Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

cp-10

information system recovery and reconstitution

assessment objective:

Determine if the organization provides for:

cp-10[1]

the recovery of the information system to a known state after:

cp-10[1][a]

a disruption;

cp-10[1][b]

a compromise; or

cp-10[1][c]

a failure;

cp-10[2]

the reconstitution of the information system to a known state after:

cp-10[2][a]

a disruption;

cp-10[2][b]

a compromise; or

cp-10[2][c]

a failure.

potential assessment methods and objects:

Examine: [select from: Contingency planning policy; procedures addressing information system backup; contingency plan; information system backup test results; contingency plan test results; contingency plan test documentation; redundant secondary system for information system backups; location(s) of redundant secondary backup system(s); other relevant documents or records].

Interview: [select from: Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities; organizational personnel with information security responsibilities].

Test: [SELECT FROM: Organizational processes implementing information system recovery and reconstitution operations; automated mechanisms supporting and/or implementing information system recovery and reconstitution operations].