If you search for CP-5 Contingency Plan Update, you will find a control with no statement. It is withdrawn in Rev 5 of NIST SP 800-53. The official catalog marks it with a withdrawn status and a link showing it was incorporated into CP-2.
800-53 binds US federal systems and others by contract. For everyone else it is a reference, so the practical question is what to do with an older checklist that still lists CP-5.
What it means in practice
Nothing is lost. The duty to keep the contingency plan current now lives in CP-2. That control asks you to review the plan at a set frequency, update it for changes to the organization, system or environment and for problems found during implementation, execution or testing, and communicate the changes.
So the evidence for CP-5 is the evidence for those CP-2 duties.
Evidence to collect
- Plan version history with dates and change summaries.
- Review records.
- The change notices sent to plan holders.
Common gaps
- A framework crosswalk still points at CP-5, and the team reports it as not applicable.
- The plan is updated, but nobody records why.
How to implement it
Treat any CP-5 line in a questionnaire as a CP-2 question. Answer with the review and update trail, and note that the control is withdrawn in Rev 5. Older Rev 4 documents may still use it, so check which revision your customer or auditor uses.
Quick check
Where did CP-5 go?
It was withdrawn and incorporated into CP-2, Contingency Plan.
