ComplianceNIST 800-53 control

NIST-CP-10 System Recovery and Reconstitution

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
CP Contingency Planning
Control
CP-10
ATT&CK techniques mitigated
12

Control statement

Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.

Discussion

Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.

ATT&CK mappings (CTID)

• T1485 Data Destruction • T1485.001 Lifecycle-Triggered Deletion • T1486 Data Encrypted for Impact • T1490 Inhibit System Recovery • T1491 Defacement • T1491.001 Internal Defacement • T1491.002 External Defacement • T1561 Disk Wipe • T1561.001 Disk Content Wipe • T1561.002 Disk Structure Wipe • T1565 Data Manipulation • T1565.001 Stored Data Manipulation

Related

Mitigates · MITRE ATT&CK (12)

  • T1485.001 Lifecycle-Triggered Deletion sub-technique
  • T1565 Data Manipulation technique
  • T1565.001 Stored Data Manipulation sub-technique
  • T1491.001 Internal Defacement sub-technique
  • T1491.002 External Defacement sub-technique
  • T1561 Disk Wipe technique
  • T1561.001 Disk Content Wipe sub-technique
  • T1561.002 Disk Structure Wipe sub-technique
  • T1491 Defacement technique
  • T1490 Inhibit System Recovery technique
  • T1486 Data Encrypted for Impact technique
  • T1485 Data Destruction technique

Related control · Compliance (9)

  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-CP-4 Contingency Plan Testing NIST 800-53 control
  • NIST-CP-6 Alternate Storage Site NIST 800-53 control
  • NIST-CP-7 Alternate Processing Site NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-IR-4 Incident Handling NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-24 Fail in Known State NIST 800-53 control
  • NIST-SI-13 Predictable Failure Prevention NIST 800-53 control

Referenced by Compliance · enhancement of (3)

Referenced by Compliance · has member (1)

  • NIST-CP Contingency Planning NIST 800-53 family

Referenced by Compliance · related control (16)

  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-CP-4(4) Full Recovery and Reconstitution NIST 800-53 enhancement
  • NIST-CP-6 Alternate Storage Site NIST 800-53 control
  • NIST-CP-7 Alternate Processing Site NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-MP-2 Media Access NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-PE-3 Physical Access Control NIST 800-53 control
  • NIST-PE-6 Monitoring Physical Access NIST 800-53 control
  • NIST-SA-24 Design For Cyber Resiliency NIST 800-53 control
  • NIST-SA-8(24) Secure Failure and Recovery NIST 800-53 enhancement
  • NIST-SC-24 Fail in Known State NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-13 Predictable Failure Prevention NIST 800-53 control