SC-47 asks you to establish alternate communications paths for system operations and organizational command and control. If your usual channels are disrupted by an incident, you still need a way to get information and give direction.
800-53 binds federal systems and contractors. For others it is a reference for incident and continuity plans.
What it means in practice
NIST points out that an incident, whether an attack or an accident, can take out the paths you normally use. The same incident can make things worse by leaving officials unable to get information or direct staff. It also mentions designating alternate decision makers if primary ones are unavailable, and setting the extent and limits of their actions.
For a company running on one chat tool and one email provider, the question is simple. If both are down, or compromised, how do you reach each other?
Evidence to collect
- An out of band contact list with personal or alternate numbers, kept somewhere that does not depend on your main systems.
- A named list of alternate decision makers and what they may decide.
- A documented fallback channel, such as a second chat tool or a phone bridge.
- The result of a test or tabletop exercise that used it.
Common gaps
The runbook lives only in the tool that is down. Alternate decision makers are named but have no access or authority.
How to implement it
Pick a fallback channel from a different provider, store the contact list offline, name deputies in the incident plan, and rehearse once a year.
Quick check
Besides a second channel, what else does NIST mention?
Designating alternate decision makers and defining the extent and limits of their actions.
