Home NIST Guidelines CP-2(6)
CP-2(6) Contingency Planning

Alternate Processing and Storage Sites

High Risk Complex High Cost

CP-2(6) (Alternate Processing and Storage Sites) enhances base CP-2 within the NIST Contingency Planning family. Base CP-2 sets the foundational expectation; this enhancement adds specificity: Plan for the transfer of [organization-defined] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that continuity through system restoration to primary processing and/or storage sites. Organiz. Covered entities and business associates apply it to downtime procedures, backup/restore, and alternate processing that keep clinical operations and ePHI available.

Control Objective

Implement Alternate Processing and Storage Sites so organization-defined contingency planning safeguards operate consistently on systems and networks that handle ePHI, with measurable evidence for HIPAA and NIST assessments.

Implementation Guidance

  1. Map CP-2(6) to systems in scope (EHR, imaging, lab, pharmacy, billing, identity, backups, and BA connections).\n2. Translate “Alternate Processing and Storage Sites” into technical settings, procedures, or architecture patterns owned by named roles.\n3. Prefer enforceable controls (config, automation, mediation) over awareness-only measures where feasible.\n4. Integrate with change, incident, and downtime processes so clinical operations are not surprised.\n5. Log and retain evidence of operation (tickets, configs, test results) aligned to audit needs.\n6. Include vendors/BAs in contracts and connection standards when they touch the control surface.\n7. Test after major EHR, network, or cloud changes — upgrades often reset protections.\n8. Review exceptions at least quarterly; expire “temporary” holes that expose ePHI paths.

Real-World Use Cases

How this control shows up in healthcare and HIPAA-covered environments.

Real-world scenario

Regional flood closes data center (CP-2(6))\nClinical apps fail to DR site outside the flood plain; downtime procedures point staff to DR URLs. Evidence labeled for CP-2(6).\n\n### Priority circuit for DR (CP-2(6))\nTelecom priority-of-service keeps DR replication up when commercial bandwidth is congested. Evidence labeled for CP-2(6).\n\n### Warm site EHR readiness (CP-2(6))\nQuarterly DR exercise brings warm site to login-ready within RTO for ED and inpatient census. Evidence labeled for CP-2(6).

Best Practices

  • Name an owner for CP-2(6) in the SSP control matrix.\n- Favor system enforcement on ePHI paths over informal email approval.\n- Measure coverage: percent of in-scope clinical systems where the enhancement operates.\n- Review exceptions quarterly with security and clinical informatics.\n- Feed relevant events to SIEM with a named use case.\n- Keep a one-page evidence pack (config + sample log + last test) ready for assessors.

Common Gaps & Violations

  • Policy cites CP-2(6) but production EHR/network paths show no enforcement of alternate processing and storage sites.\n- Permanent exceptions with no expiry for vendors or “special” clinics.\n- Control implemented only on corporate IT — clinical devices and interfaces omitted.\n- No logs or test records; reliance on tribal knowledge.\n- Major upgrade silently disabled the enhancement.

Required Documentation

  • Procedure/standard for Alternate Processing and Storage Sites (CP-2(6))\n- Architecture or configuration baselines showing enforcement points\n- Exception register with owners and expiry\n- Sample logs, alerts, or test results\n- Training or runbook references for clinical/IT operators

How to Test & Validate

  1. Attempt a prohibited or out-of-policy action related to alternate processing and storage sites; confirm block, alert, or required workflow.\n2. Complete an authorized clinical/IT path; confirm success and logging.\n3. Sample open exceptions for approval and expiry.\n4. Verify at least one EHR-adjacent and one BA/vendor path are in scope.\n5. Confirm evidence retained for the last 90 days (or per policy).

Audit Considerations

Assessors look for operating evidence of Alternate Processing and Storage Sites on systems touching ePHI — configs, logs, restore/DR artifacts, or failed-test results — not only a policy paragraph referencing CP-2(6).

HIPAA Mapping

How this NIST control supports HIPAA Security Rule expectations.

  • 164.308(a)(7) Contingency Plan — data backup, disaster recovery, and emergency-mode operations for ePHI.\n- 164.308(a)(7)(ii)(A) Data Backup Plan — retrievable exact copies of ePHI.\n- 164.308(a)(7)(ii)(B) Disaster Recovery Plan — restore lost data after disruption.\n- 164.312(a)(2)(ii) Emergency Access Procedure — continue critical access during contingency.

Compliance Tips

  • List CP-2(6) explicitly in the system security plan with system inventory references.\n- Prioritize emergency department, inpatient EHR, and remote access paths first.\n- Bundle evidence with related HIPAA contingency or transmission-security narratives where they overlap.

References & Resources

  • NIST SP 800-53 Rev. 5 — CP-2(6)\n- Related controls: CP-2

Related Guidelines

Related controls that commonly accompany CP-2(6).

CP-2 High

Contingency Plan

CP-2 requires developing a contingency plan for the information system that identifies essential missions and business functions, provides…
CP-1 Critical

Contingency Planning Policy and Procedures

CP-1 requires contingency planning policy and procedures addressing purpose, scope, roles, management commitment, coordination, and…
CP-10 High

Information System Recovery and Reconstitution

CP-10 requires providing for recovery and reconstitution of the system to a known state after a disruption, compromise, or failure…

Need Help Implementing CP-2(6)?

Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.

Contact Our Experts View All Guidelines