CP-6 protects the data. CP-7 protects the ability to run. When your primary processing capability is down, where do you run, and how fast can you get there?
800-53 binds US federal systems and others by contract. For a small or mid size company it is a reference, and failover and disaster recovery questions appear in nearly every enterprise review.
What the control asks
The statement has three parts.
- Establish an alternate processing site, with the agreements needed to transfer and resume the operations you define for essential functions, within a time period you define, when primary processing is unavailable.
- Make available at the alternate site the equipment and supplies needed to transfer and resume operations, or put contracts in place to deliver them within that time period.
- Provide controls at the alternate site equivalent to those at the primary site.
What it means in practice
NIST says alternate processing sites are geographically distinct from the primary site. The capability can be a physical site or an alternative such as failover to a cloud service provider or another internal or external processing service. Geographically distributed architectures can also count. Agreements cover environmental conditions, access rules, physical protection and coordination of personnel transfer.
For a cloud company the common design is a second region with infrastructure as code, replicated data and a documented failover process. The three time terms in the statement map to your recovery time objective. The site must also carry equivalent controls. A recovery region with weaker logging or open security groups does not meet the third part.
Evidence to collect
- Architecture showing the alternate region or provider and the essential functions it supports.
- The agreement or provider terms and any capacity commitments.
- Infrastructure code that can stand up the environment, with last run date.
- Failover test results with measured transfer and resumption times.
- Control comparison between primary and alternate, such as access, logging and encryption settings.
- The failover runbook with owners.
Common gaps
- A second region exists on paper, but quotas or capacity were never confirmed.
- Data replication lags and nobody has measured it.
- Alternate site is missing monitoring, logging or hardened images.
- The runbook assumes the primary control plane is reachable.
- Third party services have no alternate and are not in the plan.
- Failback to the primary is never described.
How to implement it
- Name the essential functions and their time objectives from CP-2.
- Choose an alternate region or provider and confirm service availability and quotas there.
- Build the environment from the same code as primary so controls match.
- Run a failover exercise, time each step and record gaps, as CP-4 describes.
- Write the failback steps as well.
Several enhancements address real design questions. CP-7.1 is Separation from Primary Site. CP-7.2 is Accessibility. CP-7.3 is Priority of Service. CP-7.4 is Preparation for Use. CP-7.5 is Equivalent Information Security Safeguards. CP-7.6 is Inability to Return to Primary Site. CP-7.3 deserves attention if you share a provider region with many other customers during a regional event.
Mapping to other frameworks
Availability and recovery criteria in SOC 2, ISO 27001 and others overlap with this control but differ in detail. Mappings vary, so check an authoritative crosswalk for your editions.
Quick check
Does an alternate site have to be a physical building?
No. The guidance says it can be a physical site or an alternative such as failover to a cloud service provider or another processing service.
What does equivalent controls mean for a second region?
The alternate site needs access, logging, encryption and hardening comparable to the primary, so failing over does not lower your security posture.
