CP-8: Telecommunications Services

Control Family:

Contingency Planning

CSF v1.1 References:

PF v1.0 References:

Threats Addressed:


Next Version:

Control Statement

The organization establishes alternate telecommunications services including necessary agreements to permit the resumption of [Assignment: organization-defined information system operations] for essential missions and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

Supplemental Guidance

This control applies to telecommunications services (data and voice) for primary and alternate processing and storage sites. Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential missions/business functions despite the loss of primary telecommunications services. Organizations may specify different time periods for primary/alternate sites. Alternate telecommunications services include, for example, additional organizational or commercial ground-based circuits/lines or satellites in lieu of ground-based communications. Organizations consider factors such as availability, quality of service, and access when entering into alternate telecommunications agreements.

Control Enhancements

CP-8(1): Priority Of Service Provisions


  • Moderate
  • High

The organization: Develops primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with organizational availability requirements (including recovery time objectives); and Requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.

CP-8(2): Single Points Of Failure


  • Moderate
  • High

The organization obtains alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.

CP-8(4): Provider Contingency Plan


  • High

The organization: Requires primary and alternate telecommunications service providers to have contingency plans; Reviews provider contingency plans to ensure that the plans meet organizational contingency requirements; and Obtains evidence of contingency testing/training by providers [Assignment: organization-defined frequency].