| name | CP-8(3)_separation-of-primary-and-alternate-providers |
| description | Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same thr |
| category | configuration |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","cp-8-3","cp","enhancement"] |
| tech_stack | ["aws","azure","gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | ["CP-8"] |
| severity_boost | {} |
CP-8(3) Separation of Primary and Alternate Providers
Enhancement of: CP-8
High-Level Description
Family: Contingency Planning (CP)
Framework: NIST SP 800-53 Rev 5
Threats that affect telecommunications services are defined in organizational assessments of risk and include natural disasters, structural failures, cyber or physical attacks, and errors of omission or commission. Organizations can reduce common susceptibilities by minimizing shared infrastructure among telecommunications service providers and achieving sufficient geographic separation between services. Organizations may consider using a single service provider in situations where the service provider can provide alternate telecommunications services that meet the separation needs addressed in the risk assessment.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for CP-8(3) implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
Tools
| Tool | Purpose | Usage |
|---|
| Manual Review | Documentation and interview-based | N/A |
Remediation Guide
Control Statement
Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.
Implementation Guidance
Threats that affect telecommunications services are defined in organizational assessments of risk and include natural disasters, structural failures, cyber or physical attacks, and errors of omission or commission. Organizations can reduce common susceptibilities by minimizing shared infrastructure among telecommunications service providers and achieving sufficient geographic separation between services. Organizations may consider using a single service provider in situations where the service provider can provide alternate telecommunications services that meet the separation needs addressed in the risk assessment.
