Navigate

CP-10

CP-10: Information System Recovery and Reconstitution

The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

Supplemental

Recovery is executing information system contingency plan activities to restore organizational missions/business functions. Reconstitution takes place following recovery and includes activities for returning organizational information systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities, recovery point/time and reconstitution objectives, and established organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of any interim information system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored information system capabilities, reestablishment of continuous monitoring activities, potential information system reauthorizations, and activities to prepare the systems against future disruptions, compromises, or failures. Recovery/reconstitution capabilities employed by organizations can include both automated mechanisms and manual procedures.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	high

Overlays
Privacy (High), Privacy (Mod), Privacy (PHI)

CSF Categories
RC.RP-1, RS.RP-1

Related Controls

The controls below (if any) were marked by NIST as being related to CP-10.

Control	Description
CA-2	The organization: a: Develops a security assessment plan that describes the scope of the assessment including: 1: Security controls and control enhancements under assessment; 2: Assessment procedures to be used to determine security control effectiveness; and 3: Assessment environment, assessment team, and assessment roles and responsibilities; b: Assesses the security controls in the information system and its environment of operation [organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; c: Produces a security assessment report that documents the results of the assessment; and d: Provides the results of the security control assessment to [organization-defined individuals or roles].
CA-6	The organization: a: Assigns a senior-level executive or manager as the authorizing official for the information system; b: Ensures that the authorizing official authorizes the information system for processing before commencing operations; and c: Updates the security authorization [organization-defined frequency].
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: a: Establishment of [organization-defined metrics] to be monitored; b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring; c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; e: Correlation and analysis of security-related information generated by assessments and monitoring; f: Response actions to address results of the analysis of security-related information; and g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].
CP-2	The organization: a: Develops a contingency plan for the information system that: 1: Identifies essential missions and business functions and associated contingency requirements; 2: Provides recovery objectives, restoration priorities, and metrics; 3: Addresses contingency roles, responsibilities, assigned individuals with contact information; 4: Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure; 5: Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and 6: Is reviewed and approved by [organization-defined personnel or roles]; b: Distributes copies of the contingency plan to [organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; c: Coordinates contingency planning activities with incident handling activities; d: Reviews the contingency plan for the information system [organization-defined frequency]; e: Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f: Communicates contingency plan changes to [organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and g: Protects the contingency plan from unauthorized disclosure and modification.
CP-6	The organization: a: Establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information; and b: Ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.
CP-7	The organization: a: Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [organization-defined information system operations] for essential missions/business functions within [organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable; b: Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and c: Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.
CP-9	The organization: a: Conducts backups of user-level information contained in the information system [organization-defined frequency consistent with recovery time and recovery point objectives]; b: Conducts backups of system-level information contained in the information system [organization-defined frequency consistent with recovery time and recovery point objectives]; c: Conducts backups of information system documentation including security-related documentation [organization-defined frequency consistent with recovery time and recovery point objectives]; and d: Protects the confidentiality, integrity, and availability of backup information at storage locations.
SC-24	The information system fails to a [organization-defined known-state] for [organization-defined types of failures] preserving [organization-defined system state information] in failure.

Enhancements

The controls below (if any) add on to the requirements of CP-10.

Control	Description
CP-10(1)
CP-10(2)	The information system implements transaction recovery for systems that are transaction-based.
CP-10(3)
CP-10(4)	The organization provides the capability to restore information system components within [organization-defined restoration time-periods] from configuration-controlled and integrity-protected information representing a known, operational state for the components.
CP-10(5)
CP-10(6)	The organization protects backup and restoration hardware, firmware, and software.

Related CCIs

The CCIs below are tied to CP-10.

CCI	Definition
CCI-000550	The organization provides for the recovery and reconstitution of the information system to a known state after a disruption.
CCI-000551	The organization provides for the recovery and reconstitution of the information system to a known state after a compromise.
CCI-000552	The organization provides for the recovery and reconstitution of the information system to a known state after a failure.