<commit_before>documentation_complete: false
name: Contingency Planning
schema_version: 3.0.0
satisfies:

- control_key: CP-1
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for developing, documenting, and
        disseminating Contingency Planning policy and procedures. A
        successful control response will need to address the content of the
        policy (which must include purpose, scope, roles, responsibilities,
        management commitment, coordination, and compliance) and procedures
        (which must facilitate the implementation of the policies and associated
        controls).>'
    - key: b
      text: |
        '<The customer will be responsible for reviewing and updating the
        Contingency Planning policy every  years, and procedures annually.
        A successful response will need to address the review and update
        process, including the role(s) responsible for initiating the review
        process, updating the policy and procedures, and providing approval
        of the updates.>'

- control_key: CP-2
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for developing a contingency plan
        meeting the specified requirements. A successful control response will
        need to address the maintenance, recovery, and resumption of customer
        applications, as well as any reliance on infrastructure functionality
        to perform these tasks.>'
    - key: b
      text: |
        '<The customer will be responsible for distributing the contingency plan
        to key contingency personnel. A successful control response will need
        to address identification of key personnel (by name, title, or role)
        and the means by which the customer ensures that all key personnel 
        receive the contingency plan.>'
    - key: c
      text: |
        '<The customer will be responsible for coordinating contingency planning
        activities with incident handling activities. A successful control
        response will need to address the division of responsibilities between
        contingency personnel and incident response personnel, as well as the
        means by which contingency planning activities are activated in the
        event of a security incident.>'
    - key: d
      text: |
        '<The customer will be responsible for reviewing the contingency plan
        at the required frequency. A successful control response will need to
        outline how reviews are initiated, performed, and signed off on.>'
    - key: e
      text: |
        '<The customer will be responsible for updating the contingency plan to
        address relevant changes as well as any problems found in the
        contingency plan. A successful control response will need to discuss
        how updates are proposed, implemented, and approved.>'
    - key: f
      text: |
        '<The customer will be responsible for communicating changes to the
        contingency plan to key contingency personnel. A successful control
        response will need to address the means by which the
        customer ensures that all key personnel receive the updated
        contingency plan.>'
    - key: g
      text: |
        '<The customer will be responsible for protecting the contingency plan
        from unauthorized disclosure or modification. A successful control
        response will need to address policy, procedural, and technical
        safeguards that are in place to protect the contingency plan.>'

- control_key: CP-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for coordinating development of the
        contingency plan with related plans (such as business continuity plans,
        disaster recovery plans, etc.). A successful control response will need
        to address the coordination of initial development, as well as how
        updates to the contingency plan affect related plans and vice versa.>'

- control_key: CP-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for reserving capacity for processing
        in an alternative region. A successful control response will need to
        note that capacity for necessary processing has been reserved in an
        alternate region.>'

- control_key: CP-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<This control is often inherited through your platform provider,
        e.g. Microsoft Azure implements this control on behalf of both PaaS
        and IaaS customers. A successful control response will indicate if this
        control is inherited through your platform provider, and if not,
        details how mission functions will be resumed.>'

- control_key: CP-2 (8)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for identifying critical
        functionality for which processing capacity must be reserved in an 
        alternate region. A successful control response will need to discuss
        the process by wich this determination is made. Once processing
        capacity is reserved in an alternate region for this critical
        functionality, the remainder of the control may be inherited
        from your infrastruture provider.>'

- control_key: CP-3
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for initial and refresher training
        related to contingency plan activities at the required intervals. A
        successful control response will need to outline the scope and contents
        of the training, the audience for the training, and the means by which
        training attendance is tracked and enforced.>'

- control_key: CP-4
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against CP-4 goes here.

        This answer can be multi-line.

- control_key: CP-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against CP-4 (1) goes here.

        This answer can be multi-line.

- control_key: CP-6
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against CP-6 goes here.

        This answer can be multi-line.

