Quick-reference card
| Field | Value |
|---|---|
| Control ID | SC-47 |
| Control Name | Alternate Communications Paths |
| Framework | NIST SP 800-53, Revision 5 |
| Control Family | System and Communications Protection |
| Baselines | — |
| Relevance | First Party and Third Party (Organization and Vendors) |
| Risk Severity | Low |
What this control requires
SC-47 requires organizations to establish backup communication channels that keep system operations and command-and-control functions running when primary paths fail. As part of the NIST SP 800-53 framework, the control addresses a foundational gap in most incident response programs. Teams plan extensively for detecting and containing threats, but rarely account for the possibility that their communication infrastructure itself becomes compromised or unavailable during a disruption.
In practice, meeting SC-47 means identifying the communication paths your organization depends on for operational coordination and system and communications protection, then provisioning alternatives that don’t share the same failure points. You need to designate alternative decision makers who can act when primary leaders are unreachable, and you need to document the scope and limitations of those delegated authorities. The control also requires that these alternate paths support command and control during incidents, not just day-to-day operations.
The underlying rationale is straightforward. When an incident disrupts your primary communication channels, your ability to coordinate a response degrades rapidly. Delayed direction to operational teams compounds the original disruption, turning a containable event into an organizational crisis. SC-47 exists to prevent that cascading failure by ensuring at least one independent communication path remains functional regardless of the incident’s scope.
Why it matters
Most organizations treat communication infrastructure as a given during incident response planning. That assumption creates a blind spot. If the same network that carries your email, chat, and VoIP also carries the threat, your response coordination collapses at the moment you need it most.
The risk classification for SC-47 is low in isolation, but its absence amplifies the impact of every other control failure. An organization without alternate communication paths can’t execute its contingency plan effectively, can’t redirect operational teams, and can’t escalate decisions to leadership when primary channels go dark. The result is a gap between documented response procedures and the ability to carry them out.
From a compliance and audit perspective, assessors evaluating your NIST SP 800-53 posture will look for documented alternate communication paths alongside evidence that those paths have been tested. Without that documentation, you’re signaling that your incident response capability has a single point of failure. Auditors treat undocumented assumptions about communication availability as a control gap, even if the organization has never experienced a disruption.
The downstream consequences extend beyond audit findings. Regulatory bodies increasingly expect organizations to demonstrate operational resilience, not just security controls. An inability to maintain command and control during an incident raises questions about the maturity of your entire security program.
What attackers exploit
- Single-channel dependency: Organizations that rely exclusively on corporate email or a single messaging platform for incident coordination lose all response capability when that channel is compromised or taken offline.
- Shared infrastructure failures: Primary and “backup” communication tools running on the same network segment, cloud provider, or authentication system create correlated failure modes that a single incident can disable simultaneously.
- Undocumented delegation of authority: When primary decision makers are unreachable and no alternate authority is documented, operational teams freeze, giving adversaries more time to move laterally.
- Untested recovery paths: Alternate communication channels that exist on paper but haven’t been exercised fail under pressure due to expired credentials, misconfigured access, or unfamiliarity among the teams expected to use them.
How to implement
The most common failure mode for SC-47 isn’t the absence of backup communication tools. It’s that organizations treat the control as an infrastructure procurement exercise rather than an operational readiness requirement. Buying a satellite phone doesn’t satisfy SC-47 if nobody knows where it’s stored, who has the access codes, or what decisions can be made through it.
For your organization
Start by mapping your current communication dependencies. Identify every channel your organization uses for system operations and incident coordination, including email, internal chat platforms, phone systems, video conferencing, and any specialized operational channels. Document which of these channels share infrastructure, authentication systems, network paths, or cloud providers.
Next, provision alternate communication paths that are architecturally independent from your primary channels. The key requirement is diversity of failure modes. If your primary channels run on your corporate network, your alternates should function without it. Categories of alternate paths include cellular-based messaging platforms, satellite communication systems, out-of-band radio networks, and pre-established agreements with alternate work site facilities that have independent communication infrastructure.
Document the delegation of authority chain for each alternate path. Specify who the alternative decision makers are, what decisions they can make, and what limits apply to their authority. Ensure that this documentation is accessible from the alternate path itself, not stored exclusively on systems that might be unavailable during a disruption.
Test your alternate communication paths on a regular schedule, at minimum quarterly. Testing should verify technical functionality, confirm that designated personnel can access and operate the systems, and validate that the delegation of authority documentation is current. Include alternate communication activation in your tabletop exercises and system recovery and reconstitution drills.
