>myctrl.tools
Preferences
Under active development — Content is continuously updated and improved
Compare

CP-2(2)—Contingency Plan | Capacity Planning

IL4 High
IL5
IL6

>Control Description

Conduct capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.

>DoD Impact Level Requirements

No specific parameter values or requirements for this impact level.

>Discussion

Capacity planning is needed because different threats can result in a reduction of the available processing, telecommunications, and support services intended to support essential mission and business functions. Organizations anticipate degraded operations during contingency operations and factor the degradation into capacity planning. For capacity planning, environmental support refers to any environmental factor for which the organization determines that it needs to provide support in a contingency situation, even if in a degraded state.

Such determinations are based on an organizational assessment of risk, system categorization (impact level), and organizational risk tolerance.

>Related Controls

PE-11
PE-12
PE-13
PE-14
PE-18
SC-5

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • •What formal policies and procedures govern the implementation of CP-2(2) (Capacity Planning)?
  • •Who are the designated roles responsible for implementing, maintaining, and monitoring CP-2(2)?
  • •How frequently is the CP-2(2) policy reviewed and updated, and what triggers policy changes?
  • •What governance structure ensures CP-2(2) requirements are consistently applied across all systems?

Technical Implementation:

  • •Describe the specific technical mechanisms or controls used to enforce CP-2(2) requirements.
  • •What automated tools, systems, or technologies are deployed to implement CP-2(2)?
  • •How is CP-2(2) integrated into your system architecture and overall security posture?
  • •What configuration settings, parameters, or technical specifications enforce CP-2(2) requirements?

Evidence & Documentation:

  • •What documentation demonstrates the complete implementation of CP-2(2)?
  • •What audit logs, records, reports, or monitoring data validate CP-2(2) compliance?
  • •Can you provide evidence of periodic reviews, assessments, or testing of CP-2(2) effectiveness?
  • •What artifacts would you present during a FedRAMP assessment to demonstrate CP-2(2) compliance?

Ask AI

Configure your API key to use AI features.