| name | CP-7_alternate-processing-site |
| description | Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [organization-defined] for essentia... |
| category | configuration |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","cp-7","cp"] |
| tech_stack | ["aws","azure","gcp"] |
| cwe_ids | [] |
| chains_with | ["CP-2","CP-6","CP-8","CP-9","CP-10","MA-6","PE-3","PE-11","PE-12","PE-17"] |
| prerequisites | [] |
| severity_boost | {"CP-2":"Chain with CP-2 for comprehensive security coverage","CP-6":"Chain with CP-6 for comprehensive security coverage","CP-8":"Chain with CP-8 for comprehensive security coverage"} |
CP-7 Alternate Processing Site
High-Level Description
Family: Contingency Planning (CP)
Framework: NIST SP 800-53 Rev 5
Alternate processing sites are geographically distinct from primary processing sites and provide processing capability if the primary processing site is not available. The alternate processing capability may be addressed using a physical processing site or other alternatives, such as failover to a cloud-based service provider or other internally or externally provided processing service. Geographically distributed architectures that support contingency requirements may also be considered alternate processing sites. Controls that are covered by alternate processing site agreements include the environmental conditions at alternate sites, access rules, physical and environmental protection requirements, and the coordination for the transfer and assignment of personnel. Requirements are allocated to alternate processing sites that reflect the requirements in contingency plans to maintain essential mission and business functions despite disruption, compromise, or failure in organizational systems.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for CP-7 implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
Tools
| Tool | Purpose | Usage |
|---|
| Manual Review | Documentation and interview-based | N/A |
Remediation Guide
Control Statement
Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [organization-defined] for essential mission and business functions within [organization-defined] when the primary processing capabilities are unavailable;
Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and
Provide controls at the alternate processing site that are equivalent to those at the primary site.
