In the context of contingency planning, CP-2 can be used as a predefined template for a generalized contingency plan for all organizational information systems with tailoring by system owners. Which option best reflects this use?

• A. Using CP-2 as a predefined template for a generalized contingency plan for all organizational information systems with tailoring by system owners
• B. CP-2 must always be tailored from scratch for each system with no template
• C. CP-2 governs encryption algorithms
• D. CP-2 is unrelated to contingency planning

Answer: (A)

Using CP-2 as a predefined template for a generalized contingency plan across all organizational information systems, with tailoring by system owners, provides a scalable and consistent approach. A baseline template ensures every system’s plan includes core elements—roles and responsibilities, recovery strategies, communications, testing, plan maintenance, and interfaces with other plans—while allowing system owners to adapt details to their system’s criticality, interdependencies, data sensitivity, and recovery objectives. This saves time, avoids duplicating effort, and supports coherent, organization-wide contingency planning. Tailoring from scratch for each system would waste effort and risk gaps; focusing on encryption algorithms falls outside contingency planning; and saying CP-2 is unrelated contradicts its role in establishing contingency capabilities.