Common mistakes to avoid:
- Designating a “backup” channel that uses the same internet service provider or cloud platform as the primary channel
- Storing alternate channel credentials or access instructions exclusively on systems that depend on the primary communication infrastructure
- Failing to update delegation of authority documentation when personnel change roles
- Testing only the technical connectivity of alternate paths without verifying that operational teams can use them for actual decision-making
For your vendors
When assessing vendor compliance with SC-47, focus on whether the vendor has documented alternate communication paths that support continuity of the services they provide to your organization, not just their internal operations.
Request evidence that the vendor maintains at least one communication channel independent of their primary infrastructure for coordinating incident response and service continuity. Ask specifically about the architectural independence of their alternate paths. A backup Slack workspace on the same cloud platform as their primary workspace doesn’t constitute an alternate path under SC-47.
Key questions to include in your assessment:
- What alternate communication paths does your organization maintain for system operations and incident command and control?
- Are your alternate communication paths architecturally independent from your primary communication infrastructure?
- Who are the designated alternative decision makers, and what are the documented limitations of their authority?
- How frequently do you test alternate communication paths, and what does the testing validate?
- Can you provide evidence of the most recent test of your alternate communication paths?
Red flags during vendor assessment:
- The vendor can’t name a specific alternate communication path distinct from their primary infrastructure
- Alternate paths haven’t been tested in the past 12 months
- No documented delegation of authority for alternative decision makers
- The vendor’s alternative security mechanisms rely on the same authentication infrastructure as their primary systems
Review the vendor’s contingency plan documentation alongside their SC-47 evidence as part of your broader communications protection assessment. The alternate communication paths should be referenced in their broader continuity and incident response procedures, demonstrating integration rather than a standalone checkbox.
Evidence examples
| Evidence Type | Example Artifact |
|---|---|
| Policy documentation | System and communications protection policy defining requirements for alternate communication paths, including activation criteria and delegation of authority |
| Communication path inventory | System design documentation listing primary and alternate communication channels, their infrastructure dependencies, and architectural independence analysis |
| Delegation of authority records | Documented chain of alternative decision makers with defined scope, limitations, and escalation procedures for each alternate communication path |
| Configuration and access documentation | System configuration settings for alternate communication platforms, including access credentials storage location and distribution procedures |
| Test results and exercise reports | Quarterly test records demonstrating successful activation of alternate paths, including participant rosters and findings from tabletop exercises |
| Audit trail | System audit records showing activation events, access attempts, and usage logs for alternate communication systems |
| System security plan | Security plan sections addressing SC-47 implementation, including risk assessment of communication path dependencies and gap analysis |
Cross-framework mapping
No cross-framework mappings have been configured for this control.
Related controls
- CP-02 — Contingency Plan: SC-47’s alternate communication paths feed directly into the organization’s contingency plan, ensuring that the coordination mechanisms needed to execute contingency operations remain available during disruptions.
- CP-08 — Telecommunications Services: Where CP-08 addresses the availability and redundancy of telecommunications services themselves, SC-47 focuses specifically on maintaining command-and-control communication paths that use those services during incidents.
Frequently asked questions
What is NIST SP 800-53 SC-47?
SC-47 is the NIST SP 800-53 control that requires organizations to establish alternate communication paths for system operations and operational command and control. It ensures that when primary communication channels are disrupted by an incident, whether adversarial or accidental, the organization can still coordinate response actions and maintain decision-making authority. The control also requires designating alternative decision makers and documenting the extent and limitations of their delegated authority.
What happens if SC-47 is not implemented?
Without SC-47 implementation, an organization loses the ability to coordinate system operations and incident response when primary communication channels are disrupted. Operational teams can’t receive direction from leadership, alternative decision makers aren’t designated, and response actions stall while the organization scrambles to establish ad hoc communication. Auditors evaluating your NIST SP 800-53 control family posture will flag the absence of documented alternate communication paths as a gap in operational resilience.
How do you audit SC-47?
Auditing SC-47 starts with verifying that the organization has documented alternate communication paths for both system operations and command-and-control functions. Assessors review system design documentation, configuration settings for alternate communication platforms, and test records demonstrating that alternate paths have been exercised. The assessment also confirms that alternative decision makers are designated with clearly defined authority limitations, and that delegation of authority documentation is accessible from the alternate communication paths themselves.
What are examples of alternate communications paths?
Alternate communication paths include cellular-based messaging systems that operate independently of the corporate network, satellite communication devices for scenarios where terrestrial infrastructure is unavailable, and out-of-band radio networks for localized coordination. Organizations also establish pre-arranged agreements with third-party communication services, maintain dedicated phone trees using personal mobile devices, and configure backup collaboration platforms hosted on infrastructure architecturally separate from primary systems. The key requirement is that each alternate path doesn’t share failure modes with the primary communication channels it’s designed to replace.