RC.RP Incident Recovery Plan Execution

Statement

The recovery portion of the incident response plan is executed once initiated from the incident response process

Guidance

Begin recovery procedures during or after incident response processes

Guidance

Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans

Statement

Recovery actions are selected, scoped, prioritized, and performed

Guidance

Select recovery actions based on the criteria defined in the incident response plan and available resources

Guidance

Change planned recovery actions based on a reassessment of organizational needs and resources

Statement

The integrity of backups and other restoration assets is verified before using them for restoration

Guidance

Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use

Statement

Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms

Guidance

Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order

Guidance

Work with system owners to confirm the successful restoration of systems and the return to normal operations

Guidance

Monitor the performance of restored systems to verify the adequacy of the restoration

Statement

The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

Guidance

Check restored assets for indicators of compromise and remediation of root causes of the incident before production use

Guidance

Verify the correctness and adequacy of the restoration actions taken before putting a restored system online

Statement

The end of incident recovery is declared based on criteria, and incident-related documentation is completed

Guidance

Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned

Guidance

Declare the end of incident recovery once the criteria are met