{"data":{"id":"CP-10","name":"System Recovery and Reconstitution","family":"CP","family_name":"Contingency Planning","withdrawn":false,"description":"Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.","supplemental_guidance":"Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.","enhancements":[{"id":"CP-10(01)","name":"Contingency Plan Testing","withdrawn":true,"incorporated_into":["CP-04"]},{"id":"CP-10(02)","name":"Transaction Recovery","statement":"Implement transaction recovery for systems that are transaction-based.","baselines":["moderate","high"]},{"id":"CP-10(03)","name":"Compensating Security Controls","withdrawn":true,"incorporated_into":[]},{"id":"CP-10(04)","name":"Restore Within Time Period","statement":"Provide the capability to restore system components within [Assignment: organization-defined restoration time periods] from configuration-controlled and integrity-protected information representing a known, operational state for the components.","baselines":["high"]},{"id":"CP-10(05)","name":"Failover Capability","withdrawn":true,"incorporated_into":["SI-13"]},{"id":"CP-10(06)","name":"Component Protection","statement":"Protect system components used for recovery and reconstitution.","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CP-10","name":"System Recovery and Reconstitution","description":"Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.","discussion":"Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.","related_controls":["CP-02","CP-04","CP-06","CP-07","CP-09","IR-04","SA-08","SC-24","SI-13"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Title changed from 'Information System Recovery and Reconstitution' Parameter adds specific recovery time and recovery point objectives"}},"compliance_mappings":{"iso_27001_2022":["A.5.29","A.5.30"],"iso_27002_2022":["5.29","5.30"],"cobit_2019":["DSS04"],"pci_dss_v4":[],"nist_csf_2":["PR.IR-03","RC.RP-01","RC.RP-02","RC.RP-04","RC.RP-05","RS.MA-05"],"cis_controls_v8":["CIS 11"],"soc2_tsc":["A1.2","A1.2-POF1","A1.2-POF2","A1.2-POF3","CC7.4-POF5","CC7.5","CC9.1","CC9.1-POF1"],"finos_ccc":["CCC-C13"],"iso_42001_2023":["A.4.5"],"iec_62443":["3-3 SR 7.3","3-3 SR 7.4"],"asd_e8":["E8-8"],"nis2":["Art. 21(2)(c)"],"apra_cps_234":[],"mas_trm":["8"],"pra_op_resilience":[],"bsi_grundschutz":["DER.4"],"anssi":["Hygiene.30","Hygiene.35","SecNumCloud.18.3"],"osfi_b13":["B-13.2.6","B-13.3.4"],"finma_circular":["IV.C(70)","IV.D(71)","IV.D(72)","IV.E(89)","IV.E(90)"],"gdpr":["Art.32(1)(c)","Art.32(1)(d)"],"dora":["Art.11(1)","Art.11(2)","Art.11(4)"],"bio2":["5.29","5.30"],"rbi_csf":["Annex1.19","ITGRCA.29"],"fisc":["FISC.O5"],"lgpd_bcb":["BCB.Art.3"],"hkma_tme1":["TME1.6.2","TME1.6.5"],"mlps_2":["8.1.4.9","8.1.10.9"],"dnb_good_practice":["DNB.11.1","DNB.11.4"],"cra":["CRA.I.2h"],"swift_cscf":[],"cbb_tm":["TM-14"],"cbuae":["CR-13"],"nca_ecc":["2-9","3-1","3-2"],"qatar_nia":["BC","OS"],"uae_ia":["T12"],"bog_cisd":["CISD-BCM"],"bom_ctrm":["5.2"],"cbe_csf":["OVM-2"],"cbn_csf":["Part3.6","Part3.7"],"popia":["s19"],"sa_js2":["JS2-7.5"],"bcbs_239":["Principle 5"],"bot_cyber":["Ch4.2"],"cpmi_pfmi":["CG.RR","PFMI.P17"],"eba_ict":["3.7.2","3.7.3"],"ecb_croe":["CROE.2.5.2"],"ffiec_is":["III.D"],"hipaa_sr":["§164.308(a)(7)(i)","§164.308(a)(7)(ii)(B)","§164.308(a)(7)(ii)(C)","§164.312(a)(2)(ii)"],"iosco_cyber":["PFMI-17","RR-2","RR-3"],"nydfs_500":["500.16"],"sebi_cscrf":["BCP-DR","RC.RP"],"nerc_cip":["CIP-009-6"],"nrc_73_54":["RG5.71-B-CP"],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["RESPONSE"],"api_1164":["Sec 11"],"awia":[],"iaea_nss":["Sec 8"],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.8.1","SYSC 13.8.2"],"fda_21_cfr_11":["§11.10(c)"],"fda_cyber":["SA-6"],"hitrust_csf":["09.d","12.b"],"iso_27799":["9.2","17.2"],"lloyds_ms":["CRM.3","MS8.6"],"naic_ds":["4F-b"],"nhs_dspt":["NDG-7.2"],"pra_ss1_23":["P-IT.3"],"solvency_ii":["DR.266-BCP","EIOPA-ICT-4.10"],"owasp_masvs_v2":[],"csa_ccm_v4":["BCR-09","CCC-09"],"csa_aicm":["BCR-09","CCC-09"],"ccss_v9":["1.03.2"],"mica":["Art.62(6)","Art.68(5)"],"basel_sco60":["SCO60.21","SCO60.23","SCO60.53","SCO60.63"],"bssc":["GSP-06","KMS-10","NOS-07"],"sec_custody_digital":["SEC-CD-12"],"dpdpa":["Rules.6(1)(d)"]},"attack_techniques":[{"id":"T1485","name":"Data Destruction","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"System recovery and reconstitution capabilities—including tested backup restoration procedures and geographically distributed backups—enable organizations to recover from data destruction attacks by restoring data from verified backup copies."