THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · CP-10

System Recovery and Reconstitution

US National Institute of Standards and Technology (NIST) · cited in 12 of our lessons

Explanation

What it asks for. The organisation must provide for recovering and reconstituting the system to a known state within defined time periods consistent with recovery time and recovery point objectives after a disruption, compromise or failure.

In practice. This means documented, tested recovery procedures for critical systems, including rebuilding from trusted images and restoring from clean backups, with checks that the restored system is secure before it returns to service. Auditors expect recovery runbooks, test results showing objectives were met and post-recovery validation steps. ISO 22301 and DORA resilience testing cover related ground.

Common gaps. Recovery after a cyber attack is often harder than after a technical failure because backups or images may be compromised. Full-scale recovery tests are rare, so objectives are unproven.

Open SP 800-53 at NIST
The official text
Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure. Discussion: Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.