Assessment Objective
Determine if:
- CP-10[01] the recovery of the system to a known state is provided within [Assignment: time period] after a disruption, compromise, or failure;
- CP-10[02] a reconstitution of the system to a known state is provided within [Assignment: time period] after a disruption, compromise, or failure.
Assessment Methods
Examine
- Contingency planning policy
- procedures addressing system backup
- contingency plan
- system backup test results
- contingency plan test results
- contingency plan test documentation
- redundant secondary system for system backups
- location(s) of redundant secondary backup system(s)
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes implementing system recovery and reconstitution operations
- mechanisms supporting and/or implementing system recovery and reconstitution operations
Pedidos ligados
| Tipo de ligação | Pedido |
|---|---|
| blocks | CP-10 [M] System Recovery and Reconstitution |