- control_key: CP-6 (1)
  standard_key: NIST-800-53<commit_msg>through CP-4<commit_after>documentation_complete: false
name: Contingency Planning
schema_version: 3.0.0
satisfies:

- control_key: CP-1
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for developing, documenting, and
        disseminating Contingency Planning policy and procedures. A
        successful control response will need to address the content of the
        policy (which must include purpose, scope, roles, responsibilities,
        management commitment, coordination, and compliance) and procedures
        (which must facilitate the implementation of the policies and associated
        controls).>'
    - key: b
      text: |
        '<The customer will be responsible for reviewing and updating the
        Contingency Planning policy every  years, and procedures annually.
        A successful response will need to address the review and update
        process, including the role(s) responsible for initiating the review
        process, updating the policy and procedures, and providing approval
        of the updates.>'

- control_key: CP-2
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for developing a contingency plan
        meeting the specified requirements. A successful control response will
        need to address the maintenance, recovery, and resumption of customer
        applications, as well as any reliance on infrastructure functionality
        to perform these tasks.>'
    - key: b
      text: |
        '<The customer will be responsible for distributing the contingency plan
        to key contingency personnel. A successful control response will need
        to address identification of key personnel (by name, title, or role)
        and the means by which the customer ensures that all key personnel 
        receive the contingency plan.>'
    - key: c
      text: |
        '<The customer will be responsible for coordinating contingency planning
        activities with incident handling activities. A successful control
        response will need to address the division of responsibilities between
        contingency personnel and incident response personnel, as well as the
        means by which contingency planning activities are activated in the
        event of a security incident.>'
    - key: d
      text: |
        '<The customer will be responsible for reviewing the contingency plan
        at the required frequency. A successful control response will need to
        outline how reviews are initiated, performed, and signed off on.>'
    - key: e
      text: |
        '<The customer will be responsible for updating the contingency plan to
        address relevant changes as well as any problems found in the
        contingency plan. A successful control response will need to discuss
        how updates are proposed, implemented, and approved.>'
    - key: f
      text: |
        '<The customer will be responsible for communicating changes to the
        contingency plan to key contingency personnel. A successful control
        response will need to address the means by which the
        customer ensures that all key personnel receive the updated
        contingency plan.>'
    - key: g
      text: |
        '<The customer will be responsible for protecting the contingency plan
        from unauthorized disclosure or modification. A successful control
        response will need to address policy, procedural, and technical
        safeguards that are in place to protect the contingency plan.>'

- control_key: CP-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for coordinating development of the
        contingency plan with related plans (such as business continuity plans,
        disaster recovery plans, etc.). A successful control response will need
        to address the coordination of initial development, as well as how
        updates to the contingency plan affect related plans and vice versa.>'

- control_key: CP-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for reserving capacity for processing
        in an alternative region. A successful control response will need to
        note that capacity for necessary processing has been reserved in an
        alternate region.>'

- control_key: CP-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<This control is often inherited through your platform provider,
        e.g. Microsoft Azure implements this control on behalf of both PaaS
        and IaaS customers. A successful control response will indicate if this
        control is inherited through your platform provider, and if not,
        details how mission functions will be resumed.>'

- control_key: CP-2 (8)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for identifying critical
        functionality for which processing capacity must be reserved in an 
        alternate region. A successful control response will need to discuss
        the process by wich this determination is made. Once processing
        capacity is reserved in an alternate region for this critical
        functionality, the remainder of the control may be inherited
        from your infrastruture provider.>'

- control_key: CP-3
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for initial and refresher training
        related to contingency plan activities at the required intervals. A
        successful control response will need to outline the scope and contents
        of the training, the audience for the training, and the means by which
        training attendance is tracked and enforced.>'

- control_key: CP-4
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for testing of contingency plans
        related to the customer application at the required frequency. A
        successful control response will need to address the scenarios and
        exercises chosen for the test.

        Microsoft Azure has provided documentation around recovery testing for
        Azure SQL Database, which customers may use to develop their own test
        plans and procedures:
        
        https://azure.microsoft.com/en-us/documentation/articles/sql-database-disaster-recovery-drills/ >'
    - key: b
      text: |
        '<The customer will be responsible for reviewing the results of
        contingency plan testing. A successful control response will need to
        discuss the roles or personnel responsible for review, as well as the
        format and content of reporting on the results.>'
    - key: c
      text: |
        '<The customer will be responsible for initiating corrective action as
        a result of contingency plan testing. A successful control response will
        need to address the types of corrective actions taken and timeframes
        for those actions.>'

- control_key: CP-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against CP-4 (1) goes here.

        This answer can be multi-line.

- control_key: CP-6
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against CP-6 goes here.

        This answer can be multi-line.

- control_key: CP-6 (1)
  standard_key: NIST-800-53
{'fraction_non_alphanumeric': 0.04829375374176811, 'fraction_numerical': 0.010510210869420607, 'mean_word_length': 2.823499491353001, 'pattern_counts': {'":': 0, '<': 34, '<?xml version=': 0, '>': 34, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3832721', 'n_tokens_mistral': 3648, 'n_tokens_neox': 3600, 'n_words': 1768}