CP-2(2): Capacity Planning

Control Family:

Contingency Planning

Parent Control:

CP-2: Contingency Plan

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

ID.AM-5
ID.AM-6
ID.BE-1
ID.BE-5
ID.SC-5
PR.DS-4
PR.IP-7
PR.IP-9
DE.AE-4
RS.AN-2
RS.AN-4
RS.CO-1
RS.CO-3
RS.CO-4
RS.IM-1
RS.IM-2
RS.RP-1
RC.CO-3
RC.IM-1
RC.IM-2

Baselines:

High

Next Version:

NIST Special Publication 800-53 Revision 5.2.0:
CP-2(2): Capacity Planning

Control Statement

The organization conducts capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.

Supplemental Guidance

Capacity planning is needed because different types of threats (e.g., natural disasters, targeted cyber attacks) can result in a reduction of the available processing, telecommunications, and support services originally intended to support the organizational missions/business functions. Organizations may need to anticipate degraded operations during contingency operations and factor such degradation into capacity planning.