Which control is associated with Contingency Plan Testing and Exercises in TT&E under NIST 800-84?

• A. CP-3 Contingency Training
• B. IR-2 Incident Response Training
• C. CP-4 Contingency Plan Testing and Exercises
• D. IR-3 Incident Response Testing and Exercises

Answer: (C)

The main idea is that TT&E focuses on practicing and validating how a contingency plan will operate during an interruption. The control that explicitly covers testing, drills, and exercises of the contingency plan is Contingency Plan Testing and Exercises. It is about verifying the plan’s effectiveness, identifying gaps, and improving readiness through structured tests and exercises. Contingency Training, by contrast, deals with training personnel on procedures rather than testing the plan itself. Incident response controls address handling security incidents, not contingency planning. Therefore, Contingency Plan Testing and Exercises is the correct control.