[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fcp-10":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","cp-10","CP-10","System Recovery and Reconstitution",12,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must provide for recovering and reconstituting the system to a known state within defined time periods consistent with recovery time and recovery point objectives after a disruption, compromise or failure.\n\n**In practice.** This means documented, tested recovery procedures for critical systems, including rebuilding from trusted images and restoring from clean backups, with checks that the restored system is secure before it returns to service. Auditors expect recovery runbooks, test results showing objectives were met and post-recovery validation steps. ISO 22301 and DORA resilience testing cover related ground.\n\n**Common gaps.** Recovery after a cyber attack is often harder than after a technical failure because backups or images may be compromised. Full-scale recovery tests are rare, so objectives are unproven.","Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.\nDiscussion: Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"ransomware-encrypts-36-pb-of-cloud-data-across-495-japanese-government-and-corporate-clients","Ransomware Encrypts 3.6 PB of Cloud Data Across 495 Japanese Government and Corporate Clients","2026-10-08T22:21:40.501+00:00",{"slug":25,"title":26,"published_at":27},"ransomware-groups-now-target-backups-first-recovery-is-no-longer-guaranteed","Ransomware Groups Now Target Backups First — Recovery Is No Longer Guaranteed","2026-10-07T16:21:31.344+00:00",{"slug":29,"title":30,"published_at":31},"microsoft-365-native-backup-falls-short-of-business-data-protection-needs","Microsoft 365 Native Backup Falls Short of Business Data Protection Needs","2026-06-18T14:20:32.243+00:00",{"slug":33,"title":34,"published_at":35},"microsoft-june-2026-updates-break-office-app-launching","Microsoft June 2026 Updates Break Office App Launching","2026-06-17T12:20:24.754+00:00",{"slug":37,"title":38,"published_at":39},"police-department-ransomware-attack-exposes-critical-infrastructure-vulnerabilities","Police Department Ransomware Attack Exposes Critical Infrastructure Vulnerabilities","2026-06-14T22:20:11.461+00:00",{"slug":41,"title":42,"published_at":43},"trugreen-hit-by-inc-ransom-gang---critical-infrastructure-at-risk","TruGreen Hit by INC Ransom Gang - Critical Infrastructure at Risk","2026-04-23T02:09:22.006+00:00",{"slug":45,"title":46,"published_at":47},"destructive-lotus-wiper-targets-critical-infrastructure-with-defense-evasion","Destructive Lotus Wiper Targets Critical Infrastructure with Defense Evasion","2026-04-22T03:09:33.12+00:00",{"slug":49,"title":50,"published_at":51},"new-hyflock-raas-operation-emerges-as-lockbit-competitor","New Hyflock RaaS Operation Emerges as LockBit Competitor","2026-04-13T19:08:21.648+00:00",{"slug":53,"title":54,"published_at":55},"ai-powered-ransomware-detection-enhances-cloud-data-protection","AI-Powered Ransomware Detection Enhances Cloud Data Protection","2026-04-01T08:07:30.542+00:00",{"slug":57,"title":58,"published_at":59},"genesis-ransomware-hits-multiple-sectors-with-double-extortion-tactics","Genesis Ransomware Hits Multiple Sectors with Double-Extortion Tactics","2026-03-31T19:08:28.813+00:00",{"slug":61,"title":62,"published_at":63},"play-ransomware-strikes-10-organizations-across-multiple-industries","PLAY Ransomware Strikes 10 Organizations Across Multiple Industries","2026-03-31T00:07:02.143+00:00",{"slug":65,"title":66,"published_at":67},"threat-actor-compromises-rdp-access-to-disable-backup-infrastructure","Threat Actor Compromises RDP Access to Disable Backup Infrastructure","2026-03-30T18:08:12.106+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",9,{"slug":75,"name":76,"problem":77,"stories":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",7,{"slug":80,"name":81,"problem":82,"stories":83},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",5,{"slug":85,"name":86,"problem":87,"stories":88},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",3,{"slug":90,"name":91,"problem":92,"stories":93},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",2,{"slug":95,"name":96,"problem":97,"stories":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,[100,106,111,115,120,125,129,134],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","11","Control 11","Data Recovery",11,{"family":5,"item":107,"code":108,"title":109,"together":110},"cp-9","CP-9","System Backup",10,{"family":5,"item":112,"code":113,"title":114,"together":78},"ir-4","IR-4","Incident Handling",{"family":116,"item":117,"code":118,"title":119,"together":83},"iso","27035","ISO\u002FIEC 27035","ISO\u002FIEC 27035: Information security incident management",{"family":101,"item":121,"code":122,"title":123,"together":124},"12","Control 12","Network Infrastructure Management",4,{"family":126,"item":127,"code":128,"title":128,"together":124},"itil","overview","ITIL",{"family":130,"item":131,"code":132,"title":133,"together":88},"gdpr","32","Article 32","Security of processing",{"family":101,"item":135,"code":136,"title":137,"together":93},"6","Control 6","Access Control Management"]