What it asks for. In CSF 1.1 this Recover category required recovery processes and procedures to be executed and maintained to restore systems or assets affected by incidents. CSF 2.0 renamed it Incident Recovery Plan Execution and broadened it to include verifying backups, prioritising restoration and declaring the end of recovery.
In practice. Recovery plans define priorities based on business impact, recovery time and point objectives, and the steps to restore systems from trusted sources. The integrity of restored assets is verified before return to production. Evidence includes recovery plans, restore tests, recovery records from incidents and post recovery reviews.
Common gaps. Recovery objectives are often set without testing whether they are achievable. Restoring from backups that may contain the attacker's foothold is a frequent risk in ransomware cases.