Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

cp-10(4)

information system recovery and reconstitution  | restore within time period

assessment objective:

Determine if the organization:

cp-10(4)[1]

defines a time period to restore information system components from configuration-controlled and integrity-protected information representing a known, operational state for the components; and

cp-10(4)[2]

provides the capability to restore information system components within the organization-defined time period from configuration-controlled and integrity-protected information representing a known, operational state for the components.

potential assessment methods and objects:

Examine: [select from: Contingency planning policy; procedures addressing information system recovery and reconstitution; contingency plan; information system design documentation; information system configuration settings and associated documentation; contingency plan test documentation; contingency plan test results; evidence of information system recovery and reconstitution operations; other relevant documents or records].

Interview: [select from: Organizational personnel with information system recovery and reconstitution responsibilities; organizational personnel with information security responsibilities].

Test: [SELECT FROM: Automated mechanisms supporting and/or implementing recovery/reconstitution of information system information].