CP-8 is the contingency planning control about the wires. If your main internet or voice connectivity goes down at your primary site or your alternate site, can essential work resume within a time you defined? The control asks you to establish alternate telecommunications services, including the agreements needed to use them.
NIST 800-53 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a useful reference. A customer or auditor may borrow its wording in a questionnaire, so it helps to know what a good answer looks like.
What it means in practice
The NIST guidance covers data and voice services for primary and alternate processing and storage sites. It lists examples of alternates: additional commercial or organizational circuits, network based approaches, or satellite. It also tells you to weigh availability, quality of service and access when you sign those agreements.
For a cloud first company this often reads differently. Your processing site may be a cloud region, and your office is a place people sometimes work from. The question still applies in two places: how your staff and customers reach the service, and how your own people reach the tools needed to respond to an outage.
Evidence to collect
- A list of circuits and carriers per site, with the contract term and the recovery time each one supports.
- The signed agreement or order form for the alternate service, showing it is in force.
- The contingency plan section that names the time period for resuming essential functions on the alternate path.
- Results of a failover test: date, who ran it, what broke, what you changed.
Common gaps
Two circuits that share the same physical conduit or the same upstream provider look redundant on paper and fail together. The enhancements address this directly: CP-8.2 Single Points of Failure and CP-8.3 Separation of Primary and Alternate Providers.
Another gap is an alternate that was bought and never tested. CP-8.5 Alternate Telecommunication Service Testing exists for that reason. Also ask carriers about their own contingency plans (CP-8.4 Provider Contingency Plan) and whether you get priority of service during a wide outage (CP-8.1 Priority of Service Provisions).
How to implement it
Decide the recovery time you need for essential functions, then buy only what meets it. For many small teams a second carrier or a mobile failover on the office router is enough. Document who switches over and how. Run a real failover once a year and record the result.
Quick check
Why is a second circuit from the same provider weak evidence?
It may share conduit, upstream routes or an outage with the first one. CP-8.2 and CP-8.3 point at removing single points of failure and separating providers.
