tabletop exercise count as training?
Yes, at the organization's discretion according to the guidance, including the lessons learned session.
