+CP-10 [H] System Recovery and Reconstitution
---+CP-10(02) [H] Transaction Recovery
---+CP-10(04) [H] Restore Within Time Period
|
CP-10 [H] System Recovery and Reconstitution
Control
Provide for the recovery and reconstitution of the system to a known state within [Assignement: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.
Discussion
Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.
Assessment Objective
- the recovery of the system to a known state is provided within [Assignement: time period] after a disruption, compromise, or failure;
- a reconstitution of the system to a known state is provided within [Assignement: time period] after a disruption, compromise, or failure.
Assessment Method
Examine
Contingency planning policy
procedures addressing system backup
contingency plan
system backup test results
contingency plan test results
contingency plan test documentation
redundant secondary system for system backups
location(s) of redundant secondary backup system(s)
system security plan
other relevant documents or records
Interview
Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities
organizational personnel with information security responsibilities
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|