NIST SP 800-34
NIST Special Publication 800-34 Revision 1, "Contingency Planning Guide for Federal Information Systems", published May 2010 with updates through November 2010, tells organizations how to plan for recovering information systems after a disruption.
It sets out a seven-step process: develop the contingency planning policy, conduct a business impact analysis, identify preventive controls, create recovery strategies, develop the plan, test and train, and maintain the plan.
It also explains how an information system contingency plan relates to business continuity, disaster recovery, crisis communications, and incident response plans, and provides templates by system impact level.
The NIST CSRC listing marks the publication as withdrawn from active maintenance, but it remains the reference behind the CP control family in NIST SP 800-53 and is still cited in FedRAMP and CMMC work. In writing it yields the contingency planning policy, BIA, recovery strategies, the plan itself with roles and call trees, test records, and a maintenance log.
help
Who has to comply
Written for US federal agencies under FISMA; voluntary for others, but widely used by contractors and cloud providers to satisfy the CP controls in NIST SP 800-53 baselines.
What the assessor asks to see
Contingency planning policy; business impact analysis with recovery time and point objectives; preventive controls list; recovery strategies and alternate site or backup arrangements; the contingency plan with roles, notification procedures, and recovery steps; training records; test and exercise reports with lessons learned; plan maintenance and distribution records.
Who helps with NIST SP 800-34
Business continuity and disaster recovery consultancies use it as a template. Typical engagement is a BIA and plan build of one to three months, followed by annual test facilitation.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Consultants
Be the first NIST SP 800-34 consultant listed here
The people reading this are working out who can help them get there.
Who assesses NIST SP 800-34
None for the document itself; contingency plans built on it are reviewed by the assessor of the parent program (3PAOs, agency assessors, C3PAOs).
Assessors
Be the first NIST SP 800-34 assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for NIST SP 800-34
Tools that name this framework in their own material.
Tools
Be the first tool listed for NIST SP 800-34
Buyers comparing software for this standard land here first.
Need a hand implementing it?
Find a Consultant for NIST SP 800-34
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Get Help with NIST SP 800-34
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.