What it covers. NIST guidance on planning for and carrying out recovery after a cybersecurity event. It focuses on the recover function of the Cybersecurity Framework, covering planning, playbooks, metrics and continuous improvement for restoring normal operations.
In practice. Applying it well means understanding dependencies and priorities of systems before an event, preparing recovery playbooks for likely scenarios such as ransomware or data breach, and defining how to restore from trusted sources. Communications with staff, customers and partners are part of recovery. Evidence includes recovery plans, playbooks, test results and post-event improvement records.
Common gaps. Typical gaps are recovery plans that assume backups are clean, no prioritisation of which services to restore first and no review after real incidents. Recovery metrics are also seldom defined.