CP-10: System Recovery and Reconstitution
Control Family:
PF v1.0 References:
Threats Addressed:
Baselines:
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- CP-10: Information System Recovery And Reconstitution
Control Statement
Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.
Supplemental Guidance
Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.
OT Discussion
Reconstitution of the OT includes considering whether system state variables should be restored to initial values or the values before disruption (e.g., are valves restored to full open, full closed, or settings prior to disruption). Restoring system state variables may be disruptive to ongoing physical processes (e.g., valves initially closed may adversely affect system cooling).
Control Enhancements
CP-10(2): Transaction Recovery
Baseline(s):
- Moderate
- High
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Implement transaction recovery for systems that are transaction-based.
CP-10(4): Restore Within Time Period
Baseline(s):
- High
- OT High (SP 800-82r3)
Provide the capability to restore system components within [Assignment: organization-defined restoration time periods] from configuration-controlled and integrity-protected information representing a known, operational state for the components.
CP-10(6): Component Protection
Baseline(s):
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Protect system components used for recovery and reconstitution.