RC.RP Incident Recovery Plan Execution

Statement

The recovery portion of the incident response plan is executed once initiated from the incident response process

Example

Begin recovery procedures during or after incident response processes

Example

Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans

Statement

Recovery actions are selected, scoped, prioritized, and performed

Example

Select recovery actions based on the criteria defined in the incident response plan and available resources

Example

Change planned recovery actions based on a reassessment of organizational needs and resources

Statement

The integrity of backups and other restoration assets is verified before using them for restoration

Example

Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use

Statement

Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms

Example

Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order

Example

Work with system owners to confirm the successful restoration of systems and the return to normal operations

Example

Monitor the performance of restored systems to verify the adequacy of the restoration

Statement

The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

Example

Check restored assets for indicators of compromise and remediation of root causes of the incident before production use

Example

Verify the correctness and adequacy of the restoration actions taken before putting a restored system online

Statement

The end of incident recovery is declared based on criteria, and incident-related documentation is completed

Example

Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned

Example

Declare the end of incident recovery once the criteria are met