},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Recovery mechanisms with immutable backups, offline backup copies, and tested restoration procedures directly counter ransomware encryption by enabling data restoration without paying ransom demands."},{"id":"T1490","name":"Inhibit System Recovery","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Recovery and reconstitution procedures that maintain independent backup infrastructure—including offsite and air-gapped copies—negate adversary attempts to inhibit system recovery by ensuring backup access survives attack."},{"id":"T1491","name":"Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"System reconstitution procedures that restore web content, application configurations, and system images from known-good baselines enable rapid recovery from defacement attacks by reverting to pre-attack states."},{"id":"T1561","name":"Disk Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Recovery capabilities with bare-metal restore procedures, system image backups, and hardware replacement plans enable reconstitution of systems after disk wipe attacks by rebuilding from independently stored images."},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"System reconstitution to known-good states from verified backups counters data manipulation by enabling organizations to restore data integrity after adversaries have altered stored, transmitted, or runtime data."},{"id":"T1485.001","name":"Lifecycle-Triggered Deletion","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Recovery procedures that maintain multiple backup generations and immutable storage prevent lifecycle-triggered deletion from destroying all data copies by ensuring backups exist outside adversary-manipulated retention policies."},{"id":"T1491.001","name":"Internal Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Reconstitution procedures that restore internal applications and intranet content from verified baselines enable rapid recovery from internal defacement by reverting modified content to known-good states."},{"id":"T1491.002","name":"External Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Recovery procedures with pre-staged web content, DNS failover, and CDN-based restoration enable rapid reconstitution of public-facing services after external defacement attacks damage organizational reputation."},{"id":"T1561.001","name":"Disk Content Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Recovery from disk content wipes through bare-metal restore procedures, validated backup images, and hardware replacement plans enables system reconstitution when adversaries overwrite disk content."},{"id":"T1561.002","name":"Disk Structure Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Recovery from disk structure wipes through complete system rebuild procedures, UEFI restoration, and partition table recovery from backup metadata enables reconstitution after structural disk destruction."},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Recovery procedures that restore data from pre-manipulation backups with integrity verification counter stored data manipulation by enabling rollback to verified data states unaffected by adversary tampering."}],"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"corrective","used_by_patterns":["SP-001","SP-002","SP-008","SP-023","SP-025","SP-031","SP-034","SP-036","SP-054"]}}