+RC.RP Incident Recovery Plan Execution
---+RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
---+RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed
---+RC.RP-03 The integrity of backups and other restoration assets is verified before using them for restoration
---+RC.RP-04 Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms
---+RC.RP-05 The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed
---+RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed

RC.RP Incident Recovery Plan Execution

Statement

Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents

1. Przegląd

RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process

Statement

The recovery portion of the incident response plan is executed once initiated from the incident response process

Guidance

Begin recovery procedures during or after incident response processes

Guidance

Make all individuals with recovery responsibilities aware of the plans for recovery and the authorizations required to implement each aspect of the plans
RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed

Statement

Recovery actions are selected, scoped, prioritized, and performed

Guidance

Select recovery actions based on the criteria defined in the incident response plan and available resources

Guidance

Change planned recovery actions based on a reassessment of organizational needs and resources
RC.RP-03 The integrity of backups and other restoration assets is verified before using them for restoration

Statement

The integrity of backups and other restoration assets is verified before using them for restoration

Guidance

Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use
RC.RP-04 Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms

Statement

Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms

Guidance

Use business impact and system categorization records (including service delivery objectives) to validate that essential services are restored in the appropriate order

Guidance

Work with system owners to confirm the successful restoration of systems and the return to normal operations

Guidance

Monitor the performance of restored systems to verify the adequacy of the restoration
RC.RP-05 The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

Statement

The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

Guidance

Check restored assets for indicators of compromise and remediation of root causes of the incident before production use

Guidance

Verify the correctness and adequacy of the restoration actions taken before putting a restored system online
RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed

Statement

The end of incident recovery is declared based on criteria, and incident-related documentation is completed

Guidance

Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned

Guidance

Declare the end of incident recovery once the criteria are met

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania

3. Powiązane regulacje

Regulacje

Powiązane zgłoszenia

Powiązania
is blocked by Identify Critical Assets
is blocked by Business Continuity Management System (BCMS)
is blocked by Recovery Time / Point Objectives (RTO / RPO)
is blocked by Resume All Missions & Business Functions